Edit tour

Windows Analysis Report
doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Overview

General Information

Sample name:	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Analysis ID:	1509224
MD5:	72c1f40eafabdcdb3662d1dad9ee2230
SHA1:	7c7ad3ba48bf9ce3e2b487d98b6a66d4d631892a
SHA256:	fd3b039df3e9a565b6964276f98c61d4555f3f3dabf1a9d76604f9ff4d4b3fb7
Tags:	exe
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

doc_Zapytanie - Oferta POLSKA 91044PL.com.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

doc_Zapytanie - Oferta POLSKA 91044PL.com.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

schtasks.exe (PID: 7544 cmdline: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

workbook.exe (PID: 7596 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

workbook.exe (PID: 7720 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

schtasks.exe (PID: 7764 cmdline: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5164 cmdline: "schtasks" /delete /tn "workbook" /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5040 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 2124 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

PING.EXE (PID: 6556 cmdline: ping -n 10 localhost MD5: B3624DD758CCECF93A1226CEF252CA12)

workbook.exe (PID: 7684 cmdline: C:\Users\user\AppData\Roaming\SubDir\workbook.exe MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

workbook.exe (PID: 7896 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

workbook.exe (PID: 7904 cmdline: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" MD5: 72C1F40EAFABDCDB3662D1DAD9EE2230)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;", "SubDirectory": "SubDir", "InstallName": "workbook.exe", "MutexName": "0235e291-5d04-4fa3-932c-869aeec51499", "StartupKey": "workbook", "Tag": "Long Leg", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7496	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 7596	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 7596	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: workbook.exe PID: 7684	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: workbook.exe PID: 7684	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: workbook.exe PID: 7720	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef4d:$x1: Quasar.Common.Messages 0x29f276:$x1: Quasar.Common.Messages 0x2ab83a:$x4: Uninstalling... good bye :-( 0x2ad02f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadec:$f1: FileZilla\recentservers.xml 0x2aae2c:$f2: FileZilla\sitemanager.xml 0x2aae6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0ba:$b1: Chrome\User Data\ 0x2ab110:$b1: Chrome\User Data\ 0x2ab3e8:$b2: Mozilla\Firefox\Profiles 0x2ab4e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab63c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6f6:$b5: YandexBrowser\User Data\ 0x2ab764:$b5: YandexBrowser\User Data\ 0x2ab438:$s4: logins.json 0x2ab16e:$a1: username_value 0x2ab18c:$a2: password_value 0x2ab478:$a3: encryptedUsername 0x2fd384:$a3: encryptedUsername 0x2ab49c:$a4: encryptedPassword 0x2fd3a2:$a4: encryptedPassword 0x2fd320:$a5: httpRealm
2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab924:$s3: Process already elevated. 0x28ec4c:$s4: get_PotentiallyVulnerablePasswords 0x278d08:$s5: GetKeyloggerLogsDirectory 0x29e9d5:$s5: GetKeyloggerLogsDirectory 0x28ec6f:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d14d:$x1: Quasar.Common.Messages 0x29d476:$x1: Quasar.Common.Messages 0x2a9a3a:$x4: Uninstalling... good bye :-( 0x2ab22f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fec:$f1: FileZilla\recentservers.xml 0x2a902c:$f2: FileZilla\sitemanager.xml 0x2a906e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a92ba:$b1: Chrome\User Data\ 0x2a9310:$b1: Chrome\User Data\ 0x2a95e8:$b2: Mozilla\Firefox\Profiles 0x2a96e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb640:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a983c:$b4: Opera Software\Opera Stable\Login Data 0x2a98f6:$b5: YandexBrowser\User Data\ 0x2a9964:$b5: YandexBrowser\User Data\ 0x2a9638:$s4: logins.json 0x2a936e:$a1: username_value 0x2a938c:$a2: password_value 0x2a9678:$a3: encryptedUsername 0x2fb584:$a3: encryptedUsername 0x2a969c:$a4: encryptedPassword 0x2fb5a2:$a4: encryptedPassword 0x2fb520:$a5: httpRealm
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9b24:$s3: Process already elevated. 0x28ce4c:$s4: get_PotentiallyVulnerablePasswords 0x276f08:$s5: GetKeyloggerLogsDirectory 0x29cbd5:$s5: GetKeyloggerLogsDirectory 0x28ce6f:$s6: set_PotentiallyVulnerablePasswords 0x2fcc6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
6.2.workbook.exe.3b6c688.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.workbook.exe.3b6c688.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d14d:$x1: Quasar.Common.Messages 0x29d476:$x1: Quasar.Common.Messages 0x2a9a3a:$x4: Uninstalling... good bye :-( 0x2ab22f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.workbook.exe.3b6c688.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fec:$f1: FileZilla\recentservers.xml 0x2a902c:$f2: FileZilla\sitemanager.xml 0x2a906e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a92ba:$b1: Chrome\User Data\ 0x2a9310:$b1: Chrome\User Data\ 0x2a95e8:$b2: Mozilla\Firefox\Profiles 0x2a96e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb640:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a983c:$b4: Opera Software\Opera Stable\Login Data 0x2a98f6:$b5: YandexBrowser\User Data\ 0x2a9964:$b5: YandexBrowser\User Data\ 0x2a9638:$s4: logins.json 0x2a936e:$a1: username_value 0x2a938c:$a2: password_value 0x2a9678:$a3: encryptedUsername 0x2fb584:$a3: encryptedUsername 0x2a969c:$a4: encryptedPassword 0x2fb5a2:$a4: encryptedPassword 0x2fb520:$a5: httpRealm
6.2.workbook.exe.3b6c688.1.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9b24:$s3: Process already elevated. 0x28ce4c:$s4: get_PotentiallyVulnerablePasswords 0x276f08:$s5: GetKeyloggerLogsDirectory 0x29cbd5:$s5: GetKeyloggerLogsDirectory 0x28ce6f:$s6: set_PotentiallyVulnerablePasswords 0x2fcc6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef4d:$x1: Quasar.Common.Messages 0x29f276:$x1: Quasar.Common.Messages 0x2ab83a:$x4: Uninstalling... good bye :-( 0x2ad02f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadec:$f1: FileZilla\recentservers.xml 0x2aae2c:$f2: FileZilla\sitemanager.xml 0x2aae6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0ba:$b1: Chrome\User Data\ 0x2ab110:$b1: Chrome\User Data\ 0x2ab3e8:$b2: Mozilla\Firefox\Profiles 0x2ab4e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab63c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6f6:$b5: YandexBrowser\User Data\ 0x2ab764:$b5: YandexBrowser\User Data\ 0x2ab438:$s4: logins.json 0x2ab16e:$a1: username_value 0x2ab18c:$a2: password_value 0x2ab478:$a3: encryptedUsername 0x2fd384:$a3: encryptedUsername 0x2ab49c:$a4: encryptedPassword 0x2fd3a2:$a4: encryptedPassword 0x2fd320:$a5: httpRealm
0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab924:$s3: Process already elevated. 0x28ec4c:$s4: get_PotentiallyVulnerablePasswords 0x278d08:$s5: GetKeyloggerLogsDirectory 0x29e9d5:$s5: GetKeyloggerLogsDirectory 0x28ec6f:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
6.2.workbook.exe.3b6c688.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.workbook.exe.3b6c688.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.workbook.exe.3b6c688.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef4d:$x1: Quasar.Common.Messages 0x29f276:$x1: Quasar.Common.Messages 0x5ac36d:$x1: Quasar.Common.Messages 0x5bc696:$x1: Quasar.Common.Messages 0x2ab83a:$x4: Uninstalling... good bye :-( 0x5c8c5a:$x4: Uninstalling... good bye :-( 0x2ad02f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ... 0x5ca44f:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.workbook.exe.3b6c688.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadec:$f1: FileZilla\recentservers.xml 0x5c820c:$f1: FileZilla\recentservers.xml 0x2aae2c:$f2: FileZilla\sitemanager.xml 0x5c824c:$f2: FileZilla\sitemanager.xml 0x2aae6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5c828e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0ba:$b1: Chrome\User Data\ 0x2ab110:$b1: Chrome\User Data\ 0x5c84da:$b1: Chrome\User Data\ 0x5c8530:$b1: Chrome\User Data\ 0x2ab3e8:$b2: Mozilla\Firefox\Profiles 0x5c8808:$b2: Mozilla\Firefox\Profiles 0x2ab4e4:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd440:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5c8904:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x61a860:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab63c:$b4: Opera Software\Opera Stable\Login Data 0x5c8a5c:$b4: Opera Software\Opera Stable\Login Data 0x2ab6f6:$b5: YandexBrowser\User Data\ 0x2ab764:$b5: YandexBrowser\User Data\ 0x5c8b16:$b5: YandexBrowser\User Data\
6.2.workbook.exe.3b6c688.1.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x482336:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab924:$s3: Process already elevated. 0x5c8d44:$s3: Process already elevated. 0x28ec4c:$s4: get_PotentiallyVulnerablePasswords 0x5ac06c:$s4: get_PotentiallyVulnerablePasswords 0x278d08:$s5: GetKeyloggerLogsDirectory 0x29e9d5:$s5: GetKeyloggerLogsDirectory 0x596128:$s5: GetKeyloggerLogsDirectory 0x5bbdf5:$s5: GetKeyloggerLogsDirectory 0x28ec6f:$s6: set_PotentiallyVulnerablePasswords 0x5ac08f:$s6: set_PotentiallyVulnerablePasswords 0x2fea6e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x61be8e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\workbook.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\workbook.exe, ParentProcessId: 7720, ParentProcessName: workbook.exe, ProcessCommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, ProcessId: 7764, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe", ParentImage: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, ParentProcessId: 7496, ParentProcessName: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, ProcessCommandLine: "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f, ProcessId: 7544, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T10:25:15.454254+0200	2035595	1	Domain Observed Used for C2 Detected	213.159.74.80	9792	192.168.2.4	49735	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T10:25:15.454254+0200	2027619	1	Domain Observed Used for C2 Detected	213.159.74.80	9792	192.168.2.4	49735	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat

Avira: detection malicious, Label: BAT/Delbat.C

Found malware configuration

Source: 6.2.workbook.exe.3b6c688.1.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;", "SubDirectory": "SubDir", "InstallName": "workbook.exe", "MutexName": "0235e291-5d04-4fa3-932c-869aeec51499", "StartupKey": "workbook", "Tag": "Long Leg", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Multi AV Scanner detection for domain / URL

Source: twart.myfirewall.org	Virustotal: Detection: 10%			Perma Link
Source: twart.myfirewall.org	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Virustotal: Detection: 31%			Perma Link
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	ReversingLabs: Detection: 18%

Yara detected Quasar RAT

Source: Yara match	File source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7720, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Joe Sandbox ML: detected

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: CEnL.pdbSHA256(53 source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, workbook.exe.2.dr
Source:	Binary string: CEnL.pdb source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, workbook.exe.2.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 213.159.74.80:9792 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 213.159.74.80:9792 -> 192.168.2.4:49735

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: twart.myfirewall.org

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49735 -> 213.159.74.80:9792

Source: Joe Sandbox View	IP Address: 213.159.74.80 213.159.74.80
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: CTINET-ASCTINETAutonomousSystemRU CTINET-ASCTINETAutonomousSystemRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: twart.myfirewall.org
Source: global traffic	DNS traffic detected: DNS query: ipwho.is

Source: workbook.exe, 00000007.00000002.2339113373.0000000001985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: workbook.exe, 00000007.00000002.2339113373.0000000001985000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: workbook.exe, 00000007.00000002.2341312292.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: workbook.exe, 00000007.00000002.2341312292.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: workbook.exe, 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: workbook.exe, 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1808999815.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2341312292.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789220021.0000000005810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com.
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: workbook.exe, 00000007.00000002.2341312292.0000000003696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2341312292.0000000003696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2341312292.0000000003512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7720, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_0134D344	0_2_0134D344
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A1E7D0	0_2_07A1E7D0
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A107F9	0_2_07A107F9
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A185A0	0_2_07A185A0
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A14140	0_2_07A14140
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A1A080	0_2_07A1A080
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A1AE68	0_2_07A1AE68
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A19C48	0_2_07A19C48
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A1AA30	0_2_07A1AA30
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 0_2_07A10808	0_2_07A10808
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 2_2_0148F03C	2_2_0148F03C
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 2_2_05419068	2_2_05419068
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 2_2_05410508	2_2_05410508
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 2_2_05410518	2_2_05410518
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Code function: 2_2_05419EE0	2_2_05419EE0
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 5_2_00E4D344	5_2_00E4D344
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_026CD344	6_2_026CD344
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_0188F03C	7_2_0188F03C
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_085CDC50	7_2_085CDC50
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_085C7E48	7_2_085C7E48
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 11_2_02DBF03C	11_2_02DBF03C

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1790894206.0000000008EF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1780683199.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGB-lesson-forms.dll@ vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000000.1749779539.0000000000A5A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCEnL.exe@ vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1779498530.000000000108E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Binary or memory string: OriginalFilenameCEnL.exe@ vs doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@29/7@2/2

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\0235e291-5d04-4fa3-932c-869aeec51499
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

File created: C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" "

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Virustotal: Detection: 31%
Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

File read: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /delete /tn "workbook" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /delete /tn "workbook" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static file information: File size 3701760 > 1048576

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x387000

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: CEnL.pdbSHA256(53 source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, workbook.exe.2.dr
Source:	Binary string: CEnL.pdb source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, workbook.exe.2.dr

Source: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Static PE information: 0xE9F7EC64 [Sat May 22 04:00:36 2094 UTC]

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_026C47B0 push ebp; retf	6_2_026C4815
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 6_2_026C5EDD push edi; retf	6_2_026C5EDE
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Code function: 7_2_085C9AEC push FFFFFF8Bh; iretd	7_2_085C9AF0

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

File created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	File opened: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\workbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\workbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7684, type: MEMORYSTR

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 99B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: A9B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: B040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: C040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 2E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Memory allocated: 4E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 9130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: B6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 9070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: A5F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: B5F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: BA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 1880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 34E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 3400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Window / User API: threadDelayed 6184			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Window / User API: threadDelayed 3453			Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe TID: 7368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe TID: 7540	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7840	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7884	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe TID: 7936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: workbook.exe, 00000007.00000002.2362697689.0000000005E60000.00000004.00000020.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2365532678.0000000005E78000.00000004.00000020.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2362697689.0000000005E2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Memory written: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe "C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\workbook.exe "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /delete /tn "workbook" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\workbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\workbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7720, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 2.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.a50fe58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.workbook.exe.3b6c688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7684, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: workbook.exe PID: 7720, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	111 Process Injection	1 Obfuscated Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Timestomp	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	31%	Virustotal	Browse
doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	18%	ReversingLabs
doc_Zapytanie - Oferta POLSKA 91044PL.com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\AppData\Roaming\SubDir\workbook.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SubDir\workbook.exe	18%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipwho.is	0%	Virustotal	Browse
twart.myfirewall.org	10%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/14436606/23354	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://api.ipify.org/	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designersG	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/14436606/23354	0%	Virustotal		Browse
http://www.fontbureau.com/designers?	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designersG	0%	Virustotal		Browse
https://api.ipify.org/	0%	Virustotal		Browse
twart.myfirewall.org	0%	Avira URL Cloud	safe
http://ipwho.isd	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers?	0%	Virustotal		Browse
http://www.goodfont.co.kr	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.fontbureau.com/designers/?	0%	Virustotal		Browse
twart.myfirewall.org	10%	Virustotal		Browse
http://www.carterandcone.coml	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	Avira URL Cloud	safe
http://www.sakkal.com.	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.typography.netD	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Virustotal		Browse
http://www.fontbureau.com/designers/cabarga.htmlN	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/d	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	Virustotal		Browse
http://www.sakkal.com.	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/frere-user.html	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	Virustotal		Browse
https://stackoverflow.com/q/11564914/23354;	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/d	0%	Virustotal		Browse
http://www.galapagosdesign.com/staff/dennis.htm	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
https://ipwho.is	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	Avira URL Cloud	safe
http://www.fonts.com	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers8	0%	Avira URL Cloud	safe
https://ipwho.is	0%	Virustotal		Browse
http://www.galapagosdesign.com/DPlease	0%	Virustotal		Browse
http://www.fontbureau.com/designers/frere-user.html	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/	0%	Virustotal		Browse
http://www.sandoll.co.kr	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Virustotal		Browse
https://stackoverflow.com/q/11564914/23354;	0%	Virustotal		Browse
http://www.fonts.com	0%	Virustotal		Browse
http://www.urwpp.deDPlease	0%	Avira URL Cloud	safe
https://stackoverflow.com/q/2152978/23354sCannot	0%	Avira URL Cloud	safe
https://ipwho.is/	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers8	0%	Virustotal		Browse
http://www.sandoll.co.kr	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	Avira URL Cloud	safe
http://ipwho.is	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Virustotal		Browse
https://stackoverflow.com/q/2152978/23354sCannot	0%	Virustotal		Browse
http://www.sakkal.com	0%	Virustotal		Browse
https://ipwho.is/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipwho.is	195.201.57.90	true	false	0%, Virustotal, Browse	unknown
twart.myfirewall.org	213.159.74.80	true	true	10%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	87.248.204.0	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
twart.myfirewall.org	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipwho.is/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2341312292.0000000003512000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	workbook.exe, 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ipwho.isd	workbook.exe, 00000007.00000002.2341312292.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sakkal.com.	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789220021.0000000005810000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.typography.netD	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/d	workbook.exe, 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipwho.is	workbook.exe, 00000007.00000002.2341312292.0000000003696000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fonts.com	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, workbook.exe, 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000002.00000002.1808999815.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, workbook.exe, 00000007.00000002.2341312292.00000000034EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe, 00000000.00000002.1789262166.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ipwho.is	workbook.exe, 00000007.00000002.2341312292.00000000036A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.159.74.80	twart.myfirewall.org	Russian Federation		13078	CTINET-ASCTINETAutonomousSystemRU	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509224
Start date and time:	2024-09-11 10:24:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@29/7@2/2
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 248 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 87.248.204.0
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target workbook.exe, PID 7720 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:25:06	API Interceptor	1x Sleep call for process: doc_Zapytanie - Oferta POLSKA 91044PL.com.exe modified
04:25:10	API Interceptor	2137x Sleep call for process: workbook.exe modified
09:25:10	Task Scheduler	Run new task: workbook path: C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
213.159.74.80	doc_Zapytanie - Oferta KH 09281.com.exe	Get hash	malicious	Quasar	Browse
	doc_rfq Oferta KH 09281.pdf.com.exe	Get hash	malicious	Quasar	Browse
	Client.exe	Get hash	malicious	Quasar	Browse
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	doc_Zapytanie - Oferta KH 09281.com.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	doc_rfq Oferta KH 09281.pdf.com.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	bin homebots io.bat	Get hash	malicious	Unknown	Browse	195.201.57.90
	yJrZoOsgfl.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	IMKssbDprn.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	WBmC56ADQF.lnk	Get hash	malicious	Unknown	Browse	195.201.57.90
	uScqjqUS1m.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	CVSIyqGKKK.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	Client.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	AdjustLoader.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
twart.myfirewall.org	doc_Zapytanie - Oferta KH 09281.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	doc_rfq Oferta KH 09281.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Client.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse	213.159.74.80
	doc_RFQ NEW ORDER #2400228341.pdf.exe	Get hash	malicious	AsyncRAT	Browse	41.151.251.119
	doc_Rfq_TNTM #U00daj rend TM00002916620 exp_pdf.exe	Get hash	malicious	XWorm	Browse	103.35.191.158
windowsupdatebg.s.llnwi.net	http://mipco.ae/	Get hash	malicious	Unknown	Browse	87.248.202.1
	http://brisbanepowerhouse.org	Get hash	malicious	Unknown	Browse	87.248.205.0
	http://14792bf6.helper3002-eiir3332321.pages.dev/help	Get hash	malicious	Unknown	Browse	87.248.205.0
	https://experthelpdesknotice.weebly.com/	Get hash	malicious	Unknown	Browse	46.228.146.128
	http://is.gd/af4MWe?US=937448/	Get hash	malicious	Unknown	Browse	178.79.238.0
	http://web.telgram.lol/	Get hash	malicious	Unknown	Browse	46.228.146.0
	https://homepage--coinbase-fec.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	41.63.96.0
	https://interior.dipttiikhannadesigns.com/330856818500593584526057bi2sxgen-pgx-731993623051-ifxcperezabad-isxeversheds-sutherland.essf-1MC4w	Get hash	malicious	Unknown	Browse	87.248.202.1
	https://canadaca1.godaddysites.com	Get hash	malicious	Unknown	Browse	46.228.146.0
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/cth.vn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	46.228.146.0

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Vidar	Browse	5.75.214.132
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.214.132
	http://www.viundodal.serv00.net/	Get hash	malicious	Unknown	Browse	136.243.156.120
	http://yi4xu8pw3bsb6.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://focuslify.com/pages/ad4eafd7-3402-4eaa-94db-5d87e99f42b2	Get hash	malicious	HTMLPhisher	Browse	195.201.127.76
	RFQ-DL32035.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	135.181.160.46
	bot_library.exe	Get hash	malicious	Unknown	Browse	159.69.63.226
	bot_library.exe	Get hash	malicious	Unknown	Browse	159.69.63.226
	Quotation.xls	Get hash	malicious	Unknown	Browse	95.217.202.210
	https://u46709706.ct.sendgrid.net/ls/click?upn=u001.DKwEP7VZOQzO0CdL8oA-2F1XfRWjdnnJf8AzT08E2sLXTgMdD9Jn8frnIecLny3eAokPJfihouroN0Bfpu-2Fc6LnrjqjViS2pLM6S7dZHOEwpuLfW-2BIU7dEMYGgaqQi-2B7ZF0pXBlOGA-2BSPzvia0EbhuUQ-3D-3D_2_r_uaJJRFhr-2BcMTvUL7itRYOkOTFwa3yBQ-2Be5ivdH2VumIL8X-2BH-2Fbr48QmarAca3fouHSsMOxgbLM7p2wkFK-2FUQL6-2FE9yCCxVee50mxUV1yVgD0jP9rXVSjBZFhWzNsNI0r917tCy3Siqu3AuAzm4HWroH5uBBAEhWW2PKqu-2B5XjabsjUwJhDJYiuP7NzEfnzrbkWW2CLIJbYvjD7vD7au-2BFw-3D-3D	Get hash	malicious	Phisher	Browse	5.161.89.212
CTINET-ASCTINETAutonomousSystemRU	doc_Zapytanie - Oferta KH 09281.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	doc_rfq Oferta KH 09281.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Client.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rNuevoPedidoPO-00843.pdf.com.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	ZKB - Zahlungsbest#U00e4tigung an 20240828.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	Vak#U0131fBank - #U00d6deme onay makbuzu 20240826.pdf.exe	Get hash	malicious	Quasar	Browse	213.159.74.80
	4dALKsHYFM.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer, zgRAT	Browse	213.159.74.80
	yEL4yMV0s4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	213.159.64.146
	AGREEMENT AND APPROVAL REPORT FECRWY RN & FR OF 2024-501144_6.5.24.pdf	Get hash	malicious	HTMLPhisher	Browse	213.159.64.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://punchconsultingcomdocs.blob.core.windows.net/catherinebrien/2EQ40z6JcQ8ZrKYgbMrrRmtVQafHWHTWzkJLTUq2CjCuzBCekR7uHtqnRYRYmEhiJ2e7Y.html	Get hash	malicious	Unknown	Browse	195.201.57.90
	Wire-transaction073921.exe	Get hash	malicious	SilverRat	Browse	195.201.57.90
	https://online.sofitelbahrain.com	Get hash	malicious	Unknown	Browse	195.201.57.90
	018292540-SuratTeguranPPI-20230814215304.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	Q88_TAI SHAN - 11.09.24.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	195.201.57.90
	ZHONG XING HAI PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	195.201.57.90
	VlmNuDYKAv.exe	Get hash	malicious	Amadey, Stealc	Browse	195.201.57.90
	Enquiry.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	195.201.57.90
	Order Quotation.exe	Get hash	malicious	AgentTesla	Browse	195.201.57.90
	http://993.ksefilmblick.de/wp-includes/rest-api/go4biz/263-net	Get hash	malicious	HTMLPhisher	Browse	195.201.57.90

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.9844219596585932
Encrypted:	false
SSDEEP:	6:kKBULlL9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:CYD9LNkPlE99SNxAhUe/
MD5:	048D3BFDF4B7D96B8B5E9F7E0B88BEC8
SHA1:	62D142146657E5FA8F7F67A8F6690EB6D21B3E11
SHA-256:	3835B06988EB4435E8DFBC7268A5C1CCAF981A160FCFBA673E3AD880B54B5ECF
SHA-512:	1B70463A8CA262103C1A5C3F6BDEB3A5F73052B2CF3366B8317ED6641B84F6ACB670F28B54DDA44050FB0419F9F4D40899BC60E328BEBC56AD8261A2B0C99658
Malicious:	false
Preview:	p...... ........P.?.$...(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.log

Download File

Process:	C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\workbook.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.345312382054873
Encrypted:	false
SSDEEP:	6:hC47bxrBeLuVFOOzCZG1wknaZ539bKOZG1wkn23fol:d5r+uVEOorH39ffwl
MD5:	E1C9708B17F18DBB276C1DE0B877E980
SHA1:	1B6AF0A419EB6319C747F2112348D67CBCD2F9B3
SHA-256:	60DC83FCFD8200A720149B1100B57B0D57DEA555AC9A1C81AC3F8692CECE6B21
SHA-512:	9969254B9981FA7171444980DD4281B84F00259BAF71C1B8B4DB34BA3C8CC312F3C267B9CC60F8BC23D889AD641E02010ECAFCFF2B3AACEA20D1BA887267C75E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..echo DONT CLOSE THIS WINDOW!..ping -n 10 localhost > nul..del /a /q /f "C:\Users\user\AppData\Roaming\SubDir\workbook.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat"

C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Download File

Process:	C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3701760
Entropy (8bit):	7.995152873348778
Encrypted:	true
SSDEEP:	98304:sd403a+fJYbXSHFK7OVTCEr/x8TOdT2J978fB:sdxf8iZZyTq2Jp85
MD5:	72C1F40EAFABDCDB3662D1DAD9EE2230
SHA1:	7C7AD3BA48BF9CE3E2B487D98B6A66D4D631892A
SHA-256:	FD3B039DF3E9A565B6964276F98C61D4555F3F3DABF1A9D76604F9FF4D4B3FB7
SHA-512:	4F4865B93479645B0E5F52AC3EF5D91A9BA3BC89F4165B6FE595389C0D409C8352DBBC53FBA1CAF7862589D6475D4411A3794BBCFA8C04E42301EF8F11603AFE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.................0..p8..........8.. ....8...@.. ........................8...........@.................................v.8.O.....8.,.....................8......u8.p............................................ ............... ..H............text....n8.. ...p8................. ..`.rsrc...,.....8......r8.............@..@.reloc........8......z8.............@..B..................8.....H........_..d;......5...H.....7...........................................{...."..}......{...."..}....~...(2.......(......s....(.....&.(3......0............(4...r...p.(....(.....+....r...p}.....r-..p}......}.....(.......(......s....}.......0..^.........(.......{....s6...}.....{.... .....s....o......{.... .... N...s....o......(.....{....o........0..^.........(.......{....s;...}.....{.... .....s....o......{.... .... N...s....o......(.....{....o.....*...0..^.........(.

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.6048426069826895
Encrypted:	false
SSDEEP:	12:PhY5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:5qdUOAokItULVDv
MD5:	EA5DD1D8BC9737245BE9D4DA99AEA3D7
SHA1:	BD50891B148D61BC185D45580A6CACF2A38745FA
SHA-256:	CBDB331BCF1FC83A00D431570C20765983E1790BDE2F4D9DC418041363150299
SHA-512:	3FF2CB9E6A1500A79D19EC74645AB05A98FA45278E3D52146E7F70AC2EC92F06C8FC5F930EB51979E72C97C0B6FDB6FA620A178D1BBAFD2ADA8F36B4C14EBB68
Malicious:	false
Preview:	..Pinging 506013 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995152873348778
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
File size:	3'701'760 bytes
MD5:	72c1f40eafabdcdb3662d1dad9ee2230
SHA1:	7c7ad3ba48bf9ce3e2b487d98b6a66d4d631892a
SHA256:	fd3b039df3e9a565b6964276f98c61d4555f3f3dabf1a9d76604f9ff4d4b3fb7
SHA512:	4f4865b93479645b0e5f52ac3ef5d91a9ba3bc89f4165b6fe595389c0d409c8352dbbc53fba1caf7862589d6475d4411a3794bbcfa8c04e42301ef8f11603afe
SSDEEP:	98304:sd403a+fJYbXSHFK7OVTCEr/x8TOdT2J978fB:sdxf8iZZyTq2Jp85
TLSH:	1206338110798B1EEDFB46B12521B2300F2215723A61C9E95E73E3C91CDEF8E561BD9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.................0..p8...........8.. ....8...@.. ........................8...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x788eca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xE9F7EC64 [Sat May 22 04:00:36 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x388e76	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38a000	0x62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x38c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3875f8	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x386ed0	0x387000	68c920812ff5da9d8451967b96621624	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x38a000	0x62c	0x800	58693a73e206c6c7082ee47627ea6ae2	False	0.33642578125	data	3.4693095596209593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x38c000	0xc	0x200	0d259a3cb9cf199ef83a091b9c47facb	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x38a090	0x39c	data			0.4166666666666667
RT_MANIFEST	0x38a43c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T10:25:15.454254+0200	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	213.159.74.80	9792	192.168.2.4	49735	TCP
2024-09-11T10:25:15.454254+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	213.159.74.80	9792	192.168.2.4	49735	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 10:25:14.934365988 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:14.939338923 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:14.939434052 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:14.946537971 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:14.951378107 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:15.445492983 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:15.445552111 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:15.445612907 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:15.449342966 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:15.454253912 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:15.551063061 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:15.767590046 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:16.771595955 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:16.771663904 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:16.773200989 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:16.773260117 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:16.781786919 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:16.781846046 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:17.718899012 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:17.718947887 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:17.719131947 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:17.722167015 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:17.722191095 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.346656084 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.346734047 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:19.350285053 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:19.350296021 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.350693941 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.355945110 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:19.399411917 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.550677061 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.550834894 CEST	443	49737	195.201.57.90	192.168.2.4
Sep 11, 2024 10:25:19.550893068 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:19.614217043 CEST	49737	443	192.168.2.4	195.201.57.90
Sep 11, 2024 10:25:19.775459051 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:19.780613899 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:19.780786037 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:19.785696983 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:19.908416986 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:19.995028019 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:25:19.995223045 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:45.002151966 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:25:45.007762909 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.277453899 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.277507067 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.277538061 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.277601004 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:26:04.277612925 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.277790070 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:26:04.281383991 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:26:04.286256075 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.286314964 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:26:04.291220903 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.578985929 CEST	49735	9792	192.168.2.4	213.159.74.80
Sep 11, 2024 10:26:04.584377050 CEST	9792	49735	213.159.74.80	192.168.2.4
Sep 11, 2024 10:26:04.584480047 CEST	49735	9792	192.168.2.4	213.159.74.80

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 10:25:14.359769106 CEST	55021	53	192.168.2.4	1.1.1.1
Sep 11, 2024 10:25:14.929982901 CEST	53	55021	1.1.1.1	192.168.2.4
Sep 11, 2024 10:25:17.705437899 CEST	53481	53	192.168.2.4	1.1.1.1
Sep 11, 2024 10:25:17.712869883 CEST	53	53481	1.1.1.1	192.168.2.4
Sep 11, 2024 10:25:50.571995974 CEST	53	63616	162.159.36.2	192.168.2.4
Sep 11, 2024 10:25:51.054516077 CEST	53	64564	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 10:25:14.359769106 CEST	192.168.2.4	1.1.1.1	0xa295	Standard query (0)	twart.myfirewall.org	A (IP address)	IN (0x0001)	false
Sep 11, 2024 10:25:17.705437899 CEST	192.168.2.4	1.1.1.1	0xbae7	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 10:25:14.929982901 CEST	1.1.1.1	192.168.2.4	0xa295	No error (0)	twart.myfirewall.org	213.159.74.80	A (IP address)	IN (0x0001)	false
Sep 11, 2024 10:25:16.786474943 CEST	1.1.1.1	192.168.2.4	0xc777	No error (0)	windowsupdatebg.s.llnwi.net	87.248.204.0	A (IP address)	IN (0x0001)	false
Sep 11, 2024 10:25:16.786485910 CEST	1.1.1.1	192.168.2.4	0xc777	No error (0)	windowsupdatebg.s.llnwi.net	87.248.204.0	A (IP address)	IN (0x0001)	false
Sep 11, 2024 10:25:17.712869883 CEST	1.1.1.1	192.168.2.4	0xbae7	No error (0)	ipwho.is	195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	195.201.57.90	443	7720	C:\Users\user\AppData\Roaming\SubDir\workbook.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-11 08:25:19 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-09-11 08:25:19 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 11 Sep 2024 08:25:19 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-09-11 08:25:19 UTC	1019	IN	Data Raw: 33 65 66 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 Data Ascii: 3ef{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.33", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yor

Target ID:	0
Start time:	04:25:05
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"
Imagebase:	0x6d0000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1780683199.0000000003030000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1791185855.000000000A50F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1791185855.00000000099B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1802872858.000000000B841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:25:08
Start date:	11/09/2024
Path:	C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe"
Imagebase:	0x7d0000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.1796545473.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.1796545473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:25:09
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Imagebase:	0xfb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:25:09
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:25:10
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x170000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1824379236.00000000028B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:25:11
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Imagebase:	0x150000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1862456672.000000000282F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1876814149.0000000003B6C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:25:11
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0xec0000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.2341312292.00000000036F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:25:13
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "workbook" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\workbook.exe" /rl HIGHEST /f
Imagebase:	0xfb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:25:13
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:25:16
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x420000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:25:16
Start date:	11/09/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\workbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\workbook.exe"
Imagebase:	0x8b0000
File size:	3'701'760 bytes
MD5 hash:	72C1F40EAFABDCDB3662D1DAD9EE2230
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:26:03
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /delete /tn "workbook" /f
Imagebase:	0xfb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:26:03
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:26:04
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:26:04
Start date:	11/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:26:04
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xea0000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:26:04
Start date:	11/09/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 10 localhost
Imagebase:	0x9e0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	14

Executed Functions

Function 07A1E7D0 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aae6214995ba812e2d98bc18a2fe4df96736854c0b4eaa8a347dd506160b524
Instruction ID: e63f254dea18a99c5f7f9b601daca8f52ad8b6a66065ac085865e8c2d401074f
Opcode Fuzzy Hash: 1aae6214995ba812e2d98bc18a2fe4df96736854c0b4eaa8a347dd506160b524
Instruction Fuzzy Hash: 67E1DCB07042158FEB29DB79C550BAEB7FAAFC8306F14846DD9569B390DB34E801CB91

Function 07A14140 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a3a0a704c972e05a4b12a8d0df6cff8639e2fc928de463604cce5fb456b90c
Instruction ID: e3fb461691264ad0c7094b3ad1cb97a2277b0657dc17b957537e4980ef5c0a94
Opcode Fuzzy Hash: 61a3a0a704c972e05a4b12a8d0df6cff8639e2fc928de463604cce5fb456b90c
Instruction Fuzzy Hash: 8821FCB1E056598FEB18CF6BC84069EFBB7AFC9300F14C0BAC458AA265EB3409458F51

Function 0134D409 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0134D496
GetCurrentThread.KERNEL32 ref: 0134D4D3
GetCurrentProcess.KERNEL32 ref: 0134D510
GetCurrentThreadId.KERNEL32 ref: 0134D569

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6d5e6ce4681eb93b70a0c958bed6681904df58c0961e2e262427800838320fa4
Instruction ID: ab3c997fdbaf23cb2597dba707f115008d13ae932f15a0e30f4131f9be19771e
Opcode Fuzzy Hash: 6d5e6ce4681eb93b70a0c958bed6681904df58c0961e2e262427800838320fa4
Instruction Fuzzy Hash: 405136B0D003498FDB18DFAAD548BDEBBF1BB48318F208459D459AB360DB34A984CF65

Function 0134D418 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0134D496
GetCurrentThread.KERNEL32 ref: 0134D4D3
GetCurrentProcess.KERNEL32 ref: 0134D510
GetCurrentThreadId.KERNEL32 ref: 0134D569

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 82335bdfa77fc237b8c05ca07dabaf7bbd07447b6a837ff1f8d9f361654b4895
Instruction ID: cb173350305914d6db2666cf6863664389c9b6c111502d5e514010186e03f80a
Opcode Fuzzy Hash: 82335bdfa77fc237b8c05ca07dabaf7bbd07447b6a837ff1f8d9f361654b4895
Instruction Fuzzy Hash: DF5127B0D002098FDB18DFAAD548BDEBBF1BB48318F208459D459AB360DB74A944CF65

Function 07A1B9DF Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07A1BC1E

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 035cab647c72ff98e42029621a79f24cc099d80546fb7c4af53a99db43a3a21a
Instruction ID: 241f4e59b527f14eb4ac0be98335a0280934a737d87963988bb0bd8d07421339
Opcode Fuzzy Hash: 035cab647c72ff98e42029621a79f24cc099d80546fb7c4af53a99db43a3a21a
Instruction Fuzzy Hash: 88A180B1D0021ADFEB14DF69C9417EDBBB2FF48314F1481A9E858A7240DB749985CFA2

Function 07A1B9E8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07A1BC1E

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4b6d7bdbd910f32ba96d520ec9127edcd124735e5bf15b6717fc6d4059f40352
Instruction ID: e6cff4ca17c48ce19e4c17ccba41014983a88345886de16511602afe30737f8a
Opcode Fuzzy Hash: 4b6d7bdbd910f32ba96d520ec9127edcd124735e5bf15b6717fc6d4059f40352
Instruction Fuzzy Hash: 409190B1D0021ADFEB14CF69C9417EDBBB2FF48314F1481A9E858A7240DB749985CFA2

Function 0134AD88 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0134AFDE

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e926937c539de9b23a3649098d78a48f4037f5a6d3540ffe30cc6005b0652f04
Instruction ID: e58e48d5332b43367e20e6b84a7e0179bf147785e61c3fc9b195eeb4032f35da
Opcode Fuzzy Hash: e926937c539de9b23a3649098d78a48f4037f5a6d3540ffe30cc6005b0652f04
Instruction Fuzzy Hash: 9A713470A00B058FD764DF29D45475ABBF5BF48348F008A2DD59ADBA50D735F889CB90

Function 013444B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013459C9

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dd595c724c1fdba7f6349d3a754eadf87507d0820b69c6831046da9983ede4b3
Instruction ID: 02da7402d23368458d87af0ef11c67cbd82aef9d53ff7986c1f54905e19784e7
Opcode Fuzzy Hash: dd595c724c1fdba7f6349d3a754eadf87507d0820b69c6831046da9983ede4b3
Instruction Fuzzy Hash: 1F41B0B0C0071DCFDB28DFA9C884A9EBBF6BF49304F24806AD408AB255DB756945CF90

Function 0134590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013459C9

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2aac4c830ab691b6365d5d9997e5ea284c451ed8fb4a5e1e4c3141151aad5e0
Instruction ID: dcfdf8f8f9bd34c08f632da49a51a50e938ec4de43507c1db75c60da712a98b2
Opcode Fuzzy Hash: a2aac4c830ab691b6365d5d9997e5ea284c451ed8fb4a5e1e4c3141151aad5e0
Instruction Fuzzy Hash: 3F41C2B1C00719CFDB24DFA9C884A9EBBF5BF49304F24815AD408AB255DB756949CF90

Function 07A1B358 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07A1B3F0

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e9ddceff70cd50e60b3a2a7bfaa732ddbadcb6d261e9ffdceee02dff1860525c
Instruction ID: 66e0bb9714b1ef91c0a00dbe4d82ebb6a6f314abae59e0152e9584dda2d442ae
Opcode Fuzzy Hash: e9ddceff70cd50e60b3a2a7bfaa732ddbadcb6d261e9ffdceee02dff1860525c
Instruction Fuzzy Hash: BE2146B1900359DFDB10CFA9C881BEEBBF1FF88310F108429E959A7241C7789955CBA4

Function 07A1B360 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07A1B3F0

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 547eae632499f29cfa918f273cfb759054ce4ed45123c20d55008e9c0568523f
Instruction ID: 9bcbb803f1109042333495aaa70a6d1f663827ed7ed0fc205c5718fcb4b1b4ce
Opcode Fuzzy Hash: 547eae632499f29cfa918f273cfb759054ce4ed45123c20d55008e9c0568523f
Instruction Fuzzy Hash: 572169B1900359DFDB10CFA9C881BDEBBF5FF48310F108429E959A7240C7789954CBA4

Function 07A1A950 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07A1A9D6

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c2c88338a4808230391f4d1a7d1f22a0baa1a04b979f72ff32cc8c9ef14803f3
Instruction ID: 454477ffd3cdeb948bf7f6bfc43a87c11efe5281f4eb5b368386f8e293a5cbb1
Opcode Fuzzy Hash: c2c88338a4808230391f4d1a7d1f22a0baa1a04b979f72ff32cc8c9ef14803f3
Instruction Fuzzy Hash: 50214AB19003098FDB10DFAAC5457EEBBF4EF48314F14C429D459A7241C7789984CFA5

Function 0134D658 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0134D6E7

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3ed96864fe6fde023c60df764be411822b3c38b3ae3e4b14134223705318a632
Instruction ID: 4b5ecf11ce47e6cb09d050f4c61ee1e1a4283a6d516bf6130336c291c7e91e8b
Opcode Fuzzy Hash: 3ed96864fe6fde023c60df764be411822b3c38b3ae3e4b14134223705318a632
Instruction Fuzzy Hash: 8C2114B5900249EFDB10CF9AD984ADEFFF4EB48320F10841AE918A7350C378A944CFA5

Function 07A1B44B Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07A1B4D0

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 06db9e71c7a411c8f30b674810428b17d7c3f30023080469fc3dcf7ea148d8ab
Instruction ID: f1bcb1c95e9c02308306d0f85b03da2557e97812626b420e5371f51f4e77bb89
Opcode Fuzzy Hash: 06db9e71c7a411c8f30b674810428b17d7c3f30023080469fc3dcf7ea148d8ab
Instruction Fuzzy Hash: ED2128B18002599FDB10DFA9C881AEEFBF5FF48320F108429E558A7250C7789945CBA5

Function 07A1B450 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07A1B4D0

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c090a2b19d55371f88f1d42ebef99841f63a16cc03f0a24682f9637ca693a88d
Instruction ID: 43987f20c791a5d911384d330d301116bad175bea6eaedd66267a5581e81a89d
Opcode Fuzzy Hash: c090a2b19d55371f88f1d42ebef99841f63a16cc03f0a24682f9637ca693a88d
Instruction Fuzzy Hash: 4B2137B1C003599FDB10DFAAC880AEEFBF5FF48320F10842AE558A7250C7389944CBA5

Function 07A1A958 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07A1A9D6

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5cdead2d9bc95d6471dcadefc30e147e63e5b8b85fee0c8f8de39df25e55c2d6
Instruction ID: 6e59a0069eaee88d07f10cef09642cc1fa1c7b3688bb4d572f236c4ddce0c741
Opcode Fuzzy Hash: 5cdead2d9bc95d6471dcadefc30e147e63e5b8b85fee0c8f8de39df25e55c2d6
Instruction Fuzzy Hash: 9F2138B19002098FDB10DFAAC5857EEBBF4EF88324F10C42AD459A7241C7789984CFA5

Function 0134D660 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0134D6E7

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 75b056e437edaf996261418d4d5b9dcd78812c47a77059a9f12dc8820446f09e
Instruction ID: 9cc2690e4303c0ba282c6b243f924727988ac9415e82815ac6d42a99d8c44a7f
Opcode Fuzzy Hash: 75b056e437edaf996261418d4d5b9dcd78812c47a77059a9f12dc8820446f09e
Instruction Fuzzy Hash: 1C21E4B59002499FDB10CF9AD584ADEFFF5EB48320F14801AE958A7310C378A944CFA5

Function 0134B011 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0134AFDE

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 100779c5f6ca229226dd87143fbfc973afb28d207caf0b9cd3f270f5dd71b14c
Instruction ID: 551b4958f114e0d40566c38f41de32b8933433d67e03e6c0b35b0b350e4d9f9b
Opcode Fuzzy Hash: 100779c5f6ca229226dd87143fbfc973afb28d207caf0b9cd3f270f5dd71b14c
Instruction Fuzzy Hash: 3611C171A042058FE714DF6AD8047AEFBF6EBC5218F04802AD559976A0CB75A809CBA0

Function 07A1B298 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07A1B30E

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a22314c212f1f24da2e6dca6b0979eee3322250e7968d1790d21326a78f0dc56
Instruction ID: 6777be2156079d88e69a5b7bf85447a4b71a30783741df4087eb0dcdb0d1e58c
Opcode Fuzzy Hash: a22314c212f1f24da2e6dca6b0979eee3322250e7968d1790d21326a78f0dc56
Instruction Fuzzy Hash: B02159B1900249DFCB14DFAAC845ADEFFF5EF88324F108829E555A7250C775A590CFA0

Function 07A1B2A0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07A1B30E

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 971c167795d51e4f29d32e69956519c909116f4118f8204dee6c0d6982729893
Instruction ID: 0c21f7506dae734613ceca578c1e8a716ec23d948d39652854be710ead71bac1
Opcode Fuzzy Hash: 971c167795d51e4f29d32e69956519c909116f4118f8204dee6c0d6982729893
Instruction Fuzzy Hash: 781167B29002499FCB10DFAAC844BDEFFF5EF88320F108819E569A7250C735A550CFA0

Function 07A1A8A1 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07A1A90A

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e0682f6b5c1cc1199492df10b4cc253cf31ef791393c96f1b27f1b6a6487e115
Instruction ID: 6c542d2251713e8ae4e9299a9e44667ba4b9cd2c771c58eb4654133e0bd134b2
Opcode Fuzzy Hash: e0682f6b5c1cc1199492df10b4cc253cf31ef791393c96f1b27f1b6a6487e115
Instruction Fuzzy Hash: C1115BB19042498BDB10DFAAC8457DEFBF5EF88324F208429D459A7240C775A985CBA5

Function 07A1A8A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07A1A90A

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3b5d1909cbe6c626180dda43ca5284f1190870dedc35c6b37c59fc859f4ea021
Instruction ID: b1e5a8ac39aea12380b941e22829e0b2169b18bdc0ae1a271ab194ba5975bfe7
Opcode Fuzzy Hash: 3b5d1909cbe6c626180dda43ca5284f1190870dedc35c6b37c59fc859f4ea021
Instruction Fuzzy Hash: C8113AB19003498FDB10DFAAC4457EEFBF5EB88324F208419D459A7250C775A984CF95

Function 07A1B5F0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07A1DD45

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c0b6b08aafbdc5b9d1d662cb15de7e81db44f793346878267b82977943c41b04
Instruction ID: f27dc13b15fe29cfea8ffd0e176fa166fbe89c476b547add9cf7fa125a113b24
Opcode Fuzzy Hash: c0b6b08aafbdc5b9d1d662cb15de7e81db44f793346878267b82977943c41b04
Instruction Fuzzy Hash: 2B11F2B59003499FDB10DF9AD548BDEBFF8FB48320F10885AE568A7210C375A984CFA1

Function 07A1DCE0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07A1DD45

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 19ff80fa482819be4f520a1738665bd4d7a78e2f447a9f2e732b2c2547e6ba57
Instruction ID: b394bbf351a06085bf30f659eea3564594e502ee3fee414a4d53f518b04d8a08
Opcode Fuzzy Hash: 19ff80fa482819be4f520a1738665bd4d7a78e2f447a9f2e732b2c2547e6ba57
Instruction Fuzzy Hash: F111F5B5801249DFDB10DF9AC485BDEFBF8EB48310F108459D968A7610D375A984CFA1

Function 0134AF78 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0134AFDE

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c65bdb89b4d85720e62c1f94b9f090900935e413b662162b8f38b6bef0aca352
Instruction ID: bf42bef15d56d82ff7c91e057bad0a33726eeb60d85973ba7de649d7cc1e7162
Opcode Fuzzy Hash: c65bdb89b4d85720e62c1f94b9f090900935e413b662162b8f38b6bef0aca352
Instruction Fuzzy Hash: 751125B5C003498FDB10CF9AC844ADEFBF4EF48314F10841AD869A7650C375A545CFA1

Function 0106D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779444102.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2449ffb4d3d97c29c432af183776c5e98407fc81ba8b5ff75bc65c2052b9a746
Instruction ID: 2e58a35c5d8cdfc13d0d82f799d63ad91c1af72b5c32a9f3684907cb17e38aca
Opcode Fuzzy Hash: 2449ffb4d3d97c29c432af183776c5e98407fc81ba8b5ff75bc65c2052b9a746
Instruction Fuzzy Hash: 64212971604201EFDB05DF98D5C0B2ABBA9FB94324F24C5ADD9C94F256C336D446CB61

Function 0106D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779444102.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72f9cebe68806f0e2e4022c855a52ff52eb1f2f32f22fb7309d12cc0b26ef80
Instruction ID: ba2ba8d658a6f8d0b7acb37511c9e1cd3891788ceec671edd351b7fd2f637600
Opcode Fuzzy Hash: e72f9cebe68806f0e2e4022c855a52ff52eb1f2f32f22fb7309d12cc0b26ef80
Instruction Fuzzy Hash: 3D212571604200DFEB15DF58D584B26BFA9EB84314F20C5ADE9C94B256C337D447CB61

Function 0106D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779444102.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe0e6ff06409d33a3a9d8136f76f66a7aac57eee0d47f83bb1a5666a8e912e0
Instruction ID: 5ad7dc7ec989b58cb3a40b9f89e4aedbb1f847dfa6dc446015163a649e0a5bee
Opcode Fuzzy Hash: ffe0e6ff06409d33a3a9d8136f76f66a7aac57eee0d47f83bb1a5666a8e912e0
Instruction Fuzzy Hash: 842187755093808FD713CF64D594715BFB1EF46214F28C5DAD8898F667C33A980ACB62

Function 0106D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779444102.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: fc141815b1f4499ed341762f702b5eaff167880a61e78c0c01c6dd3586a4943e
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D311BB75604280DFDB12CF54C5C4B15BFA1FB84224F28C6AAD8894B296C33AD44ACB61

Function 0105D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779403952.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6b04b66963b969c6cba7522ecbddcc50985273c31deece292b285ab03641a8
Instruction ID: 8a594d73a885056ecbde15d3e903c4919a82a0d9f072ebd357d9c0297a62df7e
Opcode Fuzzy Hash: 8f6b04b66963b969c6cba7522ecbddcc50985273c31deece292b285ab03641a8
Instruction Fuzzy Hash: 9301F731008388DAE7904A69CD8476BFFD8FF41320F18C56BED484A286E2399840C7B1

Function 0105D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779403952.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fc36feef610a6bdae748ccb18b6692bfa896fc493806ed5abe3fef6c2bc6c0e
Instruction ID: fab8cb7ea25035a72561edd69f8f45ef0223f5503370a77375bc34d273bc4b5c
Opcode Fuzzy Hash: 7fc36feef610a6bdae748ccb18b6692bfa896fc493806ed5abe3fef6c2bc6c0e
Instruction Fuzzy Hash: 26F0C271004384AEE7508A1ACC84B63FFE8FF40624F18C49BED484A286D2799840CBB1

Non-executed Functions

Function 07A185A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70b3c96b93e3ca43674bc8143c4857f70b9d8b6e3ba16b1b7d0fdff5fbf1778
Instruction ID: 11e9f1da7462dd48315a2799d0c385c0a09be4fe8bebd60396eb11f5fda529c7
Opcode Fuzzy Hash: a70b3c96b93e3ca43674bc8143c4857f70b9d8b6e3ba16b1b7d0fdff5fbf1778
Instruction Fuzzy Hash: 83E15AB4E001198FDB14DFA9C5909AEFBB2FF89304F248569E814AB35AD730A941CF60

Function 07A1A080 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82060faed622a2d123e5b186c3d37497b24bd3b2c39dc9bf3fc2a87499466674
Instruction ID: 46a550c4baeb37995864114a08cdba1c1a7f040ef732a4858ea0382a5585c841
Opcode Fuzzy Hash: 82060faed622a2d123e5b186c3d37497b24bd3b2c39dc9bf3fc2a87499466674
Instruction Fuzzy Hash: 41E15BB4E011198FDB14DFA9C5909AEFBB2BF89304F24C569E815AB35AD730A941CF60

Function 07A1AE68 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43902d7405f34815962ff41263c59d3d3ead3acda78d5f746da151571f985998
Instruction ID: 9a002cee9be4982cfa9d8ca37ea345b4476f626a70e97bf9cee61e3c58ce2335
Opcode Fuzzy Hash: 43902d7405f34815962ff41263c59d3d3ead3acda78d5f746da151571f985998
Instruction Fuzzy Hash: 9CE11CB4E001198FDB14DFA9C5909AEFBF2FF89304F248569E815AB35AD731A941CF60

Function 07A19C48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259c1021c132ed8560f7c2495e39f66e9407d80e0e474d0884cc3d49c5730d7f
Instruction ID: 796e400331d6505a71bedac475869821bdb6de410a62952097daddcd3720449c
Opcode Fuzzy Hash: 259c1021c132ed8560f7c2495e39f66e9407d80e0e474d0884cc3d49c5730d7f
Instruction Fuzzy Hash: DEE12BB4E002598FDB14DFA9C5909AEFBB2FF89304F24C169E419AB359D731A941CF60

Function 07A1AA30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced202550b6fdf2eddc4d641c7ac68538ad26f93a80ffd269f27e4014a19d669
Instruction ID: 00c0ad7f19a8f00553186be9e0011bcb76630f869c7ad7bb15c5e0c02fabf762
Opcode Fuzzy Hash: ced202550b6fdf2eddc4d641c7ac68538ad26f93a80ffd269f27e4014a19d669
Instruction Fuzzy Hash: F5E117B4E011198FDB14DFA9C5909AEFBB2FF89304F24C569E815AB35AD730A941CF60

Function 07A107F9 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a370840dbaea5218ccc79314fc662f2853ef0bc92a069d63c0d065621bf9d34
Instruction ID: a208dda31ac8120f8ddf2062bf8f79375c63948a8ea1060a079cdd19d1731413
Opcode Fuzzy Hash: 4a370840dbaea5218ccc79314fc662f2853ef0bc92a069d63c0d065621bf9d34
Instruction Fuzzy Hash: BAD1283582065A8ECB01EBB8D964A9DF7B1FF95300F1097AAD0493B215EB706AD5CF41

Function 07A10808 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790526868.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7a10000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ac69100f2b08f8e0d520d60498d78bc0e79eab4cd02c35a8834d7cbf0419a8
Instruction ID: 5660c1105fcd4b2968bdc182421cae2509c6885cb5448a883164c2de14cbe03e
Opcode Fuzzy Hash: b6ac69100f2b08f8e0d520d60498d78bc0e79eab4cd02c35a8834d7cbf0419a8
Instruction Fuzzy Hash: E4D1173582065A8ECB00EBB8D964A9DF3B1FFD5300F6097AAD0493B215EB706AD4CF41

Function 0134D344 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1780011936.0000000001340000.00000040.00000800.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c613757917c07cf6a3154b6f575db029842f3e9b417cc82fdc461ba3b23d8d
Instruction ID: 66db896acca59c95f03c074526f09e3e893d3f3266fd253e34d9a636e84a0aee
Opcode Fuzzy Hash: 03c613757917c07cf6a3154b6f575db029842f3e9b417cc82fdc461ba3b23d8d
Instruction Fuzzy Hash: 75A19232E00219CFCF15DFB8C88459EBBF6FF84304B19856AE905AB265DB75E946CB40

Analysis Process: doc_Zapytanie - Oferta POLSKA 91044PL.com.exePID: 7496, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	425
Total number of Limit Nodes:	36

Executed Functions

Function 0148BFF0 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0148C256

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ac07f38279caab60d6c2fb301aa90c1c387f8a6f1ded7caa36893c15777832e7
Instruction ID: 645fe2762b3313cf1005283038ac642c407e8675765eb4a593a3f1c128906bf2
Opcode Fuzzy Hash: ac07f38279caab60d6c2fb301aa90c1c387f8a6f1ded7caa36893c15777832e7
Instruction Fuzzy Hash: FC8136B0A00B058FD724EF69D48079BBBF5BF49240F10892ED18AD7B60D775E946CBA1

Function 0541C90C Relevance: 1.6, APIs: 1, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0541E259

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 38d8bbb09cf76bc5db055b3459c7fe187b56477176731e6e3bc4a5ef79136ab8
Instruction ID: 0bad962640eba51549d2a169a2c3cc33431e8bdce84e1dc96b6dede0019a906a
Opcode Fuzzy Hash: 38d8bbb09cf76bc5db055b3459c7fe187b56477176731e6e3bc4a5ef79136ab8
Instruction Fuzzy Hash: 9E41CF75A042189FDB14DF99C844BEEBBF9EF88310F14842AE819E7350CB789941CB69

Function 01487364 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01487421

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 796d6bc0567e2c2ccee67c48dde20901d2733d56a7c71d8f51e1bd018c247ce7
Instruction ID: 48d53e3450c145826eb8d02427ba38a6f79d513aa99e8320be0146ebc78b9562
Opcode Fuzzy Hash: 796d6bc0567e2c2ccee67c48dde20901d2733d56a7c71d8f51e1bd018c247ce7
Instruction Fuzzy Hash: 9241E2B0C00719CFDB24DFA9C854B9EFBB5BF49704F24806AD408AB265DB756985CF90

Function 05412B64 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05414411

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2751bacfcbba8a290f9ebb5194d3c056fc7b5d47d16b797ecff3f764b9a1c591
Instruction ID: b4dd64b1f4e21cb27e4ad1e84554b68f7a823cfccfecc3a66f6682fb50233f13
Opcode Fuzzy Hash: 2751bacfcbba8a290f9ebb5194d3c056fc7b5d47d16b797ecff3f764b9a1c591
Instruction Fuzzy Hash: 3D411BB9A00209CFCB14DF99C448AAAFBF5FF88314F14C45AD519AB321D775A841CFA4

Function 01486414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01487421

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b19397e2cdfee59b0cf53e55b082265cdb24a96584901a409a9c8b975f466fe7
Instruction ID: 7e702925a52041fb65d1e9cea57d86bf7fed1a886d3daee6d2fd09d2e5de81e4
Opcode Fuzzy Hash: b19397e2cdfee59b0cf53e55b082265cdb24a96584901a409a9c8b975f466fe7
Instruction Fuzzy Hash: EC41E0B0C0061DCFDB24DFA9C854B9EBBB5BF48704F24806AD408AB265DBB56985CF90

Function 0541B168 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ebd0e91f5f8907438a18729c3f2279982a7dbe43b41952fa6f9f230eb2f03030
Instruction ID: e7c3c9d35bef130b959bf693f70380ad808f5568452163ea8cbae65e4132807a
Opcode Fuzzy Hash: ebd0e91f5f8907438a18729c3f2279982a7dbe43b41952fa6f9f230eb2f03030
Instruction Fuzzy Hash: 64318D719043599FCB11DFAAD844AEEBFF4EF09350F14809AF954A7221C3359854CFA5

Function 01486780 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0148674E,?,?,?,?,?), ref: 0148680F

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb4d3cc9b32ad5e7149a5689f5c5395596a44e76c3ef3df8053dac48d7498a80
Instruction ID: 7604f6c2f293f943a041a89ef50848321476a1f2db60df6a5c718d2bb31b85ce
Opcode Fuzzy Hash: cb4d3cc9b32ad5e7149a5689f5c5395596a44e76c3ef3df8053dac48d7498a80
Instruction Fuzzy Hash: 662117B58002489FDB10CFAAD884AEEBFF4EB48310F14801AE958A7351D374A944CF61

Function 0148611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0148674E,?,?,?,?,?), ref: 0148680F

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aa004f7dda89deb8e682a28fac682a9984ec1e76f85033e79cc0673bd527d3f1
Instruction ID: 392ed17926b7419555d94a3aa69334a9e482ac834e3f759dfa23d5629618b94e
Opcode Fuzzy Hash: aa004f7dda89deb8e682a28fac682a9984ec1e76f85033e79cc0673bd527d3f1
Instruction Fuzzy Hash: 0D21E3B5901248AFDB10DF9AD984AEEBFF4EB48320F14841AE958A7310D374A944CFA5

Function 0541C91C Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0541E259

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 9d7d1008b5177c134f2f84aba76bb5cbf3cb253d3e6d5c315516e930fc40b242
Instruction ID: 4842c72d137561da7ee08076e343fed165586a341c2d4c33b071ecaaa8a12d7c
Opcode Fuzzy Hash: 9d7d1008b5177c134f2f84aba76bb5cbf3cb253d3e6d5c315516e930fc40b242
Instruction Fuzzy Hash: B82107B59042098FDB14CF9AC844BEEFBF9EB88310F14842AE859A7250D774A945CFA5

Function 05419D7C Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,0541B182,?,?,?,?,?), ref: 0541B227

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: d7168180562d95c42fa956e518f75cbceba4a16c348c2be7442905db56529fb9
Instruction ID: 27a0d5b25f3bffedcbfd061febd189b98d50cb72955215c1ec84e807d3bfa5e6
Opcode Fuzzy Hash: d7168180562d95c42fa956e518f75cbceba4a16c348c2be7442905db56529fb9
Instruction Fuzzy Hash: A31179B1800349DFCB10CF9AD844BEEBFF8EB48360F14845AE954A7210C375A954CFA5

Function 0148C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0148C256

Memory Dump Source

Source File: 00000002.00000002.1808095124.0000000001480000.00000040.00000800.00020000.00000000.sdmp, Offset: 01480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1480000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d1ba5f20710a886a77b4679b1fa9f0b4e08d380f384bce2da055af78c30ba481
Instruction ID: 598678ad56325858271e0b8bf4b96875d1871f4574b8a7e108f2957ad59b8661
Opcode Fuzzy Hash: d1ba5f20710a886a77b4679b1fa9f0b4e08d380f384bce2da055af78c30ba481
Instruction Fuzzy Hash: A71110B5C002498FDB10DF9AC844ADEFBF4AB88320F10842AD429B7650C375A545CFA1

Function 05419DC0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0541B58D

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 733aea502bc0806f3d84bc46c9fb9114d5e24166a848e4fd78a26287f4909a2e
Instruction ID: 76ae688ec4944c77a4095da6b07bfe9083c7b2091f1603893d535e7ac2a9a4eb
Opcode Fuzzy Hash: 733aea502bc0806f3d84bc46c9fb9114d5e24166a848e4fd78a26287f4909a2e
Instruction Fuzzy Hash: A31106B5800348DFCB10DF9AD484BEEBBF8EB48314F10845AE958A7310C3B5A944CFA5

Function 0541B52A Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0541B58D

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ad5fd8ead2728289f1ceadb9a1c72721ef0ae5c3f0fe490c4489140f2015433f
Instruction ID: edbe6821b41b15029a97276d76c90b2fa7cd201257466431d8c4a113172e9ec5
Opcode Fuzzy Hash: ad5fd8ead2728289f1ceadb9a1c72721ef0ae5c3f0fe490c4489140f2015433f
Instruction Fuzzy Hash: CC11D6B58003499FDB10DF9AD885BDEBFF8EB48314F10845AE558A7610C375A984CFA5

Function 05412010 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05412075

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 26ba89cadf9a216dc17e03edbd1eead5fe67708cee6954b915844ed8851c049f
Instruction ID: 1371e9f0170360ee5088c66b656da84b06260f0cb27d2814723d14a03b977e34
Opcode Fuzzy Hash: 26ba89cadf9a216dc17e03edbd1eead5fe67708cee6954b915844ed8851c049f
Instruction Fuzzy Hash: 0A1106B58042499FDB10CF9AD445BDFBFF8EB48320F10855AE959A7310C3B5A944CFA5

Function 05412018 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05412075

Memory Dump Source

Source File: 00000002.00000002.1821889022.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5410000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 62755c9521c515348589892d427709a601395c2c67c7880d943c0fc8665d78f6
Instruction ID: f5d9fab3d75eaefde893ce2dc2159165e5d898f5e31e7aca747a79c4cda69a7d
Opcode Fuzzy Hash: 62755c9521c515348589892d427709a601395c2c67c7880d943c0fc8665d78f6
Instruction Fuzzy Hash: 5A1100B58002498FDB10CF9AD484BDEBBF8EB48320F20851AE959A7310C3B5A944CFA5

Function 0123D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806312621.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216dfffbf7526093dae9621109388fc620d34c7da23b06b19bd607ff63fbcb69
Instruction ID: 31b3405fee75e47dac7146ee99faa3b008d9c183791c42f20b074ec67e3a4695
Opcode Fuzzy Hash: 216dfffbf7526093dae9621109388fc620d34c7da23b06b19bd607ff63fbcb69
Instruction Fuzzy Hash: 9B2130B0614208DFCB11DF68D980B26FBA5EB84B14F60C569E90A4B256C37AD406CA61

Function 0123D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1806312621.000000000123D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0123D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_123d000_doc_Zapytanie - Oferta POLSKA 91044PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33756d8b4f719ad9cca1da437ab33c0a31313b4922a9b888174b99caff0ac726
Instruction ID: 6d70480b00180710440c10c0f5cc7c3956ab1b8f4552d11b42500aadf76e8351
Opcode Fuzzy Hash: 33756d8b4f719ad9cca1da437ab33c0a31313b4922a9b888174b99caff0ac726
Instruction Fuzzy Hash: 6B2183755083849FCB02CF64D994711BF71EB86714F28C5DAD9498F2A7C33A981ACB62

Analysis Process: workbook.exePID: 7596, Parent PID: 7496COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	5

Executed Functions

Function 00E4D418 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00E4D496
GetCurrentThread.KERNEL32 ref: 00E4D4D3
GetCurrentProcess.KERNEL32 ref: 00E4D510
GetCurrentThreadId.KERNEL32 ref: 00E4D569

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cfc3c70a7c0727919dd263565a51896dca2eec4f213e88beec0f355c7cedc6b8
Instruction ID: aad4f57f63a762de487ba40176ddaf5d05daeafb866f23dd0dc83f38a3d129ee
Opcode Fuzzy Hash: cfc3c70a7c0727919dd263565a51896dca2eec4f213e88beec0f355c7cedc6b8
Instruction Fuzzy Hash: B35148B4900209CFDB14DFA9D548B9EBBF1EF88314F208459E459B72A0D774A944CF65

Function 00E4AD88 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E4AFDE

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5919303a444d1338debc07f4d9bc4ba1dbbc0b64d87fa4d1d037b0b613e8b33c
Instruction ID: aec1bc473402e25e2e2f121375f5f5c8c759f9f7dcb1d40e035468bc892fb140
Opcode Fuzzy Hash: 5919303a444d1338debc07f4d9bc4ba1dbbc0b64d87fa4d1d037b0b613e8b33c
Instruction Fuzzy Hash: BD714570A00B458FD724DF2AE44475ABBF1BF88314F048A2DD096E7B50DB74E949CB91

Function 00E4590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E459C9

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7431993d1563e73275552ddd41d8bb4ede87c904568c3a1f1b2fa2a22470b89a
Instruction ID: fc637f21e2fe62dcc1936e8aa30fc6dfabe90173743dd891ec30926217ea1a66
Opcode Fuzzy Hash: 7431993d1563e73275552ddd41d8bb4ede87c904568c3a1f1b2fa2a22470b89a
Instruction Fuzzy Hash: F441F1B1C00719DFDB24DFA9C88468EBBF5BF49304F24819AD418AB251DB75698ACF90

Function 00E444B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00E459C9

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 599ca05716a44752ae5b252d44fc568008a5bc6b18359681237e6e161e63ac6b
Instruction ID: 87fbdbaca7e36f3023f6571e61e480720b1d8c4f7d9c8f6b75440aedf6c56594
Opcode Fuzzy Hash: 599ca05716a44752ae5b252d44fc568008a5bc6b18359681237e6e161e63ac6b
Instruction Fuzzy Hash: E841F1B1C00719DBDB24DFA9C884B9EBBF5BF48304F20806AD408AB251DBB56949CF90

Function 00E45A84 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73bc1c75a4c75c3fde0899ef64b1132f3eb95f3878e5c916dc9f1389f9ff0bf
Instruction ID: 8a7026558d474b91fc271b33a33cca3a8ff4dc315207c1631a301116d43e4faf
Opcode Fuzzy Hash: c73bc1c75a4c75c3fde0899ef64b1132f3eb95f3878e5c916dc9f1389f9ff0bf
Instruction Fuzzy Hash: C531BF76C00A49CFCB11CFA8D8457EDBBF0EF95314F248289C055AB292D775A94ACF51

Function 00E4D660 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00E4D6E7

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 311056e9c910090c343e98f21c56a95a8a68eb839f727fa398bc5fbc73843638
Instruction ID: fdb21d002656fd38bd074e6baf12cd42061adab3334204e026a04e6921640dbc
Opcode Fuzzy Hash: 311056e9c910090c343e98f21c56a95a8a68eb839f727fa398bc5fbc73843638
Instruction Fuzzy Hash: 1D21E2B59002589FDB10CFAAD984ADEBBF8FB48320F14801AE958A3350D374A940CFA4

Function 00E4B011 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E4AFDE

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fcd9fbd966fedacd58e986ba12546d862d3a55f26aa8f316ddb3d2ab533c0fc5
Instruction ID: 3a11b5d068d4ca03e2aa84c23ec31a97fda863663341fa4809c01341fc00a5cf
Opcode Fuzzy Hash: fcd9fbd966fedacd58e986ba12546d862d3a55f26aa8f316ddb3d2ab533c0fc5
Instruction Fuzzy Hash: 7A11E3B1A002418FD714DF69E8407EBBBF5AFC5324F0880AAE558B72A2CB749905CB61

Function 00E4AF78 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00E4AFDE

Memory Dump Source

Source File: 00000005.00000002.1822145705.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e40000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 782a411249bed6872593404ce1c9a6a87f3a392709f66d6836148c3c7c084e5c
Instruction ID: fef92643c787ae4170ea997cbe83b2e11b2f2c932953935fa23e1e58da141e5d
Opcode Fuzzy Hash: 782a411249bed6872593404ce1c9a6a87f3a392709f66d6836148c3c7c084e5c
Instruction Fuzzy Hash: 1E1110B6D002498FDB10CF9AD444ADEFBF4AF88328F14842AD869B7610C379A545CFA1

Function 00DED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab10ce3288314894dcf22c7106e36ee56733b0efab5f06ee364a91c8fbd4e1c6
Instruction ID: 0532aa4e0a3e169025bb4eb790262ade1ffe547130a7963bdfc44826c0c69e43
Opcode Fuzzy Hash: ab10ce3288314894dcf22c7106e36ee56733b0efab5f06ee364a91c8fbd4e1c6
Instruction Fuzzy Hash: 31213A71500284DFDB05EF15D9C0B16BFA6FBA4314F24C169E9094F296C736E856C7B2

Function 00DED4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc15e9de8455415006a8b02cdc91a5ca3b7d233e29df638eed201bf7142935ea
Instruction ID: c17dcdca8d2039c3ec5caa5631421da32bcfd7fe9ad7b30e2836c3201f688351
Opcode Fuzzy Hash: cc15e9de8455415006a8b02cdc91a5ca3b7d233e29df638eed201bf7142935ea
Instruction Fuzzy Hash: 12213472504280DFCB05EF15D9C0B2BBF66FB98318F24C569E8490B256C736D856CBB2

Function 00DFD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821622768.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dfd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce452e7e752fb1102c322bd9b1f03cce4c1010dd8e3f84d90c5a582ac848d875
Instruction ID: 32dc8e2fbd3e997a44b86d1d9da508d5457a3eb193aa07b4c601be531f133e8a
Opcode Fuzzy Hash: ce452e7e752fb1102c322bd9b1f03cce4c1010dd8e3f84d90c5a582ac848d875
Instruction Fuzzy Hash: 00212271604208DFCB14DF14D984B26BBA7EB84314F24C569EA4A4B296CB3AD847CA71

Function 00DFD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821622768.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dfd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a9eeb2a7cba23c5f605eb5e470ce49963ab05a3472faa9caac125966bbc4f1
Instruction ID: e0bc45ca324525f43f12f3ae973f139539760d9dccc2ecb0fc79dfb7205fffaf
Opcode Fuzzy Hash: 49a9eeb2a7cba23c5f605eb5e470ce49963ab05a3472faa9caac125966bbc4f1
Instruction Fuzzy Hash: B2210471504208EFDB05DF14D9C4B3ABBA7FB84314F24C66DEA494B296C336D846CAB5

Function 00DFD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821622768.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dfd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a19b1b1af01678754224f8eac02d19f6384b022621c12ed3724590c53971841
Instruction ID: 2ad754b2eec5b818ac0703a610dafc42a7c0bc9d472fa7e9d09439b9f9fb5238
Opcode Fuzzy Hash: 5a19b1b1af01678754224f8eac02d19f6384b022621c12ed3724590c53971841
Instruction Fuzzy Hash: CA218E755093C48FCB02CF24D994715BF72EB46314F29C5EAD9498F2A7C33A980ACB62

Function 00DED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 74e174b4fe6efc8294f55629f2a85145a31b9b3628f5ae1e2b70ab48f8b53417
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: EF112676404280CFCB02DF00D5C4B16BF72FBA4324F28C2A9DC090B256C33AE85ACBA1

Function 00DED4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 0d59845e3553249de934e9719e44572b6d0cd34d2d550a3bd7052375c08e17c3
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: B411E676504280CFCB16DF14D9C4B16BF72FB94318F28C6AADC490B656C336D85ACBA1

Function 00DFD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821622768.0000000000DFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_dfd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: e25d882142be2dfaac293c162e195f41fc23226bff45a4a5b67f6ec4f692c83f
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: C311BB75504284DFCB02CF10D5C4B25BBA2FB84314F28C6AAD9494B296C33AD80ACBA1

Function 00DED759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00e6d87b76b32352bdd0572f1a10fa192fcdef66c9494ecff57d142085c23ac
Instruction ID: d8d6d702a7e97bffc3bbed522e23475ac79c5c0251b5e15d39549b9113410d8a
Opcode Fuzzy Hash: a00e6d87b76b32352bdd0572f1a10fa192fcdef66c9494ecff57d142085c23ac
Instruction Fuzzy Hash: 6A01A7711093809AE7107B27CD84767BFD9EF55325F1CC92AED4A4A286CA79DC40C6B1

Function 00DED758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1821461575.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ded000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3707d5ad6bef1f2d29a4b896679f29a341b17562bb5130446c189124a31160bc
Instruction ID: b596a907f231a78fc87fb301329ccb45d33b91883bf20c7e92c29e5d32459959
Opcode Fuzzy Hash: 3707d5ad6bef1f2d29a4b896679f29a341b17562bb5130446c189124a31160bc
Instruction Fuzzy Hash: 7EF0C272004380AEE7109B16CCC4B66FFE8EF50728F18C45AED090A286C2799C40CAB0

Analysis Process: workbook.exePID: 7684, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	46
Total number of Limit Nodes:	3

Executed Functions

Function 026CD409 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 026CD496
GetCurrentThread.KERNEL32 ref: 026CD4D3
GetCurrentProcess.KERNEL32 ref: 026CD510
GetCurrentThreadId.KERNEL32 ref: 026CD569

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4e33f49a25e58f61e4e7971a18a6553dad39509deb83709dda3cd942be08c6b6
Instruction ID: 5529b0514606be67a43b153dd2ea411753547474ad5a459d1f3eac8634f65a6f
Opcode Fuzzy Hash: 4e33f49a25e58f61e4e7971a18a6553dad39509deb83709dda3cd942be08c6b6
Instruction Fuzzy Hash: C45167B49003498FDB04DFAAD5487EEBBF1EB48318F20C069D049AB3A0D734A944CF66

Function 026CD418 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 026CD496
GetCurrentThread.KERNEL32 ref: 026CD4D3
GetCurrentProcess.KERNEL32 ref: 026CD510
GetCurrentThreadId.KERNEL32 ref: 026CD569

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5ae57be77a7847a664654efbf0c7f6ff66ec1f29747f5701449d1fd46cc6e3be
Instruction ID: 90c77cda20675981651fa6cc30552e50098cb21491d9ad1fd8d334b2c412301a
Opcode Fuzzy Hash: 5ae57be77a7847a664654efbf0c7f6ff66ec1f29747f5701449d1fd46cc6e3be
Instruction Fuzzy Hash: 8A5158B09006098FDB14DFAAD548BEEBBF1EF48318F20C469D019A7360D734A944CF65

Function 026CAD88 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026CAFDE

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 56fb938f25eafc494ba93f3a9c3667249b7638533d6a4bcc5a39fa25324fc618
Instruction ID: 660788732a32be391b493ea6de1225661595a695da8743f82df3903c48ffaacd
Opcode Fuzzy Hash: 56fb938f25eafc494ba93f3a9c3667249b7638533d6a4bcc5a39fa25324fc618
Instruction Fuzzy Hash: A17113B0A00B098FDB24EF69D44476ABBF2FB48304F108A2DD48AD7B50DB34E945CB94

Function 026C590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026C59C9

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33a5832672c2d9c431c953b9e3667ccb479517f28f1852da4aa498d7361d38d0
Instruction ID: 7e3a6935f9f9b6bdc422c9ec945bbcdfd6a4860700bf230d49522fcce91b0598
Opcode Fuzzy Hash: 33a5832672c2d9c431c953b9e3667ccb479517f28f1852da4aa498d7361d38d0
Instruction Fuzzy Hash: E441F4B0D00719CFDB24DFAAC88469DBBB6FF48304F60806AD409AB250DB75694ACF90

Function 026C44B4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 026C59C9

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e28d2b7c81d03835f5612cea98316ba7b78d1a335add4b713b52a2d8271bf75d
Instruction ID: dbfeb1ba2762dcb5c86419415502f221a5b07746feb3754ef495116be453e998
Opcode Fuzzy Hash: e28d2b7c81d03835f5612cea98316ba7b78d1a335add4b713b52a2d8271bf75d
Instruction Fuzzy Hash: 3741D3B0D00719CBDB24DFAAC84469EBBF6FF48304F64806AD409BB255DB756945CF90

Function 026C5A84 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2d43830c6cd4ba3c5d5e52411ca3da0fbe7c02df2f01d368f35a6f4fb01c6e
Instruction ID: 4f7a09b66c17e3ef160e66c2e8b431382b4a121bcf27dbbb70a02923d516730b
Opcode Fuzzy Hash: 4c2d43830c6cd4ba3c5d5e52411ca3da0fbe7c02df2f01d368f35a6f4fb01c6e
Instruction Fuzzy Hash: 9831BCB1804289CFDB04DFE9C8557EDBFF1EF46308FA44189D006AB265CB75A94ACB41

Function 026CD660 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 026CD6E7

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 408e162daac4b0d374f84d5c1461c332cfc71110dca73dc06144d7bcde654939
Instruction ID: 22fac6fbfa04dbe1df265d8d1b7c940184fcb00e783f5b3b6656179f81826e70
Opcode Fuzzy Hash: 408e162daac4b0d374f84d5c1461c332cfc71110dca73dc06144d7bcde654939
Instruction Fuzzy Hash: 6121E4B5900208DFDB10DF9AD984ADEBBF4EB48320F24802AE958A7310C374A940CFA5

Function 026CD658 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 026CD6E7

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b25e14083a227364af99ba41b18c7b6ec7ce7a85d9d95516aeea6d249da2f691
Instruction ID: 38c701a588819850977f2e17e11b1bf3dd95006ecb19acbdd44718dc394268fc
Opcode Fuzzy Hash: b25e14083a227364af99ba41b18c7b6ec7ce7a85d9d95516aeea6d249da2f691
Instruction Fuzzy Hash: B921E4B5900349DFDB10DFAAD584AEEBBF5EB08310F24842AE958A7350C774A944CF65

Function 026CB011 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026CAFDE

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3685180ed532bfc9fc0f9e71266a8f960c62f3a68fefffa1d5136afbdc83ea43
Instruction ID: e47c5a45ce0c2835fff53f7c0487c81e1eb20df1200a8610e4e961f14c8227d0
Opcode Fuzzy Hash: 3685180ed532bfc9fc0f9e71266a8f960c62f3a68fefffa1d5136afbdc83ea43
Instruction Fuzzy Hash: 6C11B2B1A002498FD710EF99D8447AEBBF5EF85318F24806ED558D7251C7749805CBA4

Function 026CAF78 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 026CAFDE

Memory Dump Source

Source File: 00000006.00000002.1861927170.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d0d3fec61f1bd5cc3a2fb31793e731edd3b38c543e2696347f2c8afa8987e438
Instruction ID: 6b9f0d40779bc7393f52348aaa3bbf2871e7ce7ad8cbf75e7619eed631343327
Opcode Fuzzy Hash: d0d3fec61f1bd5cc3a2fb31793e731edd3b38c543e2696347f2c8afa8987e438
Instruction Fuzzy Hash: EC1102B6C002498FCB10DF9AC444ADEFBF4EB48224F20842AD469A7610C375A545CFA5

Function 025808C1 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861754248.0000000002580000.00000040.00000800.00020000.00000000.sdmp, Offset: 02580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1a2d1d0624065897ee926d6be90979d8aa9f0018bdfdfd2b9e8a3ecede2c06
Instruction ID: 90c5f4bb0ac91898573f1dff4724c939bf81e99b8425c87a0937e6def08adefa
Opcode Fuzzy Hash: 9f1a2d1d0624065897ee926d6be90979d8aa9f0018bdfdfd2b9e8a3ecede2c06
Instruction Fuzzy Hash: 47F0EDB0D04249AFC740EFBC88113EEBFF4BF89324F0049A9D014E7141E7B4020A8B98

Function 00A7D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858486912.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a7d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d29bd2d1cf031917b3d28a22d74c4e947fb35df210b162272ba7a989188413
Instruction ID: 07762ee4aec9cbdb267b4059c080900b1027d7b5cefd9ddd9f88d2136d042552
Opcode Fuzzy Hash: 30d29bd2d1cf031917b3d28a22d74c4e947fb35df210b162272ba7a989188413
Instruction Fuzzy Hash: 6D210372500204EFDB05DF14DAC4B26BF75FF98324F20C569E90D4B256C336E856CAA2

Function 00A9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858711031.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a9d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db3158fefc6dd0cd89e1e72277a62503e9e6c09e2e9d7129668ad117bd1016c9
Instruction ID: e82f58213f7cf145e21c89291028a6053b91c0a5cdfd802579cff8209caf8c85
Opcode Fuzzy Hash: db3158fefc6dd0cd89e1e72277a62503e9e6c09e2e9d7129668ad117bd1016c9
Instruction Fuzzy Hash: 6921F271604200DFDF14DF24D984B26BFA5FB84314F20C569D84A4B296C33AD887CA61

Function 00A9D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858711031.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a9d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220c32914305e936536ae75dc70c676ce125968041ba7767575a48cf85a12144
Instruction ID: 11ff36cd81b55e6ff391f4e54bb0b142ac455fd2b69db261c359837aeba0f9c5
Opcode Fuzzy Hash: 220c32914305e936536ae75dc70c676ce125968041ba7767575a48cf85a12144
Instruction Fuzzy Hash: 81210475604200EFDF05DF14DAC0B66BBE5FB94314F20C66DE9094F296C336D886CA61

Function 00A9D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858711031.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a9d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfa77bc75365cacc06245143c4caf6885f7799c388615246dc10b5452d572d1
Instruction ID: 2131cd848caa22af9e16bd82cc1d5241d8c0641d9ab49bcad835a521e0998366
Opcode Fuzzy Hash: acfa77bc75365cacc06245143c4caf6885f7799c388615246dc10b5452d572d1
Instruction Fuzzy Hash: 3F21A4755093808FDB02CF24D594715BFB1EB45314F28C5DAD8498B297C33AD84ACB62

Function 0258084C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861754248.0000000002580000.00000040.00000800.00020000.00000000.sdmp, Offset: 02580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f63db0df3353a4e07159db8c7507af6f86e71f94b04fec47b83c6405c1175fb
Instruction ID: be5d79e480b7eacb65b9c2599916ff82ff6d5f5da85bb66439239d5db99bff13
Opcode Fuzzy Hash: 0f63db0df3353a4e07159db8c7507af6f86e71f94b04fec47b83c6405c1175fb
Instruction Fuzzy Hash: AE111770E0120ACFDB14EF69C044AAEFBF1BF48314F1484AA9418AB361E775E945CB94

Function 02580C8F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861754248.0000000002580000.00000040.00000800.00020000.00000000.sdmp, Offset: 02580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08548e701d8ac4363ca55e1e0b07f9f656af7123beca7486f795e54acfe37e08
Instruction ID: d523241ba425dc4ae181fd765ab3455322ec78ed7416850d6e47980ae9df01ad
Opcode Fuzzy Hash: 08548e701d8ac4363ca55e1e0b07f9f656af7123beca7486f795e54acfe37e08
Instruction Fuzzy Hash: 4B116D70E01205CFDB14EF68C054AAEFBF1BF89314F1584A9D854AB361D7759842CF90

Function 00A7D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858486912.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a7d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 62417d4936cf678db72456c9e69d3dddae97bbc8acdb2ca3dbb3f0624a45ee71
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 0511D076504280DFDB16CF14D9C4B16BF72FF94324F24C6A9D9090B656C33AE85ACBA2

Function 00A9D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858711031.0000000000A9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a9d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 4a20418663811efc3227c5eed09deef8da66bd764653ce9b45ae88a6d0201c56
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 7B11BB75604280DFCB02CF10C5C4B55BBA1FB84314F24C6AAD8494F296C33AD84ACB61

Function 00A7D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858486912.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a7d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f752be03ef7da71926314df98ec45322935a99925329e3995b6576424c24e55e
Instruction ID: cbea473d5d28278ba8415f361a14f32beddca66d1edb5266f85731dd1c59c0a8
Opcode Fuzzy Hash: f752be03ef7da71926314df98ec45322935a99925329e3995b6576424c24e55e
Instruction Fuzzy Hash: 2C01A2711083409AE7148B2ACD84B67BFB8EF51724F28C92AED0D4E286C7799844C6B1

Function 00A7D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1858486912.0000000000A7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a7d000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d292c0017761a3b12f044e26e274882b098b765aad35b0aefcb73e13dc93483
Instruction ID: 2c6613d522bbad5cb0b1c9270c5b4fef9ccb47e2432fc63cc03d857a863c8a80
Opcode Fuzzy Hash: 1d292c0017761a3b12f044e26e274882b098b765aad35b0aefcb73e13dc93483
Instruction Fuzzy Hash: F4F062714083449EE7148B1ADCC4B62FFA8EF51734F18C45AED4C4F286C3799844CAB1

Function 02580C50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1861754248.0000000002580000.00000040.00000800.00020000.00000000.sdmp, Offset: 02580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2580000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04908978e576aa2db028167238ced61c996739660de3051858f3188f3334dfe9
Instruction ID: 2375d5ba61218c288a3bc11025a7773a78790ed77277b9f06cedca028daa69dc
Opcode Fuzzy Hash: 04908978e576aa2db028167238ced61c996739660de3051858f3188f3334dfe9
Instruction Fuzzy Hash: ACD062B0D4430ADED780FFB9850575EBFF5BB44300F108965C515F6241E7B442498F99

Analysis Process: workbook.exePID: 7720, Parent PID: 7596COMMON

Executed Functions

Function 085CDC50 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcbd6c24b14b6380919bc009f3b18ffb9cb9e3a29f68cb9a1c03310911940ad
Instruction ID: 5ff56ab070412272727c97df4f41a1a75f58420ff24c9d63c6a5b6dfee6e5870
Opcode Fuzzy Hash: 0bcbd6c24b14b6380919bc009f3b18ffb9cb9e3a29f68cb9a1c03310911940ad
Instruction Fuzzy Hash: AA327A70B012059FDB29EBA9C590BAEBBF6BF89301F14446DE106DB3A1DB35E901CB51

Function 018874E0 Relevance: 90.7, Strings: 72, Instructions: 732COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01887B26
4'^q, xrefs: 01887868
4'^q, xrefs: 01887B7E
4'^q, xrefs: 01887E96
4'^q, xrefs: 018878F4
4'^q, xrefs: 0188793A
4'^q, xrefs: 01887E12
4'^q, xrefs: 01887C86
4'^q, xrefs: 01887CB2
4'^q, xrefs: 01887980
4'^q, xrefs: 0188770A
4'^q, xrefs: 01887BD6
4'^q, xrefs: 018879C6
4'^q, xrefs: 01887F1A
4'^q, xrefs: 01887DE6
4'^q, xrefs: 0188807A
4'^q, xrefs: 01887F72
4'^q, xrefs: 0188767E
4'^q, xrefs: 0188804E
4'^q, xrefs: 01887E3E
4'^q, xrefs: 01887796
4'^q, xrefs: 01887F9E
4'^q, xrefs: 018877DC
4'^q, xrefs: 01887917
4'^q, xrefs: 01887822
4'^q, xrefs: 01887D0A
4'^q, xrefs: 018879F2
4'^q, xrefs: 01887A4A
4'^q, xrefs: 018877FF
4'^q, xrefs: 01887C5A
4'^q, xrefs: 0188772D
4'^q, xrefs: 0188795D
4'^q, xrefs: 018876C4
4'^q, xrefs: 01887D8E
4'^q, xrefs: 01887BAA
4'^q, xrefs: 01887D62
4'^q, xrefs: 018880A6
4'^q, xrefs: 01887FF6
4'^q, xrefs: 018876A1
4'^q, xrefs: 01887615
4'^q, xrefs: 01887AA2
4'^q, xrefs: 01887B52
4'^q, xrefs: 01887DBA
4'^q, xrefs: 01887CDE
4'^q, xrefs: 018878D1
4'^q, xrefs: 018876E7
4'^q, xrefs: 01888022
4'^q, xrefs: 01887A1E
4'^q, xrefs: 0188765B
4'^q, xrefs: 018875AC
4'^q, xrefs: 01887773
4'^q, xrefs: 01887EC2
4'^q, xrefs: 01887A76
4'^q, xrefs: 018877B9
4'^q, xrefs: 01887FCA
4'^q, xrefs: 01887F46
4'^q, xrefs: 01887AFA
4'^q, xrefs: 01887638
4'^q, xrefs: 01887E6A
4'^q, xrefs: 01887589
4'^q, xrefs: 018879A3
4'^q, xrefs: 018878AE
4'^q, xrefs: 01887845
4'^q, xrefs: 018875F2
4'^q, xrefs: 01887D36
4'^q, xrefs: 01887EEE
4'^q, xrefs: 01887C02
4'^q, xrefs: 018875CF
4'^q, xrefs: 01887ACE
4'^q, xrefs: 01887750
4'^q, xrefs: 01887C2E
4'^q, xrefs: 0188788B

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-1605395142
Opcode ID: 1a9ad2644173b01d541548d60499e0904eb2a4c1746c1e75b9ab59b4a94dd995
Instruction ID: 54f610681b8b834b9ae6d230ee93207a3be2bb1081e39dda835ec065dcbcd60d
Opcode Fuzzy Hash: 1a9ad2644173b01d541548d60499e0904eb2a4c1746c1e75b9ab59b4a94dd995
Instruction Fuzzy Hash: 8772EA70A4020A8FDB19EF75E9586EDBBF2FF44304F1085A9D049AB269DF305D8A8F51

Function 01887570 Relevance: 90.7, Strings: 72, Instructions: 688COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01887B26
4'^q, xrefs: 01887868
4'^q, xrefs: 01887B7E
4'^q, xrefs: 01887E96
4'^q, xrefs: 018878F4
4'^q, xrefs: 0188793A
4'^q, xrefs: 01887E12
4'^q, xrefs: 01887C86
4'^q, xrefs: 01887CB2
4'^q, xrefs: 01887980
4'^q, xrefs: 0188770A
4'^q, xrefs: 01887BD6
4'^q, xrefs: 018879C6
4'^q, xrefs: 01887F1A
4'^q, xrefs: 01887DE6
4'^q, xrefs: 0188807A
4'^q, xrefs: 01887F72
4'^q, xrefs: 0188767E
4'^q, xrefs: 0188804E
4'^q, xrefs: 01887E3E
4'^q, xrefs: 01887796
4'^q, xrefs: 01887F9E
4'^q, xrefs: 018877DC
4'^q, xrefs: 01887917
4'^q, xrefs: 01887822
4'^q, xrefs: 01887D0A
4'^q, xrefs: 018879F2
4'^q, xrefs: 01887A4A
4'^q, xrefs: 018877FF
4'^q, xrefs: 01887C5A
4'^q, xrefs: 0188772D
4'^q, xrefs: 0188795D
4'^q, xrefs: 018876C4
4'^q, xrefs: 01887D8E
4'^q, xrefs: 01887BAA
4'^q, xrefs: 01887D62
4'^q, xrefs: 018880A6
4'^q, xrefs: 01887FF6
4'^q, xrefs: 018876A1
4'^q, xrefs: 01887615
4'^q, xrefs: 01887AA2
4'^q, xrefs: 01887B52
4'^q, xrefs: 01887DBA
4'^q, xrefs: 01887CDE
4'^q, xrefs: 018878D1
4'^q, xrefs: 018876E7
4'^q, xrefs: 01888022
4'^q, xrefs: 01887A1E
4'^q, xrefs: 0188765B
4'^q, xrefs: 018875AC
4'^q, xrefs: 01887773
4'^q, xrefs: 01887EC2
4'^q, xrefs: 01887A76
4'^q, xrefs: 018877B9
4'^q, xrefs: 01887FCA
4'^q, xrefs: 01887F46
4'^q, xrefs: 01887AFA
4'^q, xrefs: 01887638
4'^q, xrefs: 01887E6A
4'^q, xrefs: 01887589
4'^q, xrefs: 018879A3
4'^q, xrefs: 018878AE
4'^q, xrefs: 01887845
4'^q, xrefs: 018875F2
4'^q, xrefs: 01887D36
4'^q, xrefs: 01887EEE
4'^q, xrefs: 01887C02
4'^q, xrefs: 018875CF
4'^q, xrefs: 01887ACE
4'^q, xrefs: 01887750
4'^q, xrefs: 01887C2E
4'^q, xrefs: 0188788B

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-1605395142
Opcode ID: a1d08b44920e705886bebd28856080aaf1e5305a2a91ff9de5b41581e90fc0dc
Instruction ID: b64d128afdd2d6906328d723649e121cf5dd60b65f0325ce4bf038de0b5049d1
Opcode Fuzzy Hash: a1d08b44920e705886bebd28856080aaf1e5305a2a91ff9de5b41581e90fc0dc
Instruction Fuzzy Hash: F872DA70A4010A8FDB18EF75E9586EDBBF2FF44704F1085A9D049AB269DF306D8A8F51

Function 085C28A0 Relevance: 4.1, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

(bq, xrefs: 085C29F5
(bq, xrefs: 085C29C9
Hbq, xrefs: 085C2A21

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: a1560c7d0a9f715e9ddf2b6662d80d5aa02a1456d050342ef1cfcbc1919147e1
Instruction ID: 083ea3a602e43a9ac92a6b85dcf4040b55917ed031672d160b93591a5e8211f7
Opcode Fuzzy Hash: a1560c7d0a9f715e9ddf2b6662d80d5aa02a1456d050342ef1cfcbc1919147e1
Instruction Fuzzy Hash: 69E15534A00209DFCB54EFA4D8949AEBBB6FF89310F108569E4156B365DB34ED82CF90

Function 018871D0 Relevance: 3.8, Strings: 3, Instructions: 72COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 01887239
`Q^q, xrefs: 01887294
`Q^q, xrefs: 01887209

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: `Q^q$`Q^q$`Q^q
API String ID: 0-846367443
Opcode ID: 94f1991db459930530d465e715c123f79d0a12f16ca8207524d16583e90917f4
Instruction ID: 43e2d632b58748be692311166c4560a9cfce54b8c3e904e9499d4f0cfddadc3a
Opcode Fuzzy Hash: 94f1991db459930530d465e715c123f79d0a12f16ca8207524d16583e90917f4
Instruction Fuzzy Hash: 49212931F002559BEB26EB78C80876EBBF2BB45F04F24005DD245EB284C7B4598587E2

Function 085C7920 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C7BD2
4'^q, xrefs: 085C7C09

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 480c8f3ef108b77c2b52008a544f76235ff0d279d541b6350f9e28a1eb5a531c
Instruction ID: c58c4606dd2f21b2bbbdb981704293c8abdee11c091f6f826971ff826adad628
Opcode Fuzzy Hash: 480c8f3ef108b77c2b52008a544f76235ff0d279d541b6350f9e28a1eb5a531c
Instruction Fuzzy Hash: BCC1B374A00618CFCB44EFA8C994AADB7B6BF89300F504568E506AB3A5DB71ED42CF50

Function 085C7912 Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C7BD2
4'^q, xrefs: 085C7C09

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 9880f63a8c79724c38e1cfdcda565f67b35b611b6faffc4b5ffc047a872b5631
Instruction ID: b5729a83184e76e8cb594657cb3a52dcf88afa2e3cec97044ae96d9302d6fe6a
Opcode Fuzzy Hash: 9880f63a8c79724c38e1cfdcda565f67b35b611b6faffc4b5ffc047a872b5631
Instruction Fuzzy Hash: 27C1C674B00618CFCB44EFA8C994AADB7B6BF89301F504568E506AB3A5DB71ED42CF50

Function 085C0E88 Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

Hbq, xrefs: 085C0FB5
(bq, xrefs: 085C0ED6

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: a28d4487196a22f07ffbdc9a3af5fc26ee47aff321b858a1216381d62e320e6a
Instruction ID: 239f6efcb35ebb8de331b1207783f09fe583e8b27083a19411f005f052a4f9c4
Opcode Fuzzy Hash: a28d4487196a22f07ffbdc9a3af5fc26ee47aff321b858a1216381d62e320e6a
Instruction Fuzzy Hash: 0D71DF30B046158FC740EBA8C95496EBBB6FF89701B1041AEE506DB3A1DF34ED46CBA1

Function 085C73E8 Relevance: 2.7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

Hbq, xrefs: 085C75B6
(bq, xrefs: 085C758A

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 5c3ef7aa47783ba78b5f05f14fcf5e7f51a83a6e8b51c8507f5f525f23671c45
Instruction ID: bb2038553279a266af3e313de6d37fb77b44173e461fbe53e447d28b6ef15998
Opcode Fuzzy Hash: 5c3ef7aa47783ba78b5f05f14fcf5e7f51a83a6e8b51c8507f5f525f23671c45
Instruction Fuzzy Hash: 4261DB307042958FCB25DFBD845426EBFE2BF89201B1485ADD546CB791DE34ED068F91

Function 085CAE38 Relevance: 2.7, Strings: 2, Instructions: 170COMMON

Download Yara Rule

Strings

(bq, xrefs: 085CAF5D
Hbq, xrefs: 085CAF89

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: c970e04b454a247896e1b95de06fa673ba6d727be13195944a29cd036aa92f44
Instruction ID: c0a336a68ca24a41a98a5c1a41f64f5cf80013c956bea8bfbce266ee28f8fbf0
Opcode Fuzzy Hash: c970e04b454a247896e1b95de06fa673ba6d727be13195944a29cd036aa92f44
Instruction Fuzzy Hash: EC510E713007558FD325DF6AC88475BBBE2FF84320F108A2EE55A8B3A0DB74E8458B90

Function 085C7238 Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

(bq, xrefs: 085C72B1
,bq, xrefs: 085C7251

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: a3d60fd699259a179e9281a41d48ee1f84fcad03acc03929ca8a35ccf37826ab
Instruction ID: 0af028b5a50506560c8b3dfc5d9426a2fd3149adb2ca1e6b72b89ee2fd0af177
Opcode Fuzzy Hash: a3d60fd699259a179e9281a41d48ee1f84fcad03acc03929ca8a35ccf37826ab
Instruction Fuzzy Hash: 8A41C3327001596FCF029EEA9C508FFBBEAFF8D251B04406AFA19D3251DA35C9159BA0

Function 085C6680 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 085C669F

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: 807e209e868789651f933a6d8d8cd1302493f22829ee101d9405e0a1a4d79de9
Instruction ID: ed9fd3a81869753a45ea8d71f47f5762611eaeb19f8bad9866882be21d1c65eb
Opcode Fuzzy Hash: 807e209e868789651f933a6d8d8cd1302493f22829ee101d9405e0a1a4d79de9
Instruction Fuzzy Hash: F8D1FB74B102189FCB44EFA8D994EAEB7F7BF88700F104558E406AB3A5CA75ED42CB50

Function 085C2E38 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

(bq, xrefs: 085C3105

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: be264a4f5197e5fa41fc51842c8964e6591f22439065b146fa95ee418f698cde
Instruction ID: 91914f67802566132fc894409ad14df48991a709f42692d77964709759593ff3
Opcode Fuzzy Hash: be264a4f5197e5fa41fc51842c8964e6591f22439065b146fa95ee418f698cde
Instruction Fuzzy Hash: B2A17F35304204DFD7159F64D854A2A7BB3FFC9311B1585ADE10A8F3A2CA36EC46DB51

Function 085C6650 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 085C669F

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: Pl^q
API String ID: 0-2831078282
Opcode ID: c5100da0f34f0cbb1cda1f57c4e8db7221e0f76f4baa91bb8d4b4c577ce21544
Instruction ID: b2f4991ead8886fd970b885eb1fc9d6cf01ce579da7477b4f67de6fbafce766f
Opcode Fuzzy Hash: c5100da0f34f0cbb1cda1f57c4e8db7221e0f76f4baa91bb8d4b4c577ce21544
Instruction Fuzzy Hash: B4B13E74B102189FCB44EFA8D894EAEBBF6BF89700F104558E405AB3A5CB75ED42CB50

Function 0188F01C Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0188F900

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 264350b4019b873035482a612f658434f6a4370ad1e90930de0a5d52ae7ce64d
Instruction ID: fbe42e52e4e460790b3272b76c858fce5182ad0164869e0ac315e52343d9deac
Opcode Fuzzy Hash: 264350b4019b873035482a612f658434f6a4370ad1e90930de0a5d52ae7ce64d
Instruction Fuzzy Hash: A3518C303006118FD719AB2DC854B2E77E6FFC5710F248469E206CB7A5CB75DE0687A5

Function 01889EF0 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 0188A0F3

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: `Q^q
API String ID: 0-1948671464
Opcode ID: 14522bf8274019320887f5dea3e5f1ef9266b70138cf4288046f7ef1537def6e
Instruction ID: 25c4021a2e770baccce4b9aa2b9bae09a9e9a0022da3916eb63e628da1e4add5
Opcode Fuzzy Hash: 14522bf8274019320887f5dea3e5f1ef9266b70138cf4288046f7ef1537def6e
Instruction Fuzzy Hash: 17512570604249CFE726EF39E41876A7FE2FB9A308F0440A9D044DB789DB76C945CBA5

Function 085C1F70 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C1FAA

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 481d6c43493a908b06820ca15c31cd97b36fc8f13d1814ecd0037b0cd518e60e
Instruction ID: 32fd99f3eb358a8a6286c27d8997eaf9532623c3314e7d6187a2ca6323bb0b9a
Opcode Fuzzy Hash: 481d6c43493a908b06820ca15c31cd97b36fc8f13d1814ecd0037b0cd518e60e
Instruction Fuzzy Hash: B7416F30B106188FCB94AB68C858A7DB7EBBFC9700F50451ED512AB398DF749D46CB91

Function 085C3CD9 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C3D8E

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 985af16b2de3ac44558aaac80f9cc0a08fadcb9559f4b7d9b38f1fd84a09aa8e
Instruction ID: 3762eaa9b46ce613460550de72da357db81e6e81c10d81c5aa89674a8258ac7b
Opcode Fuzzy Hash: 985af16b2de3ac44558aaac80f9cc0a08fadcb9559f4b7d9b38f1fd84a09aa8e
Instruction Fuzzy Hash: 1E416D357406049FD318DB68C954F6A7BEAAFC8710F1044ACE10A8F3A6CE75EC42CBA1

Function 085C3CE8 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C3D8E

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: f50397c6df666198a925fd88c196ebbfbb9b9e1c06e9bec108b53c1b8d81ed43
Instruction ID: 6b96371bcc164385b81b1766c123d478b3be5eef1b0419f5f3064063a8889210
Opcode Fuzzy Hash: f50397c6df666198a925fd88c196ebbfbb9b9e1c06e9bec108b53c1b8d81ed43
Instruction Fuzzy Hash: 21314A757406149FD358DB69C994B2A77EABBC8714F104468E20A8B3A5CE75EC42CB90

Function 085C1F4F Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

4'^q, xrefs: 085C1FAA

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: f8eab304adac75d09fa1950195777d57025ff282ce21205fc192a1a56c520000
Instruction ID: 91cd93cb91527624de4b37e0e8c993c34f2fe827376604b00289588506e1b2d4
Opcode Fuzzy Hash: f8eab304adac75d09fa1950195777d57025ff282ce21205fc192a1a56c520000
Instruction Fuzzy Hash: 4031A330B042549FC755ABA8CC58A7EBBABBFC9701F14046EE016EB395CEB44C45CB92

Function 0188DBCC Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0188DC59

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 95290a7b405576abee930a4f7c07a0c377c7ae4cf62a560ea1cd2959a0612ba1
Instruction ID: e0136f42f9ef1a71c075db9fac628a8164fa901ddb15261db93ee9650ae4fc0c
Opcode Fuzzy Hash: 95290a7b405576abee930a4f7c07a0c377c7ae4cf62a560ea1cd2959a0612ba1
Instruction Fuzzy Hash: F931FF70B002058FDB18EF68D484AAEBBF6FB88711F104669E506D7391DF70AD01CBA1

Function 018854B8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

4'^q, xrefs: 018854F9

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: c2cf8920a64055cf6d852d0a034f5283edd150f28b3ed475bbd3c6a5eaec9871
Instruction ID: 270a94426ee797bcb42976fd9fd1ea1802b96e7eaa91349d5945fccdb80ecd07
Opcode Fuzzy Hash: c2cf8920a64055cf6d852d0a034f5283edd150f28b3ed475bbd3c6a5eaec9871
Instruction Fuzzy Hash: 9E21287074428A8FDB56EBBCE4946BDBFB2EF41314F1504A9C005EF2A2DB245E0787A1

Function 01887120 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 0188713A

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: `Q^q
API String ID: 0-1948671464
Opcode ID: eae66183d83f43b0ae848c0bc772b8cc9e4f1ee40ee85de88934d1950b055abb
Instruction ID: c9c01023db7c55c1fb2d2337edf6b82c2bbdaf6813964d1e1d5493f7df4fbb3c
Opcode Fuzzy Hash: eae66183d83f43b0ae848c0bc772b8cc9e4f1ee40ee85de88934d1950b055abb
Instruction Fuzzy Hash: E2F06571740211AFD3094A6A9C98BB667E6EFCA620F19017AE10DDB2A1CA619C074764

Function 01887130 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

`Q^q, xrefs: 0188713A

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID: `Q^q
API String ID: 0-1948671464
Opcode ID: 09cb958813fb710cef1ff46a5f63de123417b02f017d4e7874727ea8c499eaf8
Instruction ID: ad9ff1c2a6a07e8e38b5668b9d95ffe67b2a5fa867fb41fc9d508c68463aa498
Opcode Fuzzy Hash: 09cb958813fb710cef1ff46a5f63de123417b02f017d4e7874727ea8c499eaf8
Instruction Fuzzy Hash: 91E086327401146BD318556FEC58F67B6DEEBC9A20F55007AF20DDB3A0CC91EC0542A4

Function 085CA551 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

xbq, xrefs: 085CA551

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: 099a68af46b97bdf2211ce2c9b968a521d4336837b1bb4c525a9cef0cf0c7068
Instruction ID: b4187fcef051d3fcc9cddf90e185e5ebd1d94c2747ea8e743de6307fe7d1f4d5
Opcode Fuzzy Hash: 099a68af46b97bdf2211ce2c9b968a521d4336837b1bb4c525a9cef0cf0c7068
Instruction Fuzzy Hash: FAF0ED387401149FDB04CB58D945A69BBF2FF88324F1580A9E109AF3A2C732FC028F90

Function 085C21B0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3de01814fec948e5b0e2b7bf9c535549f1b72384e47bfd29cb56acdb1529cc6
Instruction ID: a6e82943372525b05d01b6a473635f47360558e8ef30d80b4fa5202c72c2a88b
Opcode Fuzzy Hash: a3de01814fec948e5b0e2b7bf9c535549f1b72384e47bfd29cb56acdb1529cc6
Instruction Fuzzy Hash: 8B120B34A002198FCB54EF68C894BADB7B2BF89301F5095A8D54AAB365DF70ED85CF50

Function 0188E2C0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7f36e942115e2269b32a06af91f5c8295388ce97567051c6eb4369e6eaaf88
Instruction ID: 81b021b874a376efe2173c19e525acc7a898aab08892e774b581101248301b7b
Opcode Fuzzy Hash: 3c7f36e942115e2269b32a06af91f5c8295388ce97567051c6eb4369e6eaaf88
Instruction Fuzzy Hash: 3AE13F71A00619CFDB25EF68C884B9DBBB2FF45304F1144A8E909BB265DB71AE85CF50

Function 0188B7A0 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bef44e8d9968bfa3ec73a29deaa1d0644654c2c0daf0e9557e923d647ab4eb5
Instruction ID: 86796a32a431729a531c7b0b6861ca73c503add8b1e2487ac4496a41bc06afd4
Opcode Fuzzy Hash: 5bef44e8d9968bfa3ec73a29deaa1d0644654c2c0daf0e9557e923d647ab4eb5
Instruction Fuzzy Hash: 86D14E31A0061ACFCB15DF58C8C09AAB7F5FF84314B598869D956EB256E330FE95CB80

Function 01889BB0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1dc42fcc2fd352c134aca97b8325ca9de667db44a824661179f003c405ed14
Instruction ID: 0da1700ca690352bf40ec0f64ad349855128414d5d02ff0c4ae31f63f95d26db
Opcode Fuzzy Hash: 4a1dc42fcc2fd352c134aca97b8325ca9de667db44a824661179f003c405ed14
Instruction Fuzzy Hash: E4B19631A10606CFCB04EF6CC4949ADBBB1FF89314F1186A9E505AB366EB71ED45CB90

Function 085C6B38 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d956a7ad86f2c64f4526fad83c1734b8a7bedd9873fabf7732db85c188117fb
Instruction ID: c7845e213be18c61b9561e5a94664c959c9a9d0e99152916996bbafa7e1941e7
Opcode Fuzzy Hash: 1d956a7ad86f2c64f4526fad83c1734b8a7bedd9873fabf7732db85c188117fb
Instruction Fuzzy Hash: BFA148347006188FCB44EBA8C894A6E7BB6BF89700B40456CE5169B3A4DF75AD82CB91

Function 085C6B48 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151d56e352bb9513890e71994685ea0333a001a8e377e43dd6908853b4d07cb9
Instruction ID: b90dc139efe8dfc6d86955c8f5dfd08aa6513e4728b5ecaee36b06ebf03b473e
Opcode Fuzzy Hash: 151d56e352bb9513890e71994685ea0333a001a8e377e43dd6908853b4d07cb9
Instruction Fuzzy Hash: 70A149347006188FCB44EFA8C894A6E77B2BF89700B50496CE5169B3A4DF75ED86CB91

Function 085C6B14 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8a3bba31953123fab2c417902e51dc4b9e189811e04e296b9dd54556cdaca6
Instruction ID: 66bc50b2cf4d7bf280cf5d331e37702715fab5cae8ea9a1e5a281dd520e3e2f2
Opcode Fuzzy Hash: 9a8a3bba31953123fab2c417902e51dc4b9e189811e04e296b9dd54556cdaca6
Instruction Fuzzy Hash: BA915C34700A188FCB44EFA8C894A6E77B2BFC9700B50456CE5169B3A5DF35ED86CB91

Function 018885E0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4eb595c1b1c2ff2a8973334e80e572cd72958d49b5ee312275db122bb8bfab
Instruction ID: 76b8b3cf4a23d3a9ed3ce8882f5f98d2cad63887fdb1c0898d683e76d69e6d10
Opcode Fuzzy Hash: 5b4eb595c1b1c2ff2a8973334e80e572cd72958d49b5ee312275db122bb8bfab
Instruction Fuzzy Hash: 92A15631A10606CFCB04EF6DC4849ADBBB1FF89314F1186A9E505AB365EB71ED85CB90

Function 085C21A1 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5fa00e938a597a9a10fea18d1eb2489d2e926ac5437c688add7c12599a3022
Instruction ID: d01bc0c76c70004da5faf6d0576d5e7104f2d778741e1b42274d6ed04e81a72d
Opcode Fuzzy Hash: de5fa00e938a597a9a10fea18d1eb2489d2e926ac5437c688add7c12599a3022
Instruction Fuzzy Hash: 65A11C74A002188FCB54DF68C894BA9B7B2BF89301F5085A8E44AAB355DF70ED85CF50

Function 085C3170 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b301f359f979aa1dc2b6c354d71f2b3af20d5b0622dd6a7b909ec1370b0da2d
Instruction ID: b4ad4056dcc72d9e8c8363aa2c8c2a193e434a6b015fe025cc955f5505de6ee7
Opcode Fuzzy Hash: 8b301f359f979aa1dc2b6c354d71f2b3af20d5b0622dd6a7b909ec1370b0da2d
Instruction Fuzzy Hash: 8E913D347002189FCB45DF68D894AADB7B6BF89601F1481ADE506DB3A5CB74EC41CF90

Function 0188BBC8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9475d5a06ac58a5415f6057bcbec23346a00b401fe1a72272ed7964ee2547675
Instruction ID: b2dca50285eafb63a41e2706058b9538bb31f0dbb7f5a81c93dd339a1b3df84f
Opcode Fuzzy Hash: 9475d5a06ac58a5415f6057bcbec23346a00b401fe1a72272ed7964ee2547675
Instruction Fuzzy Hash: C3815930700A029FEB29FF2CC45176A77E6FF85304F140569E606CB695EB34EA51CBA2

Function 085C5AC8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2752f01a793b74965e9687d8df8ef2a8fadd4d662aa2e0bbf24c1c03497521
Instruction ID: 170f076b22612eb4e199b937040062b0245cdb886d55841ba720b0c1bfc22df6
Opcode Fuzzy Hash: db2752f01a793b74965e9687d8df8ef2a8fadd4d662aa2e0bbf24c1c03497521
Instruction Fuzzy Hash: EB816D74B006099FDB48EBA4D854BAE7BB2BF88700F10446CD402AB390DF75AD82CF91

Function 0188BFF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063af3798b3837a38382f8ba955d33cc7e15b5d1363b4cff724066e04881afbd
Instruction ID: 97111c38f8d658d0f72aceba6590bfdc76b4cca1e35cc81396e4eb42c2574831
Opcode Fuzzy Hash: 063af3798b3837a38382f8ba955d33cc7e15b5d1363b4cff724066e04881afbd
Instruction Fuzzy Hash: 708148B0A00B058FD724EF69C44479ABBF1FF48340F008A2ED18ADBA55D775E946CBA1

Function 085CA6CB Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f723d8143b82ae6333ecfb47bba50c218a7d1224ebc991513a927763399e5e62
Instruction ID: b284f6ec8bf0fd0bfcc51d59bcb51188423d10a2f9e20fe49baa3e889c012e95
Opcode Fuzzy Hash: f723d8143b82ae6333ecfb47bba50c218a7d1224ebc991513a927763399e5e62
Instruction Fuzzy Hash: 6C81E274A21228AFCB55CF98D984E9DBBF2BF88310F164559E505AB361D731EC41CF80

Function 085C3161 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823a3b374213f7a66062f859c40ac8ad3724d4365f477cb47fa92449866474e9
Instruction ID: 58ccb25a359897920f2b4930efc2dc103c53e260ce05ac4205fb8d5931bb51fe
Opcode Fuzzy Hash: 823a3b374213f7a66062f859c40ac8ad3724d4365f477cb47fa92449866474e9
Instruction Fuzzy Hash: 9E611B74710618DFCB44EFA8D894AADB7B6BF88601F1481ADE4169B365CB70EC42CF90

Function 085C5AB8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6183ea24617c0bdca764bea096537e657114301a9d541e6c5bdf79f0ff58442d
Instruction ID: 26bf34e30f65501273bdeb80a0097f98ca5b9c4a4fe1ed8b4d442e250c76f298
Opcode Fuzzy Hash: 6183ea24617c0bdca764bea096537e657114301a9d541e6c5bdf79f0ff58442d
Instruction Fuzzy Hash: 7F518F74B006099FDB19EFA4D854BAE7BB2BF88301F14456DD402AB391DB74AD82CF91

Function 085CD430 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8528af285bb4b1dca72d0528d902e21ef701e538296c7d31d68d5c8d622d1e9b
Instruction ID: f0006649245c825c1325de8f936ed6836dddd60dfb4172e3623e69badf2d891c
Opcode Fuzzy Hash: 8528af285bb4b1dca72d0528d902e21ef701e538296c7d31d68d5c8d622d1e9b
Instruction Fuzzy Hash: DF519071E012059FDB14DFA9D884A9EBBF2FF88306F558129E405EB290DB71AD06CF60

Function 0188E2B0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561b690736cd5898385e79e6f0e03a93890dcab74960735be2dbee7e4d998f8f
Instruction ID: 392883aa73a8305853a0337f706f23c2146ddb86e84ccd5631c48c1458917cd0
Opcode Fuzzy Hash: 561b690736cd5898385e79e6f0e03a93890dcab74960735be2dbee7e4d998f8f
Instruction Fuzzy Hash: 2A516530900219CFDB25EF68C984B9DB7B2FF85304F5044A8E509AB365DB71AE85CF60

Function 085CD420 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d59d00ff9412232921792cc39406512d36d1b0cf6b3fdbf35de8d3122e197b
Instruction ID: ff5139e656338713b81683526e3af66896dca3ed235d2a7abf1ac85cd0a33e45
Opcode Fuzzy Hash: 66d59d00ff9412232921792cc39406512d36d1b0cf6b3fdbf35de8d3122e197b
Instruction Fuzzy Hash: 38516E71E012159FDB14DFA9C984A9DBBF2BF88306F558169E404EB2A4DB70AD06CF60

Function 085CCE70 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ab0e0adeb369e09200f7eab922a585b53a95afdceabb6fcd6de203db4985b6
Instruction ID: 08a68b7950d123b4586009745f83dd374e0d6063ffafdf1b314a0873118f42be
Opcode Fuzzy Hash: 68ab0e0adeb369e09200f7eab922a585b53a95afdceabb6fcd6de203db4985b6
Instruction Fuzzy Hash: 8E41C431B003159FCB15DBA5D4586AEBBE3FFC4204F54852DD40AAB384EF70AC8A8B91

Function 01886540 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ed78f1727e54372f6da941afba294cc0644a21831a3f9d019adf3bbf153b29
Instruction ID: 67df36cc9e8ca2feb649db220d05beb7b387f17f85cb41db9d5b672e3e01d5fb
Opcode Fuzzy Hash: 77ed78f1727e54372f6da941afba294cc0644a21831a3f9d019adf3bbf153b29
Instruction Fuzzy Hash: D45135B090024ACFDB14DFA9D548B9EBFF1EF48304F248469E519A7360DB34A945CF65

Function 085CAA70 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40fa16f863706d8d42a902120b7dca1af3b8ee7595480d07875532fecde76b24
Instruction ID: 3a279dc69ff16301cf9f4ef7fc68b74a74742f6f1ba4d604a7a10487b0f2150c
Opcode Fuzzy Hash: 40fa16f863706d8d42a902120b7dca1af3b8ee7595480d07875532fecde76b24
Instruction Fuzzy Hash: 75417D71B006159FC705DBA9D854A9EBBF6FFCC310B2585AAD509DB361DB31AC01CB80

Function 018887B7 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbf9705cc1e0266f311cd0ab847c2a4ae43bd1f8bb5986becd963ab79c56a4
Instruction ID: 4706d1046c7e441f806e827baa0cb737213568832d590fefbcadc49100b05f36
Opcode Fuzzy Hash: 52dbf9705cc1e0266f311cd0ab847c2a4ae43bd1f8bb5986becd963ab79c56a4
Instruction Fuzzy Hash: 693109316042424FD706EF6CD850398BBE1EFC6320F0985BAD409DF396DA749D4687A1

Function 0188F104 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d122a5b77250609a459b69f468279cc868361d9f067d12c00b15b0ed504e7936
Instruction ID: 02c14dc87bdb737713a86ec9cc73afdb79850a4f4cf04d3dcdd9d65c366dfab1
Opcode Fuzzy Hash: d122a5b77250609a459b69f468279cc868361d9f067d12c00b15b0ed504e7936
Instruction Fuzzy Hash: 9E415C34A10619CFDB15EF69D884AAEBBF1BF89704F1040A9E601EB3A6CB31D941CB50

Function 085C73DA Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0168bc8775147ae5c3588441935983aec33097ac54e2e1bc086522ba3b69a24
Instruction ID: c4f0b898bcbb3e6bca1e15312d850535f402cefb715e324015077377d6357389
Opcode Fuzzy Hash: b0168bc8775147ae5c3588441935983aec33097ac54e2e1bc086522ba3b69a24
Instruction Fuzzy Hash: 6941E2342002458FCB24CFBDC88466A7FF6BF89216F04856DE891CB691E770D949CF90

Function 085CDAF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac283b533b3d8752863597a466f50690411e46d0f1138b454b3ad7082d61b32
Instruction ID: 6e09fffc97f3c717ef3c4f20916f5913cbadc2da1843dbec61eea1b4dad4ed3d
Opcode Fuzzy Hash: 7ac283b533b3d8752863597a466f50690411e46d0f1138b454b3ad7082d61b32
Instruction Fuzzy Hash: 72413A793006058FC709DB68C458AAABBB2BFC931AB1544ADE5199F372CB35EC42CF51

Function 085CCE6F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b6ef80a5b98b5a73115440b4f2f8576ea04402318c059dead2fba0e701a850
Instruction ID: bc340a36fd93bc65cf93138ddec25623039cb09dc3c63f828b83fe68568d3d1f
Opcode Fuzzy Hash: 92b6ef80a5b98b5a73115440b4f2f8576ea04402318c059dead2fba0e701a850
Instruction Fuzzy Hash: 7641A871B003169FDB15DBA5D4546AEB7E3FFC8204F54852DD40AAB384EF70AC8A8B91

Function 085C5E11 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3308c44c61c2b8a288b7ed4d70689558aa5a97eb428e705e18da57b101784a0
Instruction ID: 1076e5356821e716e21added7c8888306617850404099ffbe5cf9a32f0b52ff4
Opcode Fuzzy Hash: e3308c44c61c2b8a288b7ed4d70689558aa5a97eb428e705e18da57b101784a0
Instruction Fuzzy Hash: 78319C34B006088FCB45EFA8C85496EBBB6BFC9700B00859ED406DB365EF749D46CBA1

Function 01886414 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f7d53eaae9f31f7bb59722a5e008b9daffb02be5653f6dced3c9968eb54ec6
Instruction ID: 84634f7e963259770715718503dd7952c10d02fa130f5d3cb57b3b041610bea8
Opcode Fuzzy Hash: 28f7d53eaae9f31f7bb59722a5e008b9daffb02be5653f6dced3c9968eb54ec6
Instruction Fuzzy Hash: 6F41E0B0C0061DDFDB24DFA9C884BDEBBB5BF48304F24806AD408AB255DB756985CFA0

Function 01887364 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befd2c0263e91a972b47795f47bdf09240c1e1a0fdaad84433cea81f71f974d5
Instruction ID: aea19feb6bf8bf747201659359b8ec67e140ca01ef73df1fe1eb3494de6a353b
Opcode Fuzzy Hash: befd2c0263e91a972b47795f47bdf09240c1e1a0fdaad84433cea81f71f974d5
Instruction Fuzzy Hash: CC41C3B1C00619CFDB24DFA9C984BDDBBB5BF44304F24806AD418AB255DB756945CF90

Function 085C34A0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89e9f07348e6be1d9140078063f7741701bceaca952a63941fa380540027ba9
Instruction ID: 68e208fadd6da21f49e2a00d26a27593ffcd608e145415fdf4df928a45be5c96
Opcode Fuzzy Hash: b89e9f07348e6be1d9140078063f7741701bceaca952a63941fa380540027ba9
Instruction Fuzzy Hash: ED311935A0011D9FDB54DFA8D854AEEB7B6FF88312F108069E805B73A4CA75AD05CFA0

Function 085C5E28 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bbd68d828806c5b6ea327814eda83d7a9dc14c5cac8abf6cbfc252b5ec5eb88
Instruction ID: 96a3e4ef6eff729d31f2ef54965e04fc881e0621f0402ea09d81786f628a18a2
Opcode Fuzzy Hash: 8bbd68d828806c5b6ea327814eda83d7a9dc14c5cac8abf6cbfc252b5ec5eb88
Instruction Fuzzy Hash: A0318034B106088FCB84EF64C894A6EB7BABFC8700F10855AD5169B368DF70AD42CBD1

Function 01886EDF Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5e1826fbc966faf47c5f2fd7e9cfdb9907458c74118ce81f4a01093480b8a9
Instruction ID: 9c43a72ce9993b556b80db82d512287e5b6427c9fae866ef419794a013a85083
Opcode Fuzzy Hash: dc5e1826fbc966faf47c5f2fd7e9cfdb9907458c74118ce81f4a01093480b8a9
Instruction Fuzzy Hash: 4F311035A002458BE706DFB9D514669BBF2AFC9300B2A8569D104EB396DB38D941CBA1

Function 01886EF0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7a81c6f00930ad95f60bd116606dc9418a3d081184fe4752155ac2b9fd6ea3
Instruction ID: 173b4e5f88c539cd9551e27b7dbbf841c8f52fc3bb9aaec19e4ae80cbc99852f
Opcode Fuzzy Hash: 3d7a81c6f00930ad95f60bd116606dc9418a3d081184fe4752155ac2b9fd6ea3
Instruction Fuzzy Hash: 0F310131A001458BE706DFB9D5506AEBBF2FFC9300B268169D105EB396DB38ED41CBA1

Function 0188DF70 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc72a7f31fe3c94e69abc953a1e8236d219a57078d68bfd1f596fafadfe284d
Instruction ID: 99a4f22b5339bcdf018a2c83181c79b411d2d9347572f6569d62e63512f34234
Opcode Fuzzy Hash: 8bc72a7f31fe3c94e69abc953a1e8236d219a57078d68bfd1f596fafadfe284d
Instruction Fuzzy Hash: 502109317006059FE714BBB994083AFBED2BB85350F844868C645D73D5EF348A46C7E2

Function 085CD0E8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2aa1b056f0b5d400d1a774f01a942c42739f4e7078bc8a69aa87031c542a693
Instruction ID: ebb6b580e36d444f33cc570c228915bcdb896bbe57604f48cb1044d02f0de5b5
Opcode Fuzzy Hash: d2aa1b056f0b5d400d1a774f01a942c42739f4e7078bc8a69aa87031c542a693
Instruction Fuzzy Hash: 4321F3343002409FD709677D981872FAAEFFFC9200F18446ED50AC73A5DD69DC8A83A2

Function 01886780 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8a21df470ca6e3083cc76291c7e210b29f3e62aab706e820c0a31fec87c4fa
Instruction ID: 364af190635411b31915d25a66ae36322caf881a09130ce569c75f87f6328bf9
Opcode Fuzzy Hash: 2e8a21df470ca6e3083cc76291c7e210b29f3e62aab706e820c0a31fec87c4fa
Instruction Fuzzy Hash: 8C3136B5A00259DFCB10DF99D484AEEBFF5FB88320F14802AE914A7350D334A950CFA0

Function 0188F958 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46c487babb62ba3eafc7a5dc5cc0c20c81b97bbb1b632c072400adb7d8aeda1
Instruction ID: 23de2b1ebc19ce02158c1588570464c4192e37c8f9882075dae868d404686f48
Opcode Fuzzy Hash: f46c487babb62ba3eafc7a5dc5cc0c20c81b97bbb1b632c072400adb7d8aeda1
Instruction Fuzzy Hash: 01216D303006129FE718EB2DD854B2E77A6FFC8714F508169E205CB3A4CB75EE4287A6

Function 0188E4C4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2105f7ecafcf551e7d295942de1c8f34aec1799f3986aef5cb47a3151ff3538
Instruction ID: 526aca5857844f3269cd5af307491b78ab6c086fa360e91174556132314b8b59
Opcode Fuzzy Hash: f2105f7ecafcf551e7d295942de1c8f34aec1799f3986aef5cb47a3151ff3538
Instruction Fuzzy Hash: 80315E30600215CFDB24EF28C584BA9B7B2FF85304F5044A8D119AB7A6DB74EE85CF61

Function 0188C4A8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf259a37e6754dd43fbcd07766234e8241cd8a39d138c03ba15282e6b89fee06
Instruction ID: 7a44d610f76b657e501f01e2df0239615278d25cd633b3aab5833fdb90ef28cc
Opcode Fuzzy Hash: bf259a37e6754dd43fbcd07766234e8241cd8a39d138c03ba15282e6b89fee06
Instruction Fuzzy Hash: BB11E131B053959FE7197B3C441807E7EA6AFC5310B1844AADB06CB295DE248A0787A2

Function 085CD0F8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96aa3e8ae01f320b549b49e9ed83e9c153815420e52647e61d6dae555e06f4f
Instruction ID: 6142fb4e87035a031e5bd21800e5a44d6060cda22a976fb1a35957e80096d72a
Opcode Fuzzy Hash: a96aa3e8ae01f320b549b49e9ed83e9c153815420e52647e61d6dae555e06f4f
Instruction Fuzzy Hash: 5511D3343002019FD709667D981872FA9DFEFC8640F14447ED50AC77A4DE69EC8A87A6

Function 017FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337130035.00000000017FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070495c94f2216181fab0a64e83170832dd2156c07169d10763e196270f1792c
Instruction ID: 8772a58081507cc769176612ebb76f959d903a0a34f9735c5624f424fc3f3de6
Opcode Fuzzy Hash: 070495c94f2216181fab0a64e83170832dd2156c07169d10763e196270f1792c
Instruction Fuzzy Hash: 0921D071604204DFDB25DF58D984B27FBA5EB88354F20C5ADEA0A4B356C33AD446CA62

Function 085CABB8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c81d3fac143eec6d34cdb4660b3c153310b81a3e47c8da31d9c9a30e5ccfeb
Instruction ID: 517307ad4aec19e597d1843f63ac67292639e5d9ba9aec8ce51711c79977fe6f
Opcode Fuzzy Hash: e5c81d3fac143eec6d34cdb4660b3c153310b81a3e47c8da31d9c9a30e5ccfeb
Instruction Fuzzy Hash: C3213971A102189FCB169FA8C844AEE7FB6BB8D320F14462DE415BB391DB319945CFA0

Function 01888560 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a49086d310fee11b402d781f6a37ee2fdac952f6e419e396c14e4d30ce0225e
Instruction ID: 4e98c211798646941adeea9bcc42ff75d73c816ef5e99e471915b8440fb26041
Opcode Fuzzy Hash: 6a49086d310fee11b402d781f6a37ee2fdac952f6e419e396c14e4d30ce0225e
Instruction Fuzzy Hash: CC2162716002068BD755EF2DC880395F7E2FF9A310F54C6B9E509DF389EA74AD458B90

Function 01888848 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443fdcc01604b79f8f1d9c6cc0112910fcf53d5d3c04acd55f1da54835d23359
Instruction ID: 7edc4cf3c6aea55f83a15a4b571f04d9c64e1ae7bda2f83fbf2d4606ee4d8823
Opcode Fuzzy Hash: 443fdcc01604b79f8f1d9c6cc0112910fcf53d5d3c04acd55f1da54835d23359
Instruction Fuzzy Hash: 042192716002068BD715EF6DC840795F7E2FF9A310F58C6BAE909DF386E674AC458BA0

Function 0188BF08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c3a309e0cf05a2cc6ba2604b31403766d20027bd0d72c6738f9cca60bca896
Instruction ID: 1cb1fd3edef269a9d7150a74511293582fa6c5d89701008c4a67e0972b2275de
Opcode Fuzzy Hash: b0c3a309e0cf05a2cc6ba2604b31403766d20027bd0d72c6738f9cca60bca896
Instruction Fuzzy Hash: 75216D70200B409FE716DF28C049755BBE1FF81308F144A6DE166CF6A1C7B6E99ACB95

Function 085CABC8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294300a9121613ccc5d34d7910b669a80bf163513ef452a05022bb325f805d6b
Instruction ID: 8e46f696645f14bcc0aa303d08fb3f24722545e903989701afdbaf42e28afbac
Opcode Fuzzy Hash: 294300a9121613ccc5d34d7910b669a80bf163513ef452a05022bb325f805d6b
Instruction Fuzzy Hash: F3214971A102189FCB169FA9C844AEEBFB6FF8C320F148629E515B7390DB319841CF90

Function 0188E184 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a031f3a4be110fbfd8f960b064e3bc4248653bab453c99a894ffe9a3d6e99
Instruction ID: c099189d08f8d052b68510260b5f034a4ac892820207174f157e8e8dd4fd3984
Opcode Fuzzy Hash: 523a031f3a4be110fbfd8f960b064e3bc4248653bab453c99a894ffe9a3d6e99
Instruction Fuzzy Hash: 1811C031B406198FDF15EBACC9407EDBBB2BF88301F044929D015EB295EB389A448BA1

Function 0188611C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf68cb006d6f1ee9076f07356086e8317ecf3fcdd00887fd35288b968bdd719
Instruction ID: 71f243b106b9a72f6ff322986d80f4881c67b887b9cf38b8fc0f529ccf840adc
Opcode Fuzzy Hash: cbf68cb006d6f1ee9076f07356086e8317ecf3fcdd00887fd35288b968bdd719
Instruction Fuzzy Hash: AA21E3B5900218DFDB10DF9AD984ADEBFF4EB48320F14841AE958A7310D374AA54CFA5

Function 085C2D78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28086e1cf3093986a48a889498ea6aa11128caf36bcf6c31d2098933c230ddf7
Instruction ID: f4a844fc76cf8769feabc664f722cd6a0bdc237d95dfafcbbd7d43f76651306b
Opcode Fuzzy Hash: 28086e1cf3093986a48a889498ea6aa11128caf36bcf6c31d2098933c230ddf7
Instruction Fuzzy Hash: 0921DE307002048FCB50DF64D984AAABBF6BF89300F04456AE402DB361DB70ED05CB61

Function 0188BEF8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f90ae87be890db408e85501646c4d4b2e28b290417d227aa290fc7771d649c
Instruction ID: 223cc1422ff34a7a0081088c9693e6f41d288576af488b89b368cd20367230c5
Opcode Fuzzy Hash: b8f90ae87be890db408e85501646c4d4b2e28b290417d227aa290fc7771d649c
Instruction Fuzzy Hash: 53215A302007409FE726DF28C059755BBE1EF81308F144AADD156CF6A6C7B6E99ACB91

Function 018889F9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4a085e1be7d7cc6de36d5cf86ce2fe2149d0a5ad041316e4fdbb529d0ce79e
Instruction ID: 0953da015b0c759420f21de13703727c83907527878d0d1b2ff9e8c109378c3f
Opcode Fuzzy Hash: 9b4a085e1be7d7cc6de36d5cf86ce2fe2149d0a5ad041316e4fdbb529d0ce79e
Instruction Fuzzy Hash: 4321C331A003068BDB01AFA8C840391B3B1FFD9320F1486B5D84C7B286EB717D85C7A1

Function 085CCD4F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb27d563ceeea51c206d57a26d296818a3459c0d1e32f35f8731b06c8ae1b716
Instruction ID: 05039175f17e1380b7ee2f2445209ded7d25fd87ae920411cdb0b1ba187afa94
Opcode Fuzzy Hash: fb27d563ceeea51c206d57a26d296818a3459c0d1e32f35f8731b06c8ae1b716
Instruction Fuzzy Hash: BD112FB8A002455FCB45EBB885842EDBFE6FF8D200B14496EC509E7345DB30AD06CBA1

Function 018885B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13462b14c8c34d9038ef7f1d8c05a820ac4fdb8cbf625cbc72f8beb3fe837cd9
Instruction ID: f2d8945abf115e47adb4ee7039f60be484d0ebfe19670160587641625febbe0c
Opcode Fuzzy Hash: 13462b14c8c34d9038ef7f1d8c05a820ac4fdb8cbf625cbc72f8beb3fe837cd9
Instruction Fuzzy Hash: D0218172A007068BDB01AFACC840395B3B1FF99320F108675E94C7B285EB71B98487A1

Function 085CCCB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca0064ac116346d7f2a5ee42cc799ace3b485ecef3bbe587e035012f2cb9bfc
Instruction ID: 19da602b807b30f36ad6f1ccde0a96d62d3f19ec5f520f0305a1e48b924ad7b8
Opcode Fuzzy Hash: 2ca0064ac116346d7f2a5ee42cc799ace3b485ecef3bbe587e035012f2cb9bfc
Instruction Fuzzy Hash: 8701C4717042819F8769AAAD494053E7E9BBFC5251B5444AEDB0FCB354DE20DC42CB91

Function 085C2D88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a09081f02d4e5765d94cb3b20c386dfc0ae21e3f3ea14f6cc4482b8d6d8d3bf
Instruction ID: a36f7cc6e7cd4d6e9dfdc982da2f369c0c8d82c9f6ce712cf4654ef4f004a48e
Opcode Fuzzy Hash: 7a09081f02d4e5765d94cb3b20c386dfc0ae21e3f3ea14f6cc4482b8d6d8d3bf
Instruction Fuzzy Hash: C0119D34B006088FCB64EF68D894AAEB7F6FF88300F144569E5069B364DB70ED05CBA1

Function 085CCD60 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1495905380fba4ca426824eab40b77069c112ad0569bfbfb4f2cbcd1bd9e1609
Instruction ID: 59c9f2804143f2ee59b3f0227a0136f9ac866dd942142ba04ed58869a63870cd
Opcode Fuzzy Hash: 1495905380fba4ca426824eab40b77069c112ad0569bfbfb4f2cbcd1bd9e1609
Instruction Fuzzy Hash: CF11CA74A002599FCB44EBA885446AEBBE6FF88200B14856DD909A7305DF30AD45CBE5

Function 0188C294 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4010def09bd6505cdf0d2f9f86a0bbe34df3548969b821227ffa2acf1d0dac87
Instruction ID: fe622ebff8c86c31d32b1a780c519612055ce0ea15cad0d3cd2ee3081d94c16a
Opcode Fuzzy Hash: 4010def09bd6505cdf0d2f9f86a0bbe34df3548969b821227ffa2acf1d0dac87
Instruction Fuzzy Hash: 651123B6D003099FDB10DF9AD444AEEFFF4EB88320F10842AE519A7210C375A645CFA4

Function 0188670F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4783b31bb5f1a92d4d65bce06731faf951b2fd2fbbaa57c262bf2acef9bb61a
Instruction ID: 4738965ea6904eb12d91d714fa11dee2f863ef469c12ec1ded7c2d388400d9ad
Opcode Fuzzy Hash: d4783b31bb5f1a92d4d65bce06731faf951b2fd2fbbaa57c262bf2acef9bb61a
Instruction Fuzzy Hash: 9F118F7A6001199FCB02CF94D8048A9BFF2FF893207158096EA04DB322D732DD15DF60

Function 01884658 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce5d8a501afaba4862f9947965dfd75fe8516e3524f72fe7c0c7b87dc488c05
Instruction ID: 76210878fd8e920f14ab5080a2baf999ebdeb102d61c4363debd4282df89e08c
Opcode Fuzzy Hash: 1ce5d8a501afaba4862f9947965dfd75fe8516e3524f72fe7c0c7b87dc488c05
Instruction Fuzzy Hash: 081188306403018FC729AB78D05856EBBE2FF85310701896ED146CBBA4DF78AD058B82

Function 0188C870 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f4e9548a9ad90e509e2c4dafa2d6f5409920e60b6e842d06578a24d13ce66c
Instruction ID: 22af1413e397b0fcc47a5de3d23de7bf2d390e5af3f71c28b175b57f06ed01ee
Opcode Fuzzy Hash: 67f4e9548a9ad90e509e2c4dafa2d6f5409920e60b6e842d06578a24d13ce66c
Instruction Fuzzy Hash: ED11EFB6D002098FDB10DFAAD544ADEFBF4AB88320F14842AD519A7610C379A645CFA5

Function 085CB6F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b246b916f7d051bb61cca835fe9c4441ecb3a888fc425f2b2385a2596a4d3045
Instruction ID: 9b63fd4d81bab66c26c5fb98f6ca0e0f2f38a72d040cf73623b54dbc8a38fcce
Opcode Fuzzy Hash: b246b916f7d051bb61cca835fe9c4441ecb3a888fc425f2b2385a2596a4d3045
Instruction Fuzzy Hash: 12117035B50609AFCB109BB4D941FADBBB6BF89B01F108069F6069B2A0EB719506CF51

Function 017FD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337130035.00000000017FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 017FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17fd000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 061a631cc2e9f67696d5bd13750d38576f73e2b114031e831ac02e21b2ccf302
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 6A11A975504280CFDB26CF58D5C4B16FBA2FB88214F24C6AED9094B756C33AD40ACBA2

Function 085CA8C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695c1413caa97dd20f8d04ad9cf1bc93eaf1cfc76a233d56ad718f2ce0db6df3
Instruction ID: afc5431ed723b14546ffc2d8affc61ddb73d8616cccda011b3d0f11039aa76aa
Opcode Fuzzy Hash: 695c1413caa97dd20f8d04ad9cf1bc93eaf1cfc76a233d56ad718f2ce0db6df3
Instruction Fuzzy Hash: 7C115E74A10229DFCB55CBA8D895EAD7BB2FF84320F150159F416AB3A2CB349C41CF40

Function 085C35D9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa703b1c89351ed2fbd5b7f36f1e1143aa3860463af17874579bafb2418bbd9d
Instruction ID: b1a2772f5bf372af7631c0c2625dc6614242cebd5e64c93f45c5374e3ca54565
Opcode Fuzzy Hash: fa703b1c89351ed2fbd5b7f36f1e1143aa3860463af17874579bafb2418bbd9d
Instruction Fuzzy Hash: BE1104313006448FC3269B74D454B2AB7A2FFC9311F0885ADD0468B7E1CB34EC82DB80

Function 0188C1F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ae8c7e9984e947e983c07ece853e20026726bfc8e95a1991f2dadb2590ef14
Instruction ID: 57e7f8756f053fee07cdfd77fcffa4994f0d8576180e6a2956dcfea290782207
Opcode Fuzzy Hash: 78ae8c7e9984e947e983c07ece853e20026726bfc8e95a1991f2dadb2590ef14
Instruction Fuzzy Hash: 8F1110B5C002498FDB10DF9AC444ADEFBF4AB88320F10852AD529B7650C375A645CFA5

Function 0188C464 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414d18312a0b9502be7b7d524e7d809961745aa2e8d2c6e083be600c82e892d2
Instruction ID: 73755ef2401e31e39a6d6e7da4fde299cdc7129f9fbd252f1b95946ca3f3200c
Opcode Fuzzy Hash: 414d18312a0b9502be7b7d524e7d809961745aa2e8d2c6e083be600c82e892d2
Instruction Fuzzy Hash: 6E019631A406699BDF14EB6CC8947EEBAF5BF88301F040929E442F7294DB785A44CBA1

Function 085CD058 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103fde8d1e661a1b3c85b1018adde1b995be364f7ab89d2a41d47557cfa59634
Instruction ID: a1ac14da17c3cb8f3ddb89e3168bc96b7e9bba0f0c8dee5a3b1144768f8d1ebc
Opcode Fuzzy Hash: 103fde8d1e661a1b3c85b1018adde1b995be364f7ab89d2a41d47557cfa59634
Instruction Fuzzy Hash: FE01BC313003548FC721E768E00479ABBE7EBC5319F04856DD44A87352EB7AAC8A87A2

Function 085CD6A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d700070911f849fb980cadba20e17db4d99fdf1cba3e558d9e94bb93019867
Instruction ID: da90d8aac668953b80df9e1db924ba7215f4e31c9b097c2ca81d07eec32c622a
Opcode Fuzzy Hash: 25d700070911f849fb980cadba20e17db4d99fdf1cba3e558d9e94bb93019867
Instruction Fuzzy Hash: A711E0B9800288DFDB10DF9AD584BDEBFF4EB48320F248459D559A7210C375A584CFA1

Function 01884668 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b13854630ab52bb08741f3dd18ce51723f45e2e53e849ffb1a2070f45f75664
Instruction ID: 27b7e6939a06825bdc1228245269517dd1ecca4079665aef98d6f8d8c6dd8811
Opcode Fuzzy Hash: 9b13854630ab52bb08741f3dd18ce51723f45e2e53e849ffb1a2070f45f75664
Instruction Fuzzy Hash: 370165312007018FC729AB78D058A6EBBE2FF883107008969E50BCB798DF75ED048BC6

Function 01888950 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4762878b68e32af7c99e3176ac8e0f270d6ad7f2dcbe96c60ef3d463b93279
Instruction ID: 95e9328f3b19d124278ac8d075ea979c8c819371a19565b2907fffeb575e3d70
Opcode Fuzzy Hash: 5c4762878b68e32af7c99e3176ac8e0f270d6ad7f2dcbe96c60ef3d463b93279
Instruction Fuzzy Hash: 3F01D6313053018BD701AF6C885078577A6FF96320F1482B5E90CAF7C6DB755D4687B1

Function 085C0E51 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955a45d347159de9fb0ca3b5ca81287aa6df35be7e66c4234f4b6e0e9ca0ec57
Instruction ID: 02a71d88b932209091bbab2122e27f6f85744eced14dbcfc0acb2e2e436a1a81
Opcode Fuzzy Hash: 955a45d347159de9fb0ca3b5ca81287aa6df35be7e66c4234f4b6e0e9ca0ec57
Instruction Fuzzy Hash: C1F022B2340B509FC75526A85814A6F3BAAAFC6251B04406FE000CB380DA669D42C7A0

Function 0188C4B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a44dd7487db97790107fb439353fe5c85f9c84cd98a1468a940754be442e70
Instruction ID: e6c64813a04884568f7979dc9fd3ef2e964a338c910fafb61b15cf3fcf68fe18
Opcode Fuzzy Hash: a5a44dd7487db97790107fb439353fe5c85f9c84cd98a1468a940754be442e70
Instruction Fuzzy Hash: 41018F35A002099FDB50EF79C84479DBBF9FF45705F1084A9E605CB292D774DA54CB40

Function 085C35E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb28914ebf8df0fdef05b2ad1fa32569f0ab4382d8c5d78348f1c11079936a1
Instruction ID: 77195cd4281c712ecda96982081a6757c067920c2374e94cce4ae5c2c5d9f49d
Opcode Fuzzy Hash: deb28914ebf8df0fdef05b2ad1fa32569f0ab4382d8c5d78348f1c11079936a1
Instruction Fuzzy Hash: DE01BC343006089FC3259A64D454A6ABBA2FBC9321F5489ACE5564B7D0CB75EC82DB80

Function 085C0991 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5d35658189d6ca5ac17b94cfca14f5cfa379e8c520cd06b2df006ef90b7afc
Instruction ID: f1a9fdbb88899344b53e17757a43cc03a1d8a4135e0e25692b655e4eede67ad4
Opcode Fuzzy Hash: bf5d35658189d6ca5ac17b94cfca14f5cfa379e8c520cd06b2df006ef90b7afc
Instruction Fuzzy Hash: E801D4753006049FC3069B24D45496A7BB2EFCD71071081AEE906CB7A1CB36EC02CBA1

Function 085CD6B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b5956e358bf286363026ed4648772e0f9bd93bf17e554592a48b58fb2635bc
Instruction ID: 3fe5eb0903ce45d6760befc8de0a8b5c344b82df88e8993a538916576b591852
Opcode Fuzzy Hash: 17b5956e358bf286363026ed4648772e0f9bd93bf17e554592a48b58fb2635bc
Instruction Fuzzy Hash: 6611C2B5800249DFDB10DF9AD585BDEBBF8EB48320F108459D558A7250C375A544CFA5

Function 085CD048 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bba2bc032551ab934358ceb6cbf1b52390b4c1b9815226934b430b04a824264
Instruction ID: 1d63ac98ceb01b1ca445fa765790ffa601b8bbac014439030253e9570d035458
Opcode Fuzzy Hash: 6bba2bc032551ab934358ceb6cbf1b52390b4c1b9815226934b430b04a824264
Instruction Fuzzy Hash: 490175312087908FD712D728D4547596FE7EB85315F0845ADD0858B353DB6AAC46C7A2

Function 01888580 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb44e5e54c38c764dbe2949f2d84069eb49d0c48cb2a3e65e720cc297eaeb56
Instruction ID: b9d2c10fdf25a060c513245c1efdcb2720283609dc6bf1ae171727f21b380a52
Opcode Fuzzy Hash: bfb44e5e54c38c764dbe2949f2d84069eb49d0c48cb2a3e65e720cc297eaeb56
Instruction Fuzzy Hash: A3F0A47130020547E700AF6D8890756B7A5FB95320F504675E908AF3C9DB71694487B5

Function 0188E220 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a76bf4ef05e97950f841bd3481766441c9ce6dd05b9cea6d175a50431e8fd72
Instruction ID: 6574b07599a1360e908e139882ff7aac56abf3ed8cd7a800ba96bf16e4561741
Opcode Fuzzy Hash: 9a76bf4ef05e97950f841bd3481766441c9ce6dd05b9cea6d175a50431e8fd72
Instruction Fuzzy Hash: 83F0FF303192504FC70AA77C89656593BA2AF87710F4680EAD145CFBB7CE688C0687A2

Function 085C09A0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072b81a42737b5f8dad69da81a38819b71d23149d51e4c59c2834151c2098208
Instruction ID: e82584963fc1bde037d94a94d31f200b93940357ec19f6186bf2f4468b632bbd
Opcode Fuzzy Hash: 072b81a42737b5f8dad69da81a38819b71d23149d51e4c59c2834151c2098208
Instruction Fuzzy Hash: 750181793005189FC7059B24D45491AB7A7EFCC7117108169E90687790CF36ED02CBD0

Function 085C0718 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6224c4a7cbc377d872a934fbc999f7dc5077d4f851ca111ed6bb281cc86a2c
Instruction ID: f29de57fa7fd41ad81facfdf07f2b63fe91377796a6031ba60669151b74bfbd3
Opcode Fuzzy Hash: 0f6224c4a7cbc377d872a934fbc999f7dc5077d4f851ca111ed6bb281cc86a2c
Instruction Fuzzy Hash: F6F0AF79300300AFC3159B29D854D2B7BBAEF8A720B1540AEF946CB372CA31DC02CB60

Function 0188E110 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1793df1428c0fe081e9436cf8b85970b063fc45284d91a59dbfedef5374dc5f
Instruction ID: ac1408cedb0bd0ded904fe2e467e1518443e3db7dbd088e004fb1e0e2cdc74bb
Opcode Fuzzy Hash: c1793df1428c0fe081e9436cf8b85970b063fc45284d91a59dbfedef5374dc5f
Instruction Fuzzy Hash: F3F02431B803061FDB15A77C891069EBFA5AF80320F048671D018CB269EF28DE4987D0

Function 017ED603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337054563.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17ed000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6476e7a2d1cce8f6231461f2afafdcca46446c5d9642220db812b3e75e27ec1
Instruction ID: 3e666834758494e31d58dd3805b558b67d59fbe82a018e4a8286eac66ead09d9
Opcode Fuzzy Hash: d6476e7a2d1cce8f6231461f2afafdcca46446c5d9642220db812b3e75e27ec1
Instruction Fuzzy Hash: 97F0FF75600610AF97208F0AD984C23FBEDFBD4770715C59AE84A4B615C671FC41CEA0

Function 085C0E78 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7411eb8f36b5eed4a4b73813358ebe99bb34143f376cd847b7f47a526342a5
Instruction ID: 75f891488d3dc50489215f2a9ea2ec1a4d543804441f3aa22731de246789089a
Opcode Fuzzy Hash: 5c7411eb8f36b5eed4a4b73813358ebe99bb34143f376cd847b7f47a526342a5
Instruction Fuzzy Hash: 77F02761344B90EFC75126B85914A7F2FAE6FC6562B0840AFE441CF3D2CE698D42C3B1

Function 0188BED1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762573bb69ae87af3a8992e3a0519356b08d996a4a4f99b60d8cd900202460bd
Instruction ID: 3a5aab29ac4ce72ed442bb11393360801420bd3bfe09a89e3a5faf21956e6301
Opcode Fuzzy Hash: 762573bb69ae87af3a8992e3a0519356b08d996a4a4f99b60d8cd900202460bd
Instruction Fuzzy Hash: 21F0CD32B116418FC704CF2CE8947897BF1FF84210B0901FAE518CB252E330E990CBA2

Function 017ED5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337054563.00000000017ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 017ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_17ed000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b929315ca024fd7fcfb7c5d992372278951a02715e40e286bbf4d21d66b3b40
Instruction ID: 5b94e52b58cc12a5ec2ec91b24701385be3c127a92f617f5f7f8a53cbd2ff329
Opcode Fuzzy Hash: 6b929315ca024fd7fcfb7c5d992372278951a02715e40e286bbf4d21d66b3b40
Instruction Fuzzy Hash: BFF03C75104640AFD325CF06C984C22BFF9FF897607198489E84A4B352C631FC42CF60

Function 01885470 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56892cdafcd9647092a12b9f729583eacecc1d7904a94b4b5c0e5cf2a22147c0
Instruction ID: 7d8ea416e42c959648e61920a9780f5f73850eafabb441b5fc2437bac756766d
Opcode Fuzzy Hash: 56892cdafcd9647092a12b9f729583eacecc1d7904a94b4b5c0e5cf2a22147c0
Instruction Fuzzy Hash: 71F0E9613493D28FD753777CA4909BA3FA65F41321B05049AD045EF2A7D6098D02CBB2

Function 0188E120 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c251e564a09cbaa1f5a150ceb156ee41b72a604dd4f4de7950051ade1131bb08
Instruction ID: eeeecedd7c37bcb23bbf7b6717314687df8ca29636d19e989a435425c8b57cdd
Opcode Fuzzy Hash: c251e564a09cbaa1f5a150ceb156ee41b72a604dd4f4de7950051ade1131bb08
Instruction Fuzzy Hash: 89E0E531B407192BDB20B67D8900A9FBF99DF80760F004634D518CB358EF25EE4947D0

Function 0188C498 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482f2b07e04f10878e4383e5ff3818f7738f1db8800f03f2b5b2a0e1f7f61aff
Instruction ID: a4301a427fd534993550f475bb1edc08efb33f6dc8176b659101aa94042473ee
Opcode Fuzzy Hash: 482f2b07e04f10878e4383e5ff3818f7738f1db8800f03f2b5b2a0e1f7f61aff
Instruction Fuzzy Hash: 5CF030303500154BDB08B76CD494B6E779AEFDAB00F4084AAF10ACB7A9CE65DD4147E2

Function 01886720 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d7b0131e6f90fa143841b9bfaba8dad7ee0350378acf1395bfca94b2d9968a
Instruction ID: 77059bdb7f9e91389391d2af1984883cc92e2059d1760dfa48fb866bf94ce2c4
Opcode Fuzzy Hash: 44d7b0131e6f90fa143841b9bfaba8dad7ee0350378acf1395bfca94b2d9968a
Instruction Fuzzy Hash: 36F0543A200559AFCF029F85C804CAD7FAAFB8D3107098065FA05CB275D736D9259BA0

Function 085C388F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412b8ddeb0185d800cdc3a2ec938eb4372e5ad55c01a48cfad7daa2319d1e0a7
Instruction ID: a6510bbf97e4d3d6a3644fe655d968e8f39d3675016b2a7249b2f7bace526dcd
Opcode Fuzzy Hash: 412b8ddeb0185d800cdc3a2ec938eb4372e5ad55c01a48cfad7daa2319d1e0a7
Instruction Fuzzy Hash: 0FF0396904A384AFD30367B0D964881BF74AE6321575A80EBD04A8B673D626895BCB35

Function 085CA96C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf24c5adec8eef3c1a00efefd0d9da815df77954cd74e026e5602f31a3ac14d
Instruction ID: 2bdb8b4af8b1c5922780444b3e90cdddbbd6f2c35e6e3f1eac92da87633a582e
Opcode Fuzzy Hash: 6cf24c5adec8eef3c1a00efefd0d9da815df77954cd74e026e5602f31a3ac14d
Instruction Fuzzy Hash: DDF090B0A40129EFDB519F94CC9ABEEBBB6FF84611F06401CE006A72A0CB704C05CF40

Function 085CC560 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2143ce4497934b2d4d8786dac8ceb407c412eb6fae18c4b3207bf756b727bea8
Instruction ID: d1359e9b8354e196bb6cd97c9ca1e986dfa2e293b4ff358d1fbfdc4ea53b0867
Opcode Fuzzy Hash: 2143ce4497934b2d4d8786dac8ceb407c412eb6fae18c4b3207bf756b727bea8
Instruction Fuzzy Hash: 8AF0A0737002846F8250A69D600256BFBCAABE9233B1848AFE14AC7211CA61DC47CBA0

Function 085C0728 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528e63cb7936322fe5c7ec1586298cd319784d03281f36618c45cb9592ec3519
Instruction ID: 10a64ed3d579da233a9a04498478d29d6beb25b77b8b197d5edf8e33e8a112e7
Opcode Fuzzy Hash: 528e63cb7936322fe5c7ec1586298cd319784d03281f36618c45cb9592ec3519
Instruction Fuzzy Hash: 6AF05E393003049FC714DB19D854D3A77AAEFC9721B104169FA068B361CA31EC42CF90

Function 0188C698 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5c31756b7d9d3ac4eca2c26b3885147f4e6a49fa7269c782549781e9ce08fc
Instruction ID: 7491a7323e4a172f716fd099a7333b4cc8df02e97785f7d9e396891a9a09b7de
Opcode Fuzzy Hash: 7e5c31756b7d9d3ac4eca2c26b3885147f4e6a49fa7269c782549781e9ce08fc
Instruction Fuzzy Hash: 59E0D83171410617B758F17F9C109B7338FDBC07A4B08843DA609CB2C9EF909E0242B1

Function 0188AA88 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c722d65e7cfab43e669f26cdf9622fd2aeddfb7b8af3940aac43cb3b72b26a
Instruction ID: 3f33c34b41530e35b0f2643be9c99105c23dec6d97d904f3bd99adc69b8b39db
Opcode Fuzzy Hash: 88c722d65e7cfab43e669f26cdf9622fd2aeddfb7b8af3940aac43cb3b72b26a
Instruction Fuzzy Hash: 82F06230115384CFE3276FBAE5453657F959B52314F084096D441C79E6DB698A86CF32

Function 01887178 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b9cf8f1902a4a359e17527328e3086e957dd733b8570fa8496e62df85a84d8
Instruction ID: 28f91b82e42539e28fed0a6de351c9c1bb3197a8117003cfe5a71c733893d12d
Opcode Fuzzy Hash: b7b9cf8f1902a4a359e17527328e3086e957dd733b8570fa8496e62df85a84d8
Instruction Fuzzy Hash: 87E0D8363406354BD311AA7DD800AA673AEDF54765B508076EA04CB761EA31DD82D3D1

Function 0188D9D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7493de77afd5c0a4a60f61b73120917cf1a1d68207a152855319c07b80433b03
Instruction ID: f8e38f337dc8070334bc69be0707487695c71b9108fc0c74759771f2b8cb30d4
Opcode Fuzzy Hash: 7493de77afd5c0a4a60f61b73120917cf1a1d68207a152855319c07b80433b03
Instruction Fuzzy Hash: F0E092323005148BEF21A7FEF8006E9B39CEB41369B180566F60EE7281EB51ED108791

Function 0188421C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1249fa7367839f3a68dd33b3c3e85e170850434b30c914d055cd61489e5e661d
Instruction ID: 9dd3434eca662de68569624ac5de859d0e75517f015cdf32bc921232fef82b62
Opcode Fuzzy Hash: 1249fa7367839f3a68dd33b3c3e85e170850434b30c914d055cd61489e5e661d
Instruction Fuzzy Hash: B7E092322401061BC904F32CA8949BEAADBCFC2360B800839E11ADB358DE20AE4643E6

Function 085C92BF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856a80f72b36da2d7fcc93e9c0cbee26038708fc5ee7e77e032a13f0ef3f8606
Instruction ID: acc205c40e64c9fc2d0d39302b7dd754993024594ebda241ce727548bfbac906
Opcode Fuzzy Hash: 856a80f72b36da2d7fcc93e9c0cbee26038708fc5ee7e77e032a13f0ef3f8606
Instruction Fuzzy Hash: 64F089757101059FD720CF98D485EAABB79FF89714B10805DF105E7262CA31E806CBA1

Function 018897A8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf64d4d76593789fa8a68e0c6913e16591d8726d01eccf7272978f0296cfd080
Instruction ID: 4fc82c35b7d394ffffbd4e0bd33f61078979d0aa515abf78a0f67f1b86ca4225
Opcode Fuzzy Hash: cf64d4d76593789fa8a68e0c6913e16591d8726d01eccf7272978f0296cfd080
Instruction Fuzzy Hash: 16F08220111345CAE73BBAFEF685339BF98EB61314F044096E405C79DADBA48A90CF72

Function 085CC74C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc89f02124ee70e9035155284e2c98e11bedd0196943714ad95f2441d7925424
Instruction ID: 28b7cf46ff68f2d95f7b0cf0ee30e6077779c9dafb5d013d5f10ec6063013bed
Opcode Fuzzy Hash: cc89f02124ee70e9035155284e2c98e11bedd0196943714ad95f2441d7925424
Instruction Fuzzy Hash: DEF0B234A02209DFDB66DFA0E599BAEBBB2FF48642F21402CF406A2254CB305E44CF40

Function 01887167 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecad108c4f1d63eb357076909ad5d32202fe378da08efa6546f95c376858e7a6
Instruction ID: cffccfcd549151545fd99704099f9b061a4f83055c89cc0e719a8196107d39f6
Opcode Fuzzy Hash: ecad108c4f1d63eb357076909ad5d32202fe378da08efa6546f95c376858e7a6
Instruction Fuzzy Hash: DBF0223A24A7618FC3028F7CC9106943BB18F06324B1500A2D880CB762D636CC82D781

Function 085CB26F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232e5890f287fd5e8e494d6516f3410b7531a0c5ab737ee621d2f948c77498ed
Instruction ID: eb13971e3e1eca6e8c0542f238dc5a57f1b2307b12b8efb9eb9e915fb33030b7
Opcode Fuzzy Hash: 232e5890f287fd5e8e494d6516f3410b7531a0c5ab737ee621d2f948c77498ed
Instruction Fuzzy Hash: 0AE01276714B004BD764CA6EF551257B3E2EFC4261748C92EE59AC7B54DA30F8418F40

Function 0188D940 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cc9f0be4afc0ac644165525d597ad076ee9766bdce824a08779b9a407e207f
Instruction ID: 3907e95f1b73f0619f61226fb10d474954c0c70deeff3c394057d7ea19eebe3f
Opcode Fuzzy Hash: 56cc9f0be4afc0ac644165525d597ad076ee9766bdce824a08779b9a407e207f
Instruction Fuzzy Hash: CBE0C2323006248B9B04FAEDF8408E977DCFB48A6530400EAF60CC7A50CB51ED008791

Function 085CD038 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c700b5c63f12473e5803b8821e718b209c5f7a32f34651c3ebeb37f720fcbf
Instruction ID: f38ca3f59a4da97c105d5f96e4ece1acf3cf585eeeef74d2834aa96bc6352f91
Opcode Fuzzy Hash: 76c700b5c63f12473e5803b8821e718b209c5f7a32f34651c3ebeb37f720fcbf
Instruction Fuzzy Hash: DAE092316042504EDB11D3B4A41939DBBE3EB84314F40086AC25A97640DFB6698983D2

Function 085CAA20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a129e1c597cb879a3d4d488f2713637a5766d695ceb9c6c822da2d939973e0
Instruction ID: b7f8a29122cbbe4aec33e3afb60269798e74edf307716288ebd137a4da7d751b
Opcode Fuzzy Hash: 88a129e1c597cb879a3d4d488f2713637a5766d695ceb9c6c822da2d939973e0
Instruction Fuzzy Hash: F0E0C2213056904FD34AA3749C2819A3B87DB8722134981DF914A8BAA3CA644C028B55

Function 01884F69 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2a9f74d035811cfb06694f42ceab863d63cbffc65681379f4d8eb445510d4b
Instruction ID: 906d236d9aa7890754cf39ec82f72ad369e9da554bbec5d2bb1fe652913f1cc4
Opcode Fuzzy Hash: ac2a9f74d035811cfb06694f42ceab863d63cbffc65681379f4d8eb445510d4b
Instruction Fuzzy Hash: 9AE0EC71A083428FEB07EB35DB4A6657BB0EB422647094BA5E0048A566E66C5D0B8B91

Function 085CC519 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7223d46c0ea33e95d359782dea5405d7328e0e7c305587aec2ba573bb9552895
Instruction ID: a3d2fbf1ee63b6f9a30fa9612357c78591602b7cc4d276b51f33dd3e47f8d5b3
Opcode Fuzzy Hash: 7223d46c0ea33e95d359782dea5405d7328e0e7c305587aec2ba573bb9552895
Instruction Fuzzy Hash: 82E0127200D3846FC352D664E851896BF65AF52224349C8CFE489CF167C7368843D762

Function 01886DE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f2d5dd7fd78db9fc20bb9195c14ac562d230a0540f1620c7b884718cc6bf46
Instruction ID: acad4ea8019233b4bbb5bd1de45f84714bfe4fe93fb1d2623f37549cc94124c1
Opcode Fuzzy Hash: 92f2d5dd7fd78db9fc20bb9195c14ac562d230a0540f1620c7b884718cc6bf46
Instruction Fuzzy Hash: 2BD05E72F0451443C31BAA8CB0092EAFBD2BBD9221F854066D90883298FEA44C4203A2

Function 01889788 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e6e58a63a886111e708651c49f1f64a6d55add431c6ebcfb33509fe8c99429
Instruction ID: ea924cc88399977c2246c39a3817cfa380b59959d3dac032c41b637d16ab435e
Opcode Fuzzy Hash: 53e6e58a63a886111e708651c49f1f64a6d55add431c6ebcfb33509fe8c99429
Instruction Fuzzy Hash: 41D0A732164510078A14B22CA58486EF6A9EDC4710780493AE04BC322C9E50DA894194

Function 085CAA30 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880bb2497b63f41a17f43e3973fa7dda96dfa08161b8eb2887dce41678396273
Instruction ID: ad6c9d0d3f014dfeebd23ff1e3cd2a89a0c38a26786764f5d66130ffcd55b884
Opcode Fuzzy Hash: 880bb2497b63f41a17f43e3973fa7dda96dfa08161b8eb2887dce41678396273
Instruction Fuzzy Hash: B2D0C97531021847C708A6BAA8185AF72CFDBCA661B55806E960A83B55CE749C0287AA

Function 085C06F1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8926c182a4a6a3081465e7ad1db67142105f52dcd99e503def6bd972d3015d94
Instruction ID: e1b47322e67be836808413cff5e48c3febf8275958314cf0e6df223acdc0242b
Opcode Fuzzy Hash: 8926c182a4a6a3081465e7ad1db67142105f52dcd99e503def6bd972d3015d94
Instruction Fuzzy Hash: 40D052B2109780BFC3429B64DC44C823FB89B172A130A40C3E088CF233C2228804D732

Function 01885480 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252efbe82c7d5f8f2a0e4d5eb11607f53e95096eb62d6f0be4dacdcd788f7db5
Instruction ID: 82662ce20633f0b44cc6e253d0452cf94bb50b43290730e5efa77a41a21f7318
Opcode Fuzzy Hash: 252efbe82c7d5f8f2a0e4d5eb11607f53e95096eb62d6f0be4dacdcd788f7db5
Instruction Fuzzy Hash: 7BD0125230052247E65A776CA950FAB26CBEB81655F4100A8D605DB7E6EA04CD4107D1

Function 0188748F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9109e6dd9bf08d2669265f0b45441361bd45ef65f1926d0f9513b4400ba1359
Instruction ID: e7b6ea49efe58f656d3b5f395eae85b3a40e3f8402900385ab25203d369c565f
Opcode Fuzzy Hash: f9109e6dd9bf08d2669265f0b45441361bd45ef65f1926d0f9513b4400ba1359
Instruction Fuzzy Hash: ABD0677090431DCADB18DBEDC9987ACBBB2AF84315F604429C009AB294D779894ACB61

Function 085CB120 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773000d3a5f621c6e3d6b21f9a398adcb273993fb457fa266cb8eaa081baa4c8
Instruction ID: 22fc8c6e13481ee39f29280768e49948747a257b0a6a70fb0f3f4ca068d72b54
Opcode Fuzzy Hash: 773000d3a5f621c6e3d6b21f9a398adcb273993fb457fa266cb8eaa081baa4c8
Instruction Fuzzy Hash: 9ED0926410E2C06EC342DB688890846BF69AE9721071984CBB484DF2A7C6228D16D732

Function 0188A7E5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec07fe4f9a9f1340404aafbe069b8ab37cfedc81532a70252e46231c08c187b
Instruction ID: bba890958ebd0a4dffeaf52befe7a34d1c1bfee87b99f267ee7a10ae3e420fe7
Opcode Fuzzy Hash: 8ec07fe4f9a9f1340404aafbe069b8ab37cfedc81532a70252e46231c08c187b
Instruction Fuzzy Hash: 86C08032270A110BC605F33CF64098DF351EDC03507808634C46F4AB2CDB60F68E4545

Function 01884F78 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71158c8f33ab5d58bebec2b24904bd30cf90b26ed681578ee858e8183aaf5ef2
Instruction ID: 0fb99d6c9a24ce0ced8857da33b262db41f0d54e1d055dcc662069550872de3d
Opcode Fuzzy Hash: 71158c8f33ab5d58bebec2b24904bd30cf90b26ed681578ee858e8183aaf5ef2
Instruction Fuzzy Hash: BAD0C9703002028FEA12EF3AE74862A3BA1E7813847454854A1049B15ADB289D068B80

Function 085CAA43 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a586d5c5371147339f1e56c306d4579ac1f6a923036b624876dc706c1206ad4d
Instruction ID: cb58c18b204cf5abac8fb18708a685a4155fb60f624beaedaf74015aed2127d4
Opcode Fuzzy Hash: a586d5c5371147339f1e56c306d4579ac1f6a923036b624876dc706c1206ad4d
Instruction Fuzzy Hash: 7BB012E7AD09154B48020DF4BC1C6CA5713EC710FA75C4076E58DCA716D20FC6121550

Function 0188D910 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2337493254.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1880000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610b4c4f960054dd37fd9c5f382fd6e51e892644056e7ab51aa12caf0efcc1ac
Instruction ID: f7a291c1511a1b76ad2d93ed913685c5c4c35527d9592fa214d780edab3a9610
Opcode Fuzzy Hash: 610b4c4f960054dd37fd9c5f382fd6e51e892644056e7ab51aa12caf0efcc1ac
Instruction Fuzzy Hash: FCC09B341093C04FDB034B71555D0443F605D5211171558F6C0A58B492C95D8C47DF31

Function 085C8F08 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9957fe10f10e76d753c4a6f4543c02ba8fa4c71bf70a3ebf237bae6fb2b83848
Instruction ID: d8a64502d5e7542dd4694fd42dae96c0e5b05e980fc58807a77eefdcbf6453f1
Opcode Fuzzy Hash: 9957fe10f10e76d753c4a6f4543c02ba8fa4c71bf70a3ebf237bae6fb2b83848
Instruction Fuzzy Hash: A8C012745082805FC321DA24CC10C00BFA0AFA6305B19C4EEA8858B257D736DC12DB51

Function 085C0700 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 085C38C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31560664698bd3fe5e0308a1fa232f074b39ef59a954cefc94cf9ddd5b1fba7
Instruction ID: 6c4f017cdf089b687c20802177dc88b1c5f9a4704078cbdf5d99b04b08d92171
Opcode Fuzzy Hash: a31560664698bd3fe5e0308a1fa232f074b39ef59a954cefc94cf9ddd5b1fba7
Instruction Fuzzy Hash: 33B0923200420CAB8602AA84E904855BB69AB586417008025B609061218B32A922DB94

Function 085CB6BC Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a324d078c0adc19fb02720193295204c4e4c236ed9b9fc6bbe10baf6aa0956
Instruction ID: 137ef57aeb8cd6576910239ce11fb3171bd9d3c0c3f4a18f8b6e40d48497c031
Opcode Fuzzy Hash: f4a324d078c0adc19fb02720193295204c4e4c236ed9b9fc6bbe10baf6aa0956
Instruction Fuzzy Hash: 68A012B272010103F100855059467102F10C3B0323F004601622AA01C4DA5080048521

Function 085C9F85 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88409fdbae89628996eb890b98939854c36d79e28c9594b95b6d0c9621d135e9
Instruction ID: 87a0d14235027bebb15cc19d1aa170aa70a13e687c359aeefddf1add71a3c01c
Opcode Fuzzy Hash: 88409fdbae89628996eb890b98939854c36d79e28c9594b95b6d0c9621d135e9
Instruction Fuzzy Hash: 17A0112222E288AAAA208AA0A80A0383F28CA02022B0082CAFC0C00200882200208282

Non-executed Functions

Function 085C1108 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

(_^q, xrefs: 085C17BD
(_^q, xrefs: 085C17F4
(_^q, xrefs: 085C182A
(_^q, xrefs: 085C17B3

Memory Dump Source

Source File: 00000007.00000002.2379086224.00000000085C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_85c0000_workbook.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 1e4369268a258273aaff4d6a0f12876c6b8fb39f54dd3df609fe5295939af647
Instruction ID: 5db608011480c59af414a2023b57c46b5aea904618b0d519880c603a92648d58
Opcode Fuzzy Hash: 1e4369268a258273aaff4d6a0f12876c6b8fb39f54dd3df609fe5295939af647
Instruction Fuzzy Hash: C361E078B046448FC704DFB8D4548AE7BF2BF8A211B2444AED446AF762DB35DC86CB91

Analysis Process: workbook.exePID: 7904, Parent PID: 7684COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	80
Total number of Limit Nodes:	9

Executed Functions

Function 02DB6518 Relevance: 6.1, APIs: 4, Instructions: 141
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02DB65BE
GetCurrentThread.KERNEL32 ref: 02DB65FB
GetCurrentProcess.KERNEL32 ref: 02DB6638
GetCurrentThreadId.KERNEL32 ref: 02DB6691

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f71588ad9e1ad369c4d1b07e52cd067988f9722ac67246b18e94de4dcf9324c4
Instruction ID: 28a7a6b41cbfd468ab59946cddd332c178a09efab5a9b83e94f5ed3db74fc189
Opcode Fuzzy Hash: f71588ad9e1ad369c4d1b07e52cd067988f9722ac67246b18e94de4dcf9324c4
Instruction Fuzzy Hash: 345166B0910249CFDB18DFAAC549BDEBFF5AF88304F248459D049A73A0DB349884CFA5

Function 02DB6540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02DB65BE
GetCurrentThread.KERNEL32 ref: 02DB65FB
GetCurrentProcess.KERNEL32 ref: 02DB6638
GetCurrentThreadId.KERNEL32 ref: 02DB6691

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2ebd091fee538a19802a7c71aafc79b9931d2f80b59bed774ace046dd1dbfdbc
Instruction ID: 49faf73a6328e85fadc8a7711ba29bc6aadcf96b88fe0c67eab0f5e4100f1126
Opcode Fuzzy Hash: 2ebd091fee538a19802a7c71aafc79b9931d2f80b59bed774ace046dd1dbfdbc
Instruction Fuzzy Hash: C65135B0910249CFDB18DFAAD549BDEBFF5AF88304F208459E419A7360DB34A944CFA5

Function 02DBBFF0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DBC256

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0a3b01f44c7dc27b00c3de3c4fc757705fcb65921ac9505cd07b5dbb2d64b0f2
Instruction ID: 57870a67eeecd395da98c17af4e2234f012c3a57fcfcc99a5cefe52eced7e20e
Opcode Fuzzy Hash: 0a3b01f44c7dc27b00c3de3c4fc757705fcb65921ac9505cd07b5dbb2d64b0f2
Instruction Fuzzy Hash: DC8133B0A10B05CFD725DF69C56479ABBF1FF88204F108A2AD48AD7B50DB35E845CB91

Function 02DB6414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02DB7421

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3c15ac9e51f8ca60d72f274c83af87920da8f2980f689ff2a37e224cf8bc7a49
Instruction ID: fa09c438d9fff00f2f10787f7013f33a4edc3203b631abaa49c9d9d9ade93c70
Opcode Fuzzy Hash: 3c15ac9e51f8ca60d72f274c83af87920da8f2980f689ff2a37e224cf8bc7a49
Instruction Fuzzy Hash: E341DFB1C00619CFDB25CFA9C844BDEFBB5BF88304F20806AD409AB255DB756989CF90

Function 02DB7364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02DB7421

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dc6963f6c6be232ac24ec17506e616a405a7e076ad2b15177c6d2cc81be1da0e
Instruction ID: 8146c0e3cb623c2a9ad0ad98a1227e69cc3a49575e2a88c73753ef46ef215929
Opcode Fuzzy Hash: dc6963f6c6be232ac24ec17506e616a405a7e076ad2b15177c6d2cc81be1da0e
Instruction Fuzzy Hash: 0C41F2B1C00619CFDB25CFA9C944BCDFBB5BF88304F2480AAD409AB255DB755989CF90

Function 02DB6780 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02DB680F

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c3f439f41c11ac7027c93e3d7faf5dfd67b2c18d99d4ba9ade2c9e50113bf7de
Instruction ID: 9e45dd286630e0d5e056ee5146f88ebec775ab47bd36fa5cc74656c5b1cbedcf
Opcode Fuzzy Hash: c3f439f41c11ac7027c93e3d7faf5dfd67b2c18d99d4ba9ade2c9e50113bf7de
Instruction Fuzzy Hash: 3621E3B5D00258EFDB11CF9AD984ADEBFF8EB48320F14801AE954A3350D774A944CFA5

Function 02DB6788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02DB680F

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f913a37c3bf34c37de2f31914dfbb9a9df416acfb199ea360ef20163b62ce351
Instruction ID: 51b9a3638f01ecd888249252a739c07698883267c7492389b7e1d7b6790ede43
Opcode Fuzzy Hash: f913a37c3bf34c37de2f31914dfbb9a9df416acfb199ea360ef20163b62ce351
Instruction Fuzzy Hash: A121B0B5900258DFDB10CFAAD984ADEBBF8EB48320F14841AE958A7350D374A944CFA5

Function 02DBC1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02DBC256

Memory Dump Source

Source File: 0000000B.00000002.1881855059.0000000002DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2db0000_workbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7d8e6f9d0d4425680ec0550977359db30a0cd71f5571152623a306ce21ceb614
Instruction ID: f40894f986abdb4453999424219abe9bedfb9790e2198610f6adfb3de2601d55
Opcode Fuzzy Hash: 7d8e6f9d0d4425680ec0550977359db30a0cd71f5571152623a306ce21ceb614
Instruction Fuzzy Hash: 0111DCB6D00249CFCB10DF9AC444ADEFBF4AF89624F10856AD869B7310C379A945CFA5

Function 02CED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1881206667.0000000002CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ced000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c05dfd0ebe2560da0aedc583fee654da7af5ffdb0f60c113b9ae04eca4780d
Instruction ID: a2d86a9fc4a81ca5237ef1b4b2b6482b15b325debbc885e339fb072b4570562a
Opcode Fuzzy Hash: 43c05dfd0ebe2560da0aedc583fee654da7af5ffdb0f60c113b9ae04eca4780d
Instruction Fuzzy Hash: D921F271604240DFDF14DF14D9C4B26BBA9FB84314F28C569E80B4B256C33AD447CAA1

Function 02CED005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1881206667.0000000002CED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ced000_workbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f5d0f15643b8a85068936da99cd30cef5ffd529dc3359ea6e7ecf147e8ce6c
Instruction ID: d2f122acdeff4ff5a213d4095ba0b299170f1c1956d8c41d330b7af0c957d326
Opcode Fuzzy Hash: 74f5d0f15643b8a85068936da99cd30cef5ffd529dc3359ea6e7ecf147e8ce6c
Instruction Fuzzy Hash: C42187755093C08FDB12CF24D594715BF71EB86214F28C5DAD84A8F6A7C33A950ACB62

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\doc_Zapytanie - Oferta POLSKA 91044PL.com.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\workbook.exe.log

C:\Users\user\AppData\Local\Temp\WVguSISHHEaz.bat

C:\Users\user\AppData\Roaming\SubDir\workbook.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
doc_Zapytanie - Oferta POLSKA 91044PL.com.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre